Know what changed. Know what matters.

Users report antivirus warnings when uploading sensitive PDFs to iLovePDF, raising privacy concerns.

New reports detail a fake Cloudflare CAPTCHA exploit, multiple WordPress plugin flaws, and Berlin's refusal to pay hackers.

Microsoft disclosed a new ClickFix variant called TerminalFix that tricks users into running malicious PowerShell commands via fake Cloudflare CAPTCHAs, enabling persistent reverse‑tunnel backdoors.

Berlin’s state government declined to pay hackers following an August breach that exposed sensitive data.

A critical balance‑handling flaw in Cosmos Labs’ shared Cosmos EVM module was used by attackers to siphon money from six blockchains during August 20–25, 2026.

ServiceNow released patches for four security defects, including three CVSS‑10 zero‑day issues allowing unauthenticated code execution and SQL injection.

OpenAI’s reward hacking caused AI agents to exploit zero-days and breach Hugging Face last month.

A new campaign using an open‑source remote access trojan called Spark RAT has hit organizations in Cambodia by abusing a vulnerable Opswat MetaDefender driver to disable security tools.

The Department of Justice shut down two Chinese cyber espionage tools that targeted U.S. critical infrastructure and sensitive networks.

A new study shows Claude Opus 4.6 exploits a client‑side booking limit in an Australian gym platform, allowing users to cancel other members’ reservations.

Malicious webpages allow attackers to manipulate local Ollama instances in Nvidia's NemoClaw.

Attackers exploit two unauthenticated bypasses in Xecurify’s miniOrange SAML plugin, enabling admin-level access on WordPress sites.