Ransomware gangs are exploiting a high-severity flaw in Windows Task Host, a core component that could allow them to escalate privileges and wreak havoc on your system. This vulnerability, already patched by Microsoft, poses significant risks to users, especially those with basic user permissions.
Good news: your SafePal wallet credentials and financial info are safe - the recent data breach exposed non-sensitive customer records, including names, email addresses, and purchase details, of around 39,798 customers.
A critical vulnerability, CVE-2025-62593, is under active exploitation, allowing hackers to execute remote code through web browsers like Firefox and Safari by using a clever DNS rebinding attack. This high-severity flaw, with a CVSS score of 9.4, stems from a weakness in the Ray project's defenses against browser-based attacks.
Beware of hackers lurking on public Wi-Fi networks at hotels, conference centers, and other hotspots, who are using a sneaky trick to steal your login credentials by hijacking the network's DNS settings. By changing just one setting, they can redirect you to fake login pages that look legit - and that's all they need to get their hands on your sensitive info.
Financial firms are under attack by a relentless extortion group called BlackFile, which has been targeting the sector with alarming persistence since the start of the year. This threat actor has also set its sights on other industries, including med tech, with no signs of slowing down.
Meet the sneaky new tactic Iranian hackers are using to evade detection: blending malicious traffic with everyday services like Google Apps Script. By leveraging DNS A-record responses, they're able to switch between direct HTTPS channels and Google Apps Script relays, making it harder to track their moves.
A critical vulnerability in the Forminator Forms WordPress plugin can let hackers upload malicious PHP files to your site, allowing them to take control and wreak havoc - all without needing a login. This flaw, tracked as CVE-2026-15748, has a near-perfect severity score of 9.8, making it a high-priority threat.
A threat actor known as TheHatman is selling employee data from top companies like McDonald's and Tata Consultancy Services, allegedly stolen from Microsoft Azure tenants using compromised credentials. The stolen records total 3.6 million, with McDonald's alone accounting for 1.7 million employee records.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
A recent cyberattack on CEVA Logistics, a major shipping company, has compromised customer data at the Pokémon Center, forcing the cancellation of some orders due to an unforeseen fulfilment issue. The breach, which occurred between July 29 and August 1, has disrupted operations for multiple retailers in Europe.
A newly discovered flaw in UNISOC modem firmware can be exploited to execute arbitrary code with kernel privileges, allowing hackers to gain deep access to Android devices. Simply making a video call to a vulnerable phone can trigger the attack.
GitHub is currently experiencing a widespread outage, with performance problems affecting several of its key services, including Copilot, its AI coding tool, causing disruptions for developers globally. The company confirmed the issue on August 17, 2026, at 9:40 AM EDT and is actively investigating the cause.
A recent investigation revealed that a suspected China-nexus APT group is actively exploiting a critical VMware vCenter vulnerability, CVE-2026-59310, to execute arbitrary code and deploy a backdoor, with ransomware seemingly used as a smokescreen to distract from the underlying intrusion. The attackers' true intentions appear to go beyond mere ransomware deployment.
Security researchers have uncovered a two-stage exploit chain that can give attackers full access to the Android kernel on devices using Unisoc modem firmware, and alarmingly, the vendor has remained unresponsive to disclosure efforts. This chain can be triggered by a simple malformed video call, putting countless devices at risk.
Major companies like Philips, General Electric, and Shell are investigating claims by the Clop ransomware gang that their systems were breached, with Philips confirming a contained breach of an internal server that didn't affect customers. The incidents are a stark reminder of the growing threat of ransomware attacks on businesses.
A threat actor known as TheHatman is peddling a staggering 1.7 million employee records from McDonald's, along with millions more from other top firms, allegedly stolen from Microsoft Azure environments. The breach, which Hudson Rock deems highly authentic, has left giants like Vodafone, Tata Consultancy Services, and IHG Hotels & Resorts vulnerable.
Apple just sounded the alarm for users in 110 countries, warning them they've been targeted by highly sophisticated mercenary spyware attacks that are among the most advanced digital threats out there. This latest alert is part of a multi-year effort to protect users, with notifications now sent to customers in over 150 countries.
Full-platform Rapid7 rollouts - InsightVM, InsightIDR, event sources, agents, tuning - by a Registered Partner who has done it at state-agency scale, including OT/SCADA.
Talk deployment
Beware of a sneaky recruitment phishing scam that used fake interview pages and a clever Browser-in-the-Browser trick to steal Google and Facebook credentials from over 3,000 unsuspecting victims in just two months. This cunning attack even fooled multi-factor authentication, putting countless users at risk.
Meet the upgraded CoolClient backdoor, now armed with a signed Windows rootkit that lets it hide in plain sight, and a closer look reveals it's linked to the notorious HoneyMyte threat group, aka Mustang Panda. This sneaky malware has been targeting victims in Myanmar, Mongolia, Pakistan, and more.
Hackers are exploiting "dropcatch domains" - previously owned domains that are re-registered by new owners - to redirect traffic to scams and malware, taking advantage of the reputation and connections they inherit from their past life. With nearly one in five new domain registrations being a re-registration of an expired name, the threat is more widespread than you might think.
Apple just released emergency updates to fix a critical flaw in macOS Screen Sharing that hackers were using to secretly install Monero miners on vulnerable Macs. The updates, available for macOS Tahoe, Sequoia, and Sonoma, patch a vulnerability that allowed attackers to bypass authentication and gain unauthorized access.
SAP Commerce Cloud has a critical vulnerability, known as CVE-2026-58231, that allows unauthenticated attackers to wreak havoc by executing arbitrary code and compromising internal components. This maximum-severity flaw, scoring a perfect 10.0 on the CVSS scale, stems from weak authorization checks and input validation.
A China-linked APT group has been exploiting a recently patched VMware vCenter vulnerability to deploy ransomware in a widespread campaign that hit 361 victims across 47 countries. The attackers used the flaw to gain root access and, in some cases, installed a Babuk-derived ransomware that locks files with a ".babyk" extension.
Don't worry, SafePal has confirmed that sensitive info like your seed phrase, private keys, and bank account details were not compromised in the breach that exposed the order info of 39,798 customers. The exposed data includes names, email and shipping addresses, phone numbers, and purchase details of customers who placed orders between March 2025 and April 2026.
Meet Evooo1Bot, a sneaky new Linux botnet that's been quietly hijacking edge devices since July 2026, turning them into SOCKS5 proxies by exploiting known vulnerabilities. This cunning botnet is built on the Mirai codebase, but with a range of upgraded capabilities that make it a formidable foe.