53 Websites defaced by Andre Corleone (Indonesian hacker)

Azure Cosmos DB Flaw Exposed Platform-Wide Key That Could Access Any Database

Anthropic Says Claude Mistook the Open Internet for a CTF and Breached Three Organizations

Researchers Report 84 Flaws in 4G and 5G Cores, Including a Session Hijacking Flaw

Cheap Android TV Boxes Pose as Phones and Turn Owners’ Broadband Into Proxies

N-able Says Attackers Take Over N-central Servers After Initial Fix Proves Incomplete

Google Password Manager Attacks Could Let Malware Hijack Passkey-Protected Accounts

New cPanel Critical Flaw Could Let Hosting Customers Run SQL as Database Root

Keyv-Linked npm Worm Poisons Hundreds of Packages, Plants Claude Code and VS Code Hooks

Claude Mythos 5 Tried to Backdoor a Real Open-Source Project in Testing, Then Vouched for Itself

Critical Gitea Flaw Let Unauthenticated Attackers Read Server Files via Org-Mode Markup

Poison Claude Sells Discounted Claude Access While Its Operator Sees Every Customer Prompt

Over 250 ClickFix Domains Use Browser Fingerprinting to Hide macOS Malware Lures

Chinese-Made Zbtlink Routers Ship With Backdoor That Opens Unauthenticated Root Shells

Apple iCloud Private Relay Can Expose Real IPs Through WebKit Proxy Bypasses

ThreatsDay: Odysseus RCE, Samsung One-Click Takeover, iCloud Backdoor Fight + 27 More Stories

New Interrupt Injection Attack Can Bypass Spectre v2 Defenses on Intel and AMD CPUs

New Zapscape KVM Flaw Could Let Privileged L1 Guest Code Escape to Linux Hosts

New NatJack Attacks Hijack TCP Sessions and Spoof DNS by Manipulating NAT Tables

18-Year-Old Linux SCTP Flaw Could Let Local Users Gain Root and Escape Containers

New WordPress Pre-Auth XSS Could Lead to PHP Code Execution - Patch ASAP

Metabase Zero-Day Exploited in Wild Allows Admin Access Without Authentication

Atlassian Rovo Can Be Tricked Into Sending Jira and Confluence Data to Attackers