Anthropic Mythos Helped Build a macOS M5 Kernel Exploit
Calif says researchers used Anthropic’s Mythos Preview to build a local macOS kernel exploit chain on an M5 Mac in five days. Details are withheld while Apple works on fixes.
FrostyNeighbor Targets Ukraine With PDF Lures and PicassoLoader
ESET says FrostyNeighbor is using fake Ukrtelecom-themed PDF lures, Ukrainian geofencing, JavaScript PicassoLoader, and selective Cobalt Strike delivery against Ukrainian government targets.
Device Code Phishing: Microsoft Login Trap and Token Theft
Device code phishing uses a real Microsoft login page to authorize an attacker session. Learn 2026 lure red flags, response steps, and Microsoft 365 admin checks.
Avada Builder CVEs Put WordPress Sites at File Read and SQLi Risk
Avada Builder patched two WordPress vulnerabilities that could expose server files or database data. Site owners should update to 3.15.3 and review affected access paths.
FunnelKit Checkout Skimmer Hits WooCommerce Payment Pages
Attackers are abusing vulnerable FunnelKit/Funnel Builder installations to inject checkout skimmers into WooCommerce stores. Check External Scripts, unknown WebSocket loaders, and plugin versions.
Microsoft Details Kazuar Botnet Used by Secret Blizzard
Microsoft published a technical analysis of Kazuar, a modular Secret Blizzard botnet with P2P routing, staging directories, IPC messages, and selectable C2 bridges.
NGINX CVE-2026-42945 Exposes Rewrite Rules to Crash and RCE Risk
CVE-2026-42945 affects NGINX rewrite rules that combine unnamed PCRE captures with question-mark replacements. Patch to 1.30.1 or 1.31.0 and audit rewrite directives.
Burst Statistics CVE-2026-8181 Exploited for WordPress Admin Takeover
Attackers are exploiting CVE-2026-8181 in the Burst Statistics WordPress plugin. Update to 3.4.2 and check admin users, application passwords, and REST API activity.
Exchange Server CVE-2026-42897 Exploited Through Crafted OWA Email
Microsoft says Exchange Server CVE-2026-42897 has exploitation detected. The current protection path is Exchange Emergency Mitigation Service, not a normal update package yet.
Cisco Catalyst SD-WAN CVE-2026-20182 Exploited in Limited Attacks
Cisco patched CVE-2026-20182, a critical Catalyst SD-WAN authentication bypass under limited exploitation. Check SD-WAN peering logs, vmanage-admin SSH entries, and fixed release trains before routine cleanup.
node-ipc npm Package Compromised With Credential Stealer
Malicious node-ipc versions 9.1.6, 9.2.3, and 12.0.1 were published to npm with a credential-stealing CommonJS payload. Check lockfiles, CI logs, and egress for the new indicators.
KongTuke Uses Microsoft Teams Help-Desk Lures to Drop ModeloRAT
KongTuke moved from web-based ClickFix lures into external Microsoft Teams chats, using fake help-desk messages to push ModeloRAT and layered persistence on Windows hosts.
