Know what changed. Know what matters.

A firmware flaw in Coldcard wallets let attackers drain over 1,000 accounts for roughly $70 million on July 30.

A hijacked hotel Wi‑Fi network pushed a fake browser update that installed CornFlake, enabling attackers to record webcams, microphones, and keystrokes of guests.

A suspected Chinese‑speaking threat group has been attacking government organizations across Central Asia using OctLurk and SilkLurk since January 2025.

OAuth-based device code phishing has exploded into an industrial‑scale threat targeting IoT devices, raising privacy risks worldwide.

Threat actors linked to North Korea deployed fake macOS updates that deliver crypto‑stealing malware.

Hackers leveraged trusted Korean web pages to inject SIGNBT or COPPERHEDGE backdoors into AnySign4PC installers, allowing covert surveillance without user prompts.

Ruby on Rails’ Active Storage vulnerability (CVE‑2026‑66066) lets attackers upload images that reveal server secrets.

A critical login flaw in Check Point’s SmartConsole allows attackers to impersonate administrators using valid session tokens.

Researchers found 24,650 out of 36,872 exposed Baseboard Management Controllers disclosing pre‑login password hashes via IPMI.

A critical flaw in JetBrains’ on‑premises TeamCity allows attackers to run arbitrary OS commands without authentication.

After law‑enforcement action on JackSkid, the Dysphoria IoT botnet switched to blockchain-based command and control, making takedowns harder.

China-linked group uses Cruciferra crypter to embed malware in legitimate processes, evading detection.