Microsoft has disclosed details of a new ClickFix variant, dubbed TerminalFix, that aims to trick users into running a malicious command in Windows Terminal or PowerShell. “While traditional ClickFix campaigns direct victims to the Windows Run dialog, TerminalFix campaigns apply the same technique but direct users to Windows Terminal orRead More »TerminalFix Uses Fake Cloudflare CAPTCHAs to Deploy Reverse-Tunnel Backdoor

Multiple critical security flaws have been disclosed in WordPress plugins and themes, including WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP, that could lead to authentication bypass, account takeover, and arbitrary code execution. The vulnerabilities, according to Wordfence and Patchstack, are listed below – CVE-2026-76581 (CVSS score: 9.8) – AnRead More »Five Critical WordPress Plugin and Theme Flaws Enable Site Takeover or RCE

Berlin’s state government has confirmed that it is the target of an extortion attempt following the August compromise of the city’s state administrative network, and said it will not meet the extortionists’ demands. The same statement disclosed that forensic work had found further data outflows in the portfolio of theRead More »Berlin Refuses to Pay Hackers Who Stole Data From the City’s State Network

Cosmos Labs has warned that a critical balance-handling flaw in the shared Cosmos EVM module was exploited to drain funds from six blockchains between August 20 and August 25, 2026. The vulnerability, designated GHSA-7g4w-cg88-2cq2, is rated Critical by Cosmos Labs and was published without a CVE identifier, a weakness classification,Read More »Cosmos EVM Flaw Exploited After Cosmos Labs Knew Every Blockchain Running It Was Vulnerable

Malicious actors are exploiting a newly patched security flaw in PaperCut NG and MF to execute arbitrary code on susceptible instances, as the company released a fresh emergency fix with additional hardening. “This vulnerability gives an unauthenticated attacker remote control over PaperCut’s trusted configuration, which could be used to executeRead More »Attackers Chain Two PaperCut Flaws to Execute Code Without Authentication

Meta will be making adjustments to its platforms following an $18 billion settlement. 

Google on Thursday announced new network security protections in Android 17 to bolster connection privacy, address cellular vulnerabilities, and safeguard the privacy of users’ home networks. Topping the list is support for Encrypted Client Hello (ECH), a privacy standard that prevents networks from eavesdropping on which websites a user isRead More »Android 17 Adds OS-Wide ECH to Hide Website Visits From Network Providers

100 technology firms released an open letter calling for “collective action” for cyber defense.