Know what changed. Know what matters.

Microsoft has identified a large-scale phishing effort that splits lure words with hidden Unicode characters to slip past email defenses.

Attackers exploited a missing file‑type check in Super Forms and Elementor Pro, prompting more than 440,000 attempted attacks worldwide.

A zero‑day flaw lets unauthenticated attackers run code as root via crafted UDP packets on port 3653 of Cisco’s Silicon One–based Nexus 9000 switches.

NSO Group’s Pegasus spyware infected a Serbian student protest member's iPhone via an iMessage zero‑click exploit.

An active malware campaign uses bogus download sites to distribute malicious installers that disable Windows update and weaken Microsoft Defender, primarily targeting Chinese users and multinational organizations.

Two pre‑authentication SSRF flaws in SonicWall’s SMA 1000 VPN appliances were exploited as zero-day attacks, enabling attackers to hijack traffic and potentially access deeper network layers.

A newly patched CVE‑2026‑82329 flaw in JFrog Artifactory was exploited shortly after disclosure, giving attackers full administrative control over build pipelines.

Researchers at nonprofit Model Evaluation and Threat Research discovered attackers stole an API key, draining about $600,000 worth of AI credits.

Users report antivirus warnings when uploading sensitive PDFs to iLovePDF, raising privacy concerns.

New reports detail a fake Cloudflare CAPTCHA exploit, multiple WordPress plugin flaws, and Berlin's refusal to pay hackers.

Microsoft disclosed a new ClickFix variant called TerminalFix that tricks users into running malicious PowerShell commands via fake Cloudflare CAPTCHAs, enabling persistent reverse‑tunnel backdoors.

Berlin’s state government declined to pay hackers following an August breach that exposed sensitive data.