A widespread spam campaign is exploiting vulnerable helpdesk systems, with Zendesk tickets hijacked to send out floods of unwanted emails globally. Victims have reported receiving hundreds of messages through compromised support channels. The emails arrive with strange, sometimes alarming subject lines, raising concerns about potential phishing or malware distribution. Security researchers say the spam appears […]
MITRE unveils ESTM 3.0, a cybersecurity framework designed to strengthen protections for embedded systems used across critical infrastructure sectors. The latest version of the Embedded System Security Technical Mitigations (ESTM) framework introduces updated guidelines aimed at addressing evolving cyber threats, particularly in environments such as energy, transportation, and manufacturing. The 3.0 release offers enhanced capabilities […]
Hackers are actively exploiting a Cisco Unified CM zero-day vulnerability that allows remote code execution without authentication, prompting the company to release an urgent security fix. Identified as CVE-2026-20045, the flaw affects Cisco’s communication platform and poses a critical risk to organizations relying on the software for enterprise connectivity. The company issued patches to address […]
The European Union is preparing a major cybersecurity overhaul that would require telecom operators to exclude high-risk foreign suppliers from core infrastructure. This legislative proposal, introduced by the European Commission, aims to fortify the EU’s digital defenses amid growing threats from state-sponsored hackers and cybercriminals targeting critical services. Under the new plan, member states must […]
A ransomware group known as Everest ransomware claims a McDonald’s India data breach that reportedly exposed sensitive customer information. The attackers say they accessed and exfiltrated internal company data, including customer records tied to the fast-food giant’s operations in India. A screenshot posted online appears to show folders containing financial records, HR information, and client […]
Poland President vetoes a key legislative act, halting the country’s plans to implement the Digital Services Act (DSA) after two years of negotiations. The veto sends the process back to the drawing board, requiring legislators to start from scratch. The long-awaited implementation was intended to align Poland with the European Union’s digital framework, but the […]
The European Union has launched its own public vulnerability platform, marking a notable advancement in digital sovereignty. The EU’s GCVE cuts reliance on global systems, such as the U.S.-based Common Vulnerabilities and Exposures (CVE), by offering a European-managed alternative for tracking cybersecurity flaws. Operated under the GCVE initiative, the newly live EU Vulnerability Database enables […]
European Digital Rights (EDRi) seeks a spyware ban across the EU with the launch of a new document pool focused on surveillance technologies. The pool compiles EDRi’s research, advocacy, and policy analysis, alongside selected third-party materials, to support a comprehensive ban on spyware. By centralizing resources, EDRi aims to bolster transparency and equip civil society […]
A Jordanian admits selling access to more than 50 enterprise networks in a U.S. court after striking deals with an undercover agent posing as a cybercriminal. Acting as an access broker, the defendant marketed unauthorized entry to compromised corporate systems, allowing potential buyers to exploit the network environments. Court documents reveal that the illicit activity […]
Attackers hijack paychecks without breaching a single system, exploiting human behavior instead of deploying malware or hacking tools. The scheme came to light when employees reported missing salary deposits. Investigators soon uncovered that the attacker had modified direct-deposit details and rerouted funds to bank accounts under their control. The attacker used social engineering to impersonate […]
Threat actors are abusing Visual Studio Code extensions to deploy multistage malware, targeting developer environments rather than end-user machines. In a recent campaign dubbed Evelyn Stealer, attackers hid the malicious payload within a trojanized extension that installs a fake Lightshot.dll file. This component loads via Lightshot.exe when a screenshot is taken, initiating the infection chain. […]
A critical vulnerability in the “Advanced Custom Fields: Extended” WordPress plugin threatens over 100,000 websites with potential takeover. The advanced custom fields flaw, tracked as CVE-2025-14533, could allow attackers to execute arbitrary code and gain administrative access on affected sites. This plugin enhances the default WordPress custom fields and is widely used for building complex […]