‘CoGUI’ Phishing Kit Helps Chinese Hackers Target Japan
Japan is being peppered with an overwhelming volume of spam, thanks to a new platform popular across the East China Sea.
-
-
AI Agents Fail in Novel Ways, Put Businesses at Risk
Microsoft researchers identify 10 new potential pitfalls for companies who are developing or deploying agentic AI systems, with failures potentially leading to the AI becoming a malicious insider.
-
TikTok Fined €530 Million Over Chinese Access to EU Data
European regulators sent an unmistakable message about messing around with GDPR-protected data. How can organizations avoid similar compliance hassles?
-
Meta Wins Lawsuit Against Spyware Vendor NSO Group
The spyware company must pay the tech giant $168 million in punitive and compensatory damages after a 2019 attack targeting 1,400 devices.
-
Play Ransomware Group Used Windows Zero-Day
Previously, Microsoft reported that Storm-2460 had also used the privilege escalation bug to deploy ransomware on organizations in several countries.
-
"Bring Your Own Installer" Attack Targets SentinelOne EDR
Researchers from Aon’s Stroz Friedberg incident response firm discovered a new attack type, known as “Bring Your Own Installer,” targeting misconfigured SentinelOne EDR installs.
-
Infrastructure as Code: An IaC Guide to Cloud Security
IaC is powerful. It brings speed, scale, and structure to cloud infrastructure. But none of that matters if your security can’t keep up.
-
Europol Shuts Down Six DDoS-for-Hire Services Used in Global Attacks
Europol has announced the takedown of distributed denial of service (DDoS)-for-hire services that were used to launch thousands of cyber-attacks across the world. In connection with the operation, Polish authorities have arrested four individuals and the United States has seized nine domains that are associated with the now-defunct platforms. “The suspects are believed to be…
-
OttoKit WordPress Plugin with 100K+ Installs Hit by Exploits Targeting Multiple Flaws
A second security flaw impacting the OttoKit (formerly SureTriggers) WordPress plugin has come under active exploitation in the wild. The vulnerability, tracked as CVE-2025-27007 (CVSS score: 9.8), is a privilege escalation bug impacting all versions of the plugin prior to and including version 1.0.82. “This is due to the create_wp_connection() function missing a capability check…
-
SysAid Patches 4 Critical Flaws Enabling Pre-Auth RCE in On-Premise Version
Cybersecurity researchers have disclosed multiple security flaw in the on-premise version of SysAid IT support software that could be exploited to achieve pre-authenticated remote code execution with elevated privileges. The vulnerabilities, tracked as CVE-2025-2775, CVE-2025-2776, and CVE-2025-2777, have all been described as XML External Entity (XXE) injections, which occur when an attacker is