Surfshark says an internet-reachable engineering test server was accessed by an unauthorised party. It reports no user-data or VPN-service impact, but the incident exposed an important security gap.
Gen Digital traced a GRAYRABBIT intrusion to a crafted Sogou Input Method link. The link opened a six-year-old browser engine with its sandbox disabled, allowing an old JavaScript exploit to run.
Wiz observed attackers chaining two Artifactory flaws for administrator access and using a third flaw separately. Some intrusions left persistent accounts, malicious plugins and Rust backdoors.
A May package flood forced RubyGems to pause sign-ups and remove more than 500 malicious gems. New research points to AI agents, but the evidence remains disputed.
Anthropic says a Russia-linked espionage operator used AI to monitor detections and keep rebuilding malware until it was no longer detected. The attack cycle, not a single hash, is now the defensive problem.
CISA says attackers are exploiting CVE-2026-85706, a CVSS 10 GitLab flaw that can expose arbitrary server files without authentication. Self-managed operators need to update and investigate.
CISA now marks CVE-2025-14733 as used in ransomware campaigns. WatchGuard Firebox operators need to patch, investigate and rotate stored secrets.
CISA has set a 12 September deadline for CVE-2025-25249 as researchers describe attackers using compromised FortiGate devices for tunnelling, credential harvesting and internal discovery.
Sophos found a rootkit that makes Apache execute a malicious version of legitimate BIG-IP APM files while the copies on disk remain clean.
A modified ScreenConnect client can transfer and run malware when a new support session connects. The first infection still needs social engineering, but one trusted remote session can become the bridge to the next PC.
