3+ day, 8+ hour ago   (539+ words) Research published by Noma Labs researcher Sasi Levi reveals that this attack does not rely on prompt injection, stolen credentials, or jailbreaking an AI model. Instead, it exploits a fundamental authorization flaw: AI workflows can process untrusted input from low-privileged…...

3+ day, 3+ hour ago   (533+ words) Skullcandy Dime 3 wireless earbuds have a serious vulnerability related to unauthenticated Bluetooth pairing. This flaw allows nearby attackers to silently pair with the earbuds, disrupt legitimate audio sessions, and potentially capture microphone audio. This issue, tracked as VU#859658 by the…...

3+ day, 2+ hour ago   (616+ words) Nearly one in 10 internet-exposed LiteLLM AI gateways accepted the widely documented default master key, sk-1234, or required no authentication, creating a direct path to LLMjacking, sensitive credential exposure, and in vulnerable versions root-level code execution inside the gateway container. Their…...

4+ day, 5+ hour ago   (1549+ words) Best value overall: Bitdefender — competent managed XDR at pricing that mid-market organizations can approve, which most of this list cannot claim. Best telemetry breadth: Palo Alto Unit 42. Best for keeping your existing tools: Stellar Cyber and ReliaQuest. MXDR is MDR…...

4+ day, 8+ hour ago   (312+ words) cPanel has disclosed CVE-2026-67401, a SQL injection vulnerability in its EmailTrack functionality. This flaw allows an authenticated account holder to create arbitrary files on a server, which can ultimately enable them to execute code with root privileges. The issue, published…...

4+ day, 10+ hour ago   (569+ words) The campaign scans IPv4 address ranges for Redis services exposed to the internet, typically on TCP port 6379, then attempts to interact with instances that allow connections without authentication. Once access is obtained, the attackers use Redis’s administrative CONFIG SET command to…...

5+ day, 10+ hour ago   (616+ words) A known Shai-Hulud npm worm payload has resurfaced after 111 days of inactivity, raising fresh questions about the effectiveness of registry-level malware screening. The May campaign demonstrated how quickly a single compromised maintainer account can turn into a software supply-chain incident....

5+ day, 6+ hour ago   (596+ words) A newly documented ransomware intrusion attributed to The Gentlemen shows how attackers can convert a foothold in a Windows environment into domain-wide control by elevating accounts, turning off endpoint defenses, and abusing trusted Active Directory infrastructure to distribute ransomware. The…...

5+ day, 5+ hour ago   (801+ words) DNS security delivers more blocked attacks per dollar than any other network control when you buy the right shape at the right tier. Published per-user tier: DNSFilter and SafeDNS publish per-user monthly pricing (single-digit dollars, volume breaks); Cloudflare Gateway runs…...

5+ day, 2+ hour ago   (1582+ words) Best value overall: Fortinet. Delivered directly and through the largest partner network in security, at price points the premium providers can’t approach provided you vet the actual delivery partner. Best global reach: NTT Data. Best if you want to stop…...