Hackers are exploiting critical RCE flaw in Wing FTP Server

Hackers have started to exploit a critical remote code execution vulnerability in Wing FTP Server just one day after technical details on the flaw became public. [...] | Continue reading


@bleepingcomputer.com | 18 hours ago

'123456' password exposed chats for 64 million McDonald’s job applicants

Cybersecurity researchers discovered a vulnerability in McHire, McDonald's chatbot job application platform, that exposed the chats of more than 64 million job applicants across the United States. [...] | Continue reading


@bleepingcomputer.com | 1 day ago

Exploits for pre-auth Fortinet FortiWeb RCE flaw released, patch now

Proof-of-concept exploits have been released for a critical SQLi vulnerability in Fortinet FortiWeb that can be used to achieve pre-authenticated remote code execution on vulnerable servers. [...] | Continue reading


@bleepingcomputer.com | 1 day ago

WordPress Gravity Forms developer hacked to push backdoored plugins

The popular WordPress plugin Gravity Forms has been compromised in what seems a supply-chain attack where manual installers from the official website were infected with a backdoor. [...] | Continue reading


@bleepingcomputer.com | 1 day ago

NVIDIA shares guidance to defend GDDR6 GPUs against Rowhammer attacks

NVIDIA is warning users to activate System Level Error-Correcting Code  mitigation to protect against Rowhammer attacks on graphical processors with GDDR6 memory. [...] | Continue reading


@bleepingcomputer.com | 1 day ago

The zero-day that could've compromised every Cursor and Windsurf user

Learn how one overlooked flaw in OpenVSX discovered by Koi Secureity could've let attackers hijack millions of dev machines via an extension supply chain attack. The zero-day threat's been patched—but the wake-up call is clear: extensions are a new, massive supply chain risk. [.. … | Continue reading


@bleepingcomputer.com | 1 day ago

CISA tags Citrix Bleed 2 as exploited, gives agencies a day to patch

The U.S. Cybersecurity & Infrastructure Security Agency has confirmed active exploitation of the CitrixBleed 2 vulnerability (CVE-2025-5777) in Citrix NetScaler ADC and Gateway and is giving federal agencies one day to apply fixes. [...] | Continue reading


@bleepingcomputer.com | 1 day ago

Windows 11 now uses JScript9Legacy engine for improved security

Microsoft announced that it has replaced the default scripting engine JScript with the newer and more secure JScript9Legacy on Windows 11 version 24H2 and later. [...] | Continue reading


@bleepingcomputer.com | 2 days ago

Russian pro basketball player arrested for alleged role in ransomware attacks

Russian professional basketball player Daniil Kasatkin was arrested in France at the request of the United States for allegedly acting as a negotiator for a ransomware gang. [...] | Continue reading


@bleepingcomputer.com | 2 days ago

PerfektBlue Bluetooth flaws impact Mercedes, Volkswagen, Skoda cars

Four vulnerabilities dubbed PerfektBlue and affecting the BlueSDK Bluetooth stack from OpenSynergy can be exploited to achieve remote code execution and potentially allow access to critical elements in vehicles from multiple vendors, including Mercedes-Benz AG, Volkswagen, and Sk … | Continue reading


@bleepingcomputer.com | 2 days ago

FBI's CJIS demystified: Best practices for passwords, MFA & access control

FBI's Criminal Justice Information Services (CJIS) compliance isn't optional when handling law enforcement data. From MFA to password hygiene, see how Specops Software helps meet FBI standards while also securing your Windows Active Directory. [...] | Continue reading


@bleepingcomputer.com | 2 days ago

Four arrested in UK over M&S, Co-op, Harrod cyberattacks

The UK's National Crime Agency (NCA) arrested four people suspected of being involved in cyberattacks on major retailers in the country, including Marks & Spencer, Co-op, and Harrods. [...] | Continue reading


@bleepingcomputer.com | 2 days ago

Microsoft Authenticator on iOS moves backups fully to iCloud

Microsoft is rolling out a new backup system in September for its Authenticator app on iOS, removing the requirement to use a Microsoft personal account to back up TOTP secrets and account names. [...] | Continue reading


@bleepingcomputer.com | 3 days ago

Microsoft confirms Windows Server Update Services (WSUS) sync is broken

Microsoft has confirmed a widespread issue in Windows Server Update Services (WSUS) that prevents organizations from syncing with Microsoft Update and deploying the latest Windows updates. [...] | Continue reading


@bleepingcomputer.com | 3 days ago

Qantas confirms data breach impacts 5.7 million customers

Australian airline Qantas has confirmed that 5.7 million people have been impacted by a recent data breach, in which threat actors stole customers' data. [...] | Continue reading


