Apple fixes WebKit vulnerability that allows same-origin policy bypass on iOS and macOS
Ravi LakshmananMarch 18, 2026Vulnerability/Zero-day Apple on Tuesday released the first round of background security improvements to address a security flaw in WebKit that affects iOS, iPadOS, and macOS. The vulnerability, tracked as CVE-2026-20643 (CVSS score: N/A), is described as a cross-origin issue in WebKit’s Navigation API that can be exploited to bypass the same-origin policy […]
Critical flaw in unpatched Telnetd (CVE-2026-32746) enables unauthenticated route RCE over port 23
Ravi LakshmananMarch 18, 2026Vulnerability/Data Protection Cybersecurity researchers have uncovered a critical security flaw affecting the GNU InetUtils Telnet daemon (telnetd). This flaw could be exploited by an unauthenticated, remote attacker to execute arbitrary code with elevated privileges. This vulnerability is tracked as CVE-2026-32746 and has a CVSS score of 9.8 out of 10.0. This is […]
AI flaws in Amazon Bedrock, LangSmith, and SGLang enable data breaches and RCEs
Cybersecurity researchers have detailed a new method for extracting sensitive data from artificial intelligence (AI) code execution environments using Domain Name System (DNS) queries. In a report published Monday, BeyondTrust revealed that Amazon Bedrock AgentCore Code Interpreter’s sandbox mode allows outbound DNS queries that attackers can exploit to enable an interactive shell and bypass network […]
LeakNet ransomware uses ClickFix and deploys Deno In-Memory Loader via hacked sites
The ransomware campaign known as LeakNet employed ClickFix social engineering tactics delivered through compromised websites as its initial access method. The use of ClickFix, which allows users to be tricked into manually running malicious commands to address non-existent errors, is a departure from relying on traditional methods of gaining initial access, such as stealing credentials […]
AI is everywhere, but CISOs are still protecting it with yesterday’s skills and tools, study finds
hacker newsMarch 17, 2026Artificial Intelligence/Security Leadership According to Penera’s AI and Adversarial Testing Benchmark Report 2026, the majority of security leaders struggle to defend their AI systems with tools and skills that are not suited to the task. This report, based on a survey of 300 U.S. CISOs and senior security leaders, examines how organizations […]
Konni introduced EndRAT through spear phishing and used KakaoTalk to spread malware
Ravi LakshmananMarch 17, 2026Threat Intelligence/Endpoint Security North Korean attackers have been observed sending phishing attacks to compromise targets, gain access to victims’ KakaoTalk desktop applications, and distribute malicious payloads to specific contacts. South Korean threat intelligence firm Genians attributes this activity to a hacker group called Konni. “Initial access was achieved through a spear-phishing email […]
CISA reports that Wing FTP vulnerability that leaks server paths is being actively exploited
Ravi LakshmananMarch 17, 2026Vulnerability/Network Security The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a medium-severity security flaw affecting Wing FTP to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. This vulnerability, CVE-2025-47813 (CVSS score: 4.3), is an information disclosure vulnerability that allows the installation path of an application to […]
GlassWorm attack uses stolen GitHub tokens to force-push malware to Python repositories
Ravi LakshmananMarch 16, 2026Malware/Cryptocurrency The GlassWorm malware campaign is being used to fuel an ongoing attack that leverages stolen GitHub tokens to inject malware into hundreds of Python repositories. “This attack targets Python projects including Django apps, ML research code, Streamlit dashboards, and PyPI packages by adding obfuscated code to files such as setup.py, main.py, […]
Chrome 0-Days, Router Botnets, AWS Breach, Rogue AI Agents & More
Ravie LakshmananMar 16, 2026Cybersecurity / Hacking Some weeks in security feel normal. Then you read a few tabs and get that immediate “ah, great, we’re doing this now” feeling. This week has that energy. Fresh messes, old problems getting sharper, and research that stops feeling theoretical real fast. A few bits hit a little too […]
Why security verification becomes agentic
If you’re running security in a fairly complex organization, your validation stack will likely look like this: In one corner is a BAS tool. It could be another penetration testing effort or an automated penetration testing product. Vulnerability scanners provide information to attack surface management platforms located elsewhere. Each tool provides a portion of the […]