A class-action lawsuit has been filed against xAI, the parent company of the artificial intelligence chatbot Grok, alleging that the tool has been used to generate and disseminate nonconsensual explicit images of individuals. The lawsuit, filed by a group of plaintiffs identifying as “Jane Doe,” claims that Grok’s capabilities were…

A severe sandbox escape vulnerability, CVE-2026-22709, has been identified in the widely-used vm2 Node.js library. This critical flaw, with a CVSS score of 9.8 out of 10, could allow malicious actors to execute arbitrary code on the underlying operating system, bypassing the intended security of the sandboxed environment. The vulnerability…

Cybersecurity researchers have identified two critical security vulnerabilities within the n8n workflow automation platform, with one flaw posing a severe risk of remote code execution. These newly disclosed weaknesses could allow unauthorized access to sensitive data and system control for attackers targeting n8n instances. The discoveries were made by the…

The HoneyMyte hacker group, also identified as Mustang Panda or Bronze President, has significantly evolved its cyber arsenal, notably enhancing its CoolClient malware to deploy a sophisticated browser login data stealer. This advancement poses a persistent and growing threat to government organizations throughout Asia and Europe, with a particular focus…

Security teams commonly focus on sophisticated threats like phishing or ransomware when discussing credential risks. While these evolving attack vectors demand vigilance, one of the most persistent and underestimated dangers to organizational security is far more ordinary: near-identical password reuse. This practice, often overlooked, continues to undermine security controls, even…

A novel malware delivery campaign has surfaced, employing a sophisticated blend of social engineering and legitimate Microsoft components, including Application Virtualization (App-V), to deploy information-stealing malware. The attack commences with a deceptive CAPTCHA prompt, tricking users into executing commands via the Windows Run dialog, thereby presenting the harmful action as…

Multiple threat actors, including nation-state adversaries from Russia and China, as well as financially motivated cybercriminals, are actively exploiting a critical WinRAR vulnerability (CVE-2025-8088) that was patched in July 2025. This widespread exploitation, detailed by Google Threat Intelligence, highlights ongoing risks associated with unpatched software and underscores a persistent gap…

A Chinese national has been sentenced to 46 months in prison for his role in a sophisticated cryptocurrency fraud scheme that defrauded 174 American investors of over $36.9 million. Jingliang Su was ordered to pay $26.9 million in restitution to victims by federal courts on January 27, 2026, highlighting a…

A critical security vulnerability in WinRAR, a widely used file compression tool for Windows, is being actively exploited by malicious actors to gain unauthorized control over user systems. Tracked as CVE-2025-8088, this flaw allows attackers to stealthily place malicious files into sensitive system directories, effectively compromising Windows machines. Despite a…

Researchers have uncovered a significant security threat targeting ChatGPT users through a coordinated campaign involving 16 malicious Chrome extensions. These extensions, designed to appear as legitimate ChatGPT enhancements, are actively stealing user session authentication tokens, granting attackers full access to compromised accounts and conversations. This sophisticated operation highlights the evolving…

Network security giant Fortinet has issued critical security updates to address an actively exploited FortiOS authentication bypass vulnerability. This severe flaw, identified as CVE-2026-24858, allows unauthorized access to devices, leading to potential data breaches and system compromise. The company is urging users to patch their systems immediately to prevent further…

UK security printer Zunoma has introduced a new hybrid certificate security platform, eCertSecure, targeting educational and awarding bodies in the Middle East. The platform aims to combat credential fraud and streamline the verification process by combining secure physical certificates with digitally verifiable versions, all managed through a centralized dashboard. The…