Know what changed. Know what matters.

Microsoft’s own boot‑time driver BTR.sys can delete security software on Windows 7–11 25H2 without exploiting any external flaw.

ByteDance’s TikTok settles a child‑privacy lawsuit for $400 million while researchers uncover trojanized npm packages and Microsoft Defender driver weaponization.

Kaspersky discovered Android-based malware targeting DoFun vehicle firmware via built‑in updaters, enabling ad fraud and forming a proxy botnet.

A set of trojanized npm modules masquerading as calendar and streak utilities secretly installed an AI‑powered Linux backdoor called RedC2 4.0 on affected systems.

A critical flaw in Microsoft's Entra ID lets attackers hijack OAuth tokens to run code on tenants—Microsoft says it’s already mitigated but urges users to audit app registrations.

Three suspected Russian threat groups hijack user sessions by abusing legitimate Google OAuth linking with WhatsApp.

New ToxicPanda version adds 167 commands and PIN-harvesting across more than 140 banking apps.

Researchers disclosed a remote Spectre attack against Cloudflare Workers that leaks JWTs up to 12 bits per second—360 times faster than the earliest 2021 demo.

CISA has identified four critical vulnerabilities, including a high‑severity authentication flaw in macOS (CVE‑2026‑65400), that attackers are actively exploiting.

Senator Maggie Hassan’s report shows how data‑brokerage firms fuel scams and identity theft, costing consumers billions.

A new typosquatting attack named StubMaker targets RubyGems packages, stealing browser credentials and crypto‑wallet data from developers.

A critical flaw in GitLab’s GraphQL API could let attackers modify or delete public projects without authentication [thehackernews.com].