@bleepingcomputer.com | 3 days ago

Google reveals details on Android’s Advanced Protection for Chrome

Google is sharing more information on how Chrome operates when Android mobile users enable Advanced Protection, highlighting strong security improvements. [...] | Continue reading


@bleepingcomputer.com | 3 days ago

Bitcoin Depot breach exposes data of nearly 27,000 crypto users

Bitcoin Depot, an operator of Bitcoin ATMs, is notifying customers of a data breach incident that has exposed their sensitive information. [...] | Continue reading


@bleepingcomputer.com | 3 days ago

Ruckus Networks leaves severe flaws unpatched in management devices

Multiple vulnerabilities that remain unpatched in Ruckus Wireless management products could be exploited to fully compromise the network environment they serve. [...] | Continue reading


@bleepingcomputer.com | 3 days ago

Ingram Micro starts restoring systems after ransomware attack

Ingram Micro has begun restoring systems and business services after suffering a massive SafePay ransomware attack right before the July 4th holiday. [...] | Continue reading


@bleepingcomputer.com | 3 days ago

Treasury sanctions North Korean over IT worker malware scheme

The U.S. Department of the Treasury sanctioned cyber actor Song Kum Hyok for his association with North Korea's hacking group Andariel and for facilitating IT worker schemes that generated revenue for the Pyongyang regime. [...] | Continue reading


@bleepingcomputer.com | 3 days ago

The MFA You Trust Is Lying to You – and Here's How Attackers Exploit It

MFA Authenticator apps aren't cutting it anymore. Attackers are bypassing legacy MFA with fake sites and real-time phishing. Token Ring and BioStick stop them cold—with fingerprint-bound hardware. Learn more from Token. [...] | Continue reading


@bleepingcomputer.com | 3 days ago

New ServiceNow flaw lets attackers enumerate restricted data

A new vulnerability in ServiceNow, dubbed Count(er) Strike, allows low-privileged users to extract sensitive data from tables to which they should not have access. [...] | Continue reading


@bleepingcomputer.com | 3 days ago

Samsung announces major security enhancements coming to One UI 8

Samsung has announced multiple data security and privacy enhancements for its upcoming Galaxy smartphones running One UI 8, its custom user interface on top of Android. [...] | Continue reading


@bleepingcomputer.com | 4 days ago

M&S confirms social engineering led to massive ransomware attack

M&S confirmed today that the retail outlet's network was initially breached in a "sophisticated impersonation attack" that ultimately led to a DragonForce ransomware attack. [...] | Continue reading


@bleepingcomputer.com | 4 days ago

New Android TapTrap attack fools users with invisible UI trick

A novel tapjacking technique can exploit user interface animations to bypass Android's permission system and allow access to sensitive data or trick users into performing destructive actions, such as wiping the device. [...] | Continue reading


@bleepingcomputer.com | 4 days ago

Microsoft July 2025 Patch Tuesday fixes one zero-day, 137 flaws

Today is Microsoft's July 2025 Patch Tuesday, which includes security updates for 137 flaws, including one publicly disclosed zero-day vulnerability in Microsoft SQL Server. [...] | Continue reading


@bleepingcomputer.com | 4 days ago

Android malware Anatsa infiltrates Google Play to target US banks

The Anatsa banking trojan has sneaked into Google Play once more via an app posing as a PDF viewer that counted more than 50,000 downloads. [...] | Continue reading


@bleepingcomputer.com | 4 days ago

Overcoming Technical Barriers in Desktop and Application Virtualization

Exposed RDP ports are an open door for attackers. TruGrid SecureRDP enforces Zero Trust and MFA, blocks lateral movement, and secures remote access—no open firewall ports required. Learn more and get a free trial. [...] | Continue reading


@bleepingcomputer.com | 4 days ago

Malicious Chrome extensions with 1.7M installs found on Web Store

Almost a dozen malicious extensions with 1.7 million downloads in Google's Chrome Web Store could track users, steal browser activity, and redirect to potentially unsafe web addresses. [...] | Continue reading


@bleepingcomputer.com | 4 days ago

Alleged Chinese hacker tied to Silk Typhoon arrested for cyberespionage

A Chinese national was arrested in Milan, Italy, last week for allegedly being linked to the state-sponsored Silk Typhoon hacking group, which responsible for cyberattacks against American organizations and government agencies. [...] | Continue reading


@bleepingcomputer.com | 5 days ago

Public exploits released for CitrixBleed 2 NetScaler flaw, patch now

Researchers have released proof-of-concept (PoC) exploits for a critical Citrix NetScaler vulnerability, tracked as CVE-2025-5777 and dubbed CitrixBleed2, warning that the flaw is easily exploitable and can successfully steal user session tokens. [...] | Continue reading


