Know what changed. Know what matters.

Microsoft’s SharePoint authentication flaw has been actively exploited, a Windows zero‑day backdoor was deployed by Lazarus Group against defense firms worldwide, and almost 800 VPN Chrome extensions have been discovered funneling user traffic through hidden proxies.

A study found 737 free Chrome extensions redirect user traffic through Russian proxies, affecting about 75 000 installs.

A new Microsoft SharePoint flaw lets attackers bypass authentication by tweaking HTTP headers, risking broad corporate data exposure.

North Korean Lazarus Group exploited a patched Microsoft Windows flaw to install a backdoor targeting defense firms in France, Germany, Brazil, and India.

Threat actors are exploiting a newly patched VMware vCenter directory‑traversal flaw that lets them gain persistent remote control on affected systems.

Microsoft released a patch closing CVE‑2026‑68820, a Windows kernel driver flaw that attackers are using to elevate privileges and take full control over compromised systems.

Researchers discovered that Windows 11’s Plug‑and‑Play can be abused via USB auto‑install over Remote Desktop to grant full system takeover.

Microsoft disclosed that the financially motivated actor Storm‑1175 deployed a previously undocumented ransomware strain named StormEncryptor, written in C++ and appending a .encrypted extension.

A malicious Visual Studio Code extension called Solidity Pro has been found stealing users’ crypto wallets and credentials.

Atlassian’s Rovo assistant can be tricked into sending user data to attackers via prompt injection, while recent research shows webmail interfaces are vulnerable to CSS-based XSS that steals credentials and tokens, and a zero‑day in Metabase allows unauthenticated remote attackers to inject SQL for admin access.

Security researchers discovered Atlassian’s AI assistant Rovo can be tricked into sending users’ Jira or Confluence data to attackers.

New CSS attacks allow theft of passwords on popular webmail services.