Know what changed. Know what matters.

After law‑enforcement action on JackSkid, the Dysphoria IoT botnet switched to blockchain-based command and control, making takedowns harder.

China-linked group uses Cruciferra crypter to embed malware in legitimate processes, evading detection.

A SourTrade campaign tricks browsers into compiling a Windows executable from JavaScript served by trusted sites, targeting retail traders.

Researchers published a proof‑of‑concept that lets authenticated GitLab users execute shell commands as the “git” user on unpatched, self‑managed instances.

Researchers uncovered a new DCSync exploit letting ordinary Active Directory users obtain domain controller credentials.

Companies discover that merely monitoring AI agents is not enough; enforcing least‑privilege controls proves harder than expected.

A state-backed Russian unit leveraged an unknown Zimbra webmail flaw to harvest email contents and two-factor recovery codes from Western organizations, prompting NSA and CISA alerts.

Attackers build fake machine identities from real data fragments, bypassing traditional checks.

A local privilege‑escalation bug in Ubuntu’s snap‑confine lets unprivileged users gain root on default desktop installs.

Authorities dismantled the core infrastructure of the widely used Kratos phishing kit and arrested its developer.

Apple patched a flaw that let users’ real addresses appear in Mail app logs after a year‑long discovery by Tyler Murphy.

Open‑source Android AI agents can covertly transmit commands via hidden overlays, letting attackers run code on connected PCs.