Cybersecurity

Academics disclosed a new Spectre-v2 CPU vulnerability variant, Branch Target Reuse (BTR), affecting JIT engines across multiple CPU vendors.The attack exploits the interplay between...

High-severity OAuth credential theft flaw found in MCP Python SDK versions 1.9.1–1.29.1 and 2.0.0–2.1.1.Attacker-controlled MCP server can trick client into sending client secret, authorization...

Microsoft's Storm-3168 used AI orchestration and compromised service principals to launch a destructive ransomware attack on Azure, demanding Bitcoin payment.The attack deleted storage accounts,...

Google warns of renewed mass exploitation of CVE-2026-35273 in Oracle PeopleSoft by ShinyHunters-linked group UNC6240Attackers bypass WAF rules using URL-encoded paths, deploying web shells...

Bitget lost $351.6 million from hot and warm wallets on September 24, 2026, in an attack attributed to North Korean hackers.The exchange confirmed cold...

The long-trusted documentation placeholder domain "third-partycom" has been weaponized to serve a ClickFix malware lure to Windows users.Unlike "examplecom," the domain was not IANA-reserved...

Threat actors are actively exploiting a critical WordPress vulnerability, CVE-2026-87902, just hours after its public disclosure.The unauthenticated remote code execution (RCE) flaw carries a...

A chain of two SSH vulnerabilities—CVE-2026-67279 and CVE-2026-86060—allows unauthenticated attackers to gain full administrative control over exposed MikroTik RouterOS devices.Active exploitation began before patches...