@bleepingcomputer.com | 5 days ago

Employee gets $920 for credentials used in $140 million bank heist

Hackers stole nearly $140 million from six banks in Brazil by using an employee's credentials from C&M, a company that offers financial connectivity solutions. [...] | Continue reading


@bleepingcomputer.com | 5 days ago

Atomic macOS infostealer adds backdoor for persistent attacks

Malware analyst discovered a new version of the Atomic macOS info-stealer (also known as 'AMOS') that comes with a backdoor, to attackers persistent access to compromised systems. [...] | Continue reading


@bleepingcomputer.com | 5 days ago

Qantas is being extorted in recent data-theft cyberattack

Qantas has confirmed that it is now being extorted by threat actors following a cyberattack that potentially exposed the data for 6 million customers. [...] | Continue reading


@bleepingcomputer.com | 5 days ago

'Batavia' Windows spyware campaign targets dozens of Russian orgs

A previously undocumented spyware called 'Batavia' has been targeting large industrial enterprises in Russia in a phishing email campaign that uses contract-related lures. [...] | Continue reading


@bleepingcomputer.com | 5 days ago

Hackers abuse leaked Shellter red team tool to deploy infostealers

Shellter Project, the vendor of a commercial AV/EDR evasion loader for penetration testing, confirmed that hackers used its Shellter Elite product in attacks after a customer leaked a copy of the software. [...] | Continue reading


@bleepingcomputer.com | 5 days ago

OpenAI says GPT-5 will unify breakthroughs from different models

OpenAI has again confirmed that it will unify multiple models into one and create GPT-5, which is expected to ship sometime in the summer. [...] | Continue reading


@bleepingcomputer.com | 6 days ago

Hands on with Windows 11 Notepad's new markdown support

Notepad now lets you use markdown text formatting on Windows 11, which means you can write in Notepad just like you could in WordPad. [...] | Continue reading


@bleepingcomputer.com | 6 days ago

ChatGPT is testing disruptive Study Together feature

OpenAI's "Study together" mode has been spotted in the wild, and it could help students prepare for exams directly from ChatGPT. [...] | Continue reading


@bleepingcomputer.com | 6 days ago

Ingram Micro outage caused by SafePay ransomware attack

An ongoing outage at IT giant Ingram Micro is caused by a SafePay ransomware attack that led to the shutdown of internal systems, BleepingComputer has learned. [...] | Continue reading


@bleepingcomputer.com | 7 days ago

Google's AI video maker Veo 3 is now available via $20 Gemini

Google says Veo 3, which is the company's state-of-the-art video generator, is now shipping to everyone using the Gemini app with a $20 subscription. [...] | Continue reading


@bleepingcomputer.com | 8 days ago

ChatGPT Deep Research tests new connectors for more context

ChatGPT Deep Research, which is an AI research tool to automate research, is getting support for new connectors (integrations), including Slack. [...] | Continue reading


@bleepingcomputer.com | 8 days ago

Ingram Micro suffers global outage as internal systems inaccessible

IT giant Ingram Micro is experiencing a global outage that is impacting its websites and internal systems, with customers concerned that it may be a cyberattack after the company remains silent on the cause of the issues. [...] | Continue reading


@bleepingcomputer.com | 8 days ago

Hacker leaks Telefónica data allegedly stolen in a new breach

A hacker is threatening to leak 106GB of data allegedly stolen from Spanish telecommunications company Telefónica in a breach that the company did not acknowledge. [...] | Continue reading


@bleepingcomputer.com | 8 days ago

Leaks hint at Operator-like tool in ChatGPT ahead of GPT-5 launch

A few new code references in the ChatGPT web app and Android point to an Operator-like tool in GPT's chain of thoughts. [...] | Continue reading


@bleepingcomputer.com | 9 days ago

xAI prepares Grok 4 Code as it plans to take on Claude and Gemini

xAI is preparing the rollout of Grok 4, which replaces Grok 3 as the new state-of-the-art model. [...] | Continue reading


@bleepingcomputer.com | 9 days ago

Police dismantles investment fraud ring stealing €10 million

The Spanish police have dismantled a large-scale investment fraud operation based in the country, which has caused cumulative damages exceeding €10 million ($11.8M). [...] | Continue reading


@bleepingcomputer.com | 9 days ago

Grafana releases critical security update for Image Renderer plugin

Grafana Labs has addressed four Chromium vulnerabilities in critical security updates for the Grafana Image Renderer plugin and Synthetic Monitoring Agent. [...] | Continue reading


@bleepingcomputer.com | 9 days ago