Know what changed. Know what matters.

A new variant of the DarkSword exploit kit now steals crypto wallet data and can issue remote commands on iPhone devices.

Roughly 1,280 third‑party AI products bypass standard identity controls, exposing hidden security risks.

Porn sites rely on global CDNs, making removal of content hard.

A malicious workflow was pushed via Takashi Kitao’s account into more than 340 open‑source projects, exposing CI/CD pipelines to credential theft.

A new study shows enterprise identity systems lag behind generative AI speeds, creating privacy and security gaps.

A U.S.-sanctioned cybersecurity firm built a portal that let attackers steal emails from Southeast Asian institutions.

Sixteen malicious Firefox add‑ons now siphon cryptocurrency recovery phrases during import flows.

Hackers stole control of three country‑code domain registries and issued fraudulent HTTPS certificates for multiple Google sites.

A newly disclosed Atlassian data‑center flaw lets attackers read sensitive files across Bitbucket, Confluence, Jira, and more within minutes of public disclosure.

A new phishing scheme uses fake ad portals for popular AI chatbots to steal usernames, passwords, and MFA codes.

A patched CVE-2026-96940 lets authenticated attackers read other users’ mailboxes on Microsoft Exchange servers.

Apple requires app developers to declare full‑disk access usage in macOS Monterey, aiming to curb AI agents that silently harvest user data.