Bitget’s $388 Million Breach Now Points to a Third-Party Security Product
Bitget says its $388 million breach may have begun in a third-party security product, exposing credentials used to send fraudulent withdrawal commands.
One Browser Extension Can Secretly Command Five AI Assistants
The extension did not need to persuade the model. It impersonated the channel the browser’s privileged assistant was built to trust.
Webform Can Turn Stored Data Into Executable Logic
Inspect display settings and verify the installed fix.
One Request Could Make Adobe AEM Forms Run Code Without a Login
The bulletin contains six separate vulnerabilities. The most urgent crosses the authorization boundary before an attacker has any account.
The Fake TV App That Can Watch Your Screen, Steal Your PIN and Stop You Removing It
A fake TV app can cut Google Play Protect off from the network, watch a victim’s screen, steal banking PINs and resist removal.
Attackers Are Trying to Turn a WordPress Template Bug Into Code Execution
WordPress fixed a conditional code-execution path on 22 September. Within hours, attackers were trying to turn the flaw into PHP file writes.
The FBI Confirms Its Jobs Portal Was Compromised but Not What Was Taken
FBI cyber chief says a contractor missed an issued patch. His statement does not establish the platform or data impact.
Attackers Are Exploiting the System That Manages the Rest of Your Network
A compromised orchestrator is not just another vulnerable server. It is the trusted control point for the edge devices around it.
EvilTokens Compromised 12,000 Inboxes and Let AI Choose the Next Victim
The AI did more than write convincing phishing messages. It read stolen mailboxes, mapped trust and told criminals which relationships were most valuable to abuse.
One OAuth Profile Can Turn BIG-IP APM Into a Remote Code Execution Target
F5 says attackers are already exploiting a critical BIG-IP APM flaw. The first job is not simply to patch, but to preserve evidence and find out whether the gateway has already been touched.
Chrome Fixed 11 Critical Flaws Before the CVE Databases Could Catch Up
Chrome 154 fixes 11 critical flaws across graphics and browser components, but teams cannot wait for downstream vulnerability databases before deploying it.
A Local Process Could Redirect Muse and Inherit Everything the Agent Could Reach
The weakness needed code already running on the Mac. From there, it could redirect the agent's input and inherit the reach the user had granted it.