VulnerabilitiesCVE-2026-66066 exploited in the wild: crafted image uploads abuse Rails Active Storage and libvips to read arbitrary files and steal secrets.
RansomwareBerlin confirmed data theft from two ministries in a cyberattack and refused to pay ransom. Rhysida claims 5.79TB stolen, unverified by officials.
MalwareMicrosoft's TerminalFix uses fake CAPTCHAs and PowerShell to deliver steganographic malware, creating encrypted tunnels into corporate networks.
VulnerabilitiesHardBreacher is a PoC privilege escalation exploit targeting Kaspersky Endpoint Security's UI process. Kaspersky says a fix is available via update.
MalwareValleyRAT backdoor spreads via trojanized QN Wallpaper installer using DLL sideloading to disable Windows Defender and gain full remote control.
RansomwareAurora ransomware used Cursor with Claude Sonnet for attacks on 20+ orgs. Zig encryptor for Windows, Linux, ESXi. Details inside.
APTSygnia uncovers Fire Ant's cyber-espionage expanding to Cisco IOS XR routers, TACACS servers, and Linux hosts using invisible tunnels and credential theft.
MalwareDiscover how TerminalFix malware uses fake Cloudflare CAPTCHAs to trick users into installing a reverse-tunnel backdoor via Windows Terminal, posing a serious threat to organizations.
VulnerabilitiesPaperCut releases emergency patches for two exploited zero-day vulnerabilities, CVE-2026-81578 and CVE-2026-82078, allowing authentication bypass and arbitrary code execution.