Researchers at Nebula Security have disclosed GhostLock (CVE-2026-43499), a 15-year-old Linux kernel flaw that lets any logged-in user take full root control of a machine that has not been patched. The vulnerable code has shipped by default in essentially every mainstream distribution since 2011. The flaw needs no special permission, no unusual settings, andRead More »15-Year-Old GhostLock Flaw Enables Root and Container Escape on Most Linux Distros

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added four security flaws to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerabilities are listed below – CVE-2026-48282 (CVSS score: 10.0) – A path traversal vulnerability in Adobe ColdFusion that could lead to arbitrary codeRead More »CISA Adds 4 Actively Exploited Adobe, Joomla, and Langflow Flaws to KEV

A prominent Japanese telecommunications organization revealed a data breach may have impacted 12.2 million customer emails.

A new Android malware operation called RedWing is being rented out on Telegram as a ready-made bank-fraud service. It lets even low-skill criminals take over a victim’s phone, steal their banking logins, and capture the one-time codes that protect their accounts. Zimperium’s zLabs, which found the operation, says it looksRead More »RedWing MaaS Packages Android Bank Fraud as a Telegram Rental Service

A critical flaw in Google’s Dialogflow CX could have let an attacker with edit rights on one Code Block-enabled agent compromise other Code Block-enabled agents in the same Google Cloud project. From there, they could read live conversations, steal the data users shared, and make the bots send attacker-written messages,Read More »Rogue Agent Flaw Could Have Let Attackers Hijack Google Dialogflow CX Chatbots

A Microsoft 365 device code phishing campaign has been observed leveraging collaboration-themed lures to take control of victim accounts between the last week of June 2026 and into early July, per findings from ZeroBEC. “The campaign did not depend on a fake Microsoft password page. It used a malicious collaboration-styleRead More »DEBULL Tooling Abuses Microsoft Device-Code Flow to Target M365 Accounts

The DHS announced it is investigating a data breach involving an information-sharing network. 

A public issue can trick GitHub Agentic Workflows into leaking the contents of an organization’s private repositories, researchers at Noma Security have shown. The attacker needs only to open a normal-looking issue on a public repository, with no stolen credentials and no access to the organization. If that organization hasRead More »Public GitHub Issue Could Trick GitHub Agentic Workflows Into Leaking Private Repo Data