Google released an urgent update for Chrome to fix two vulnerabilities that can be exploited by simply visiting malicious web pages. Users should ensure they're on version 143.0.7499.146 or later to stay protected from potential attacks.

Researchers found insecure bootstrap scripts in legacy Python packages that could allow attackers to exploit a domain takeover. The scripts fetch an outdated installation package from a now-available domain, which poses a risk of executing malicious code. Some affected packages have removed the scripts, but others, like slapos.core, still include them.

GoBruteforcer is a botnet attacking cryptocurrency databases to brute-force user passwords for various services. Its operators exploit weak credentials and misconfigured servers to expand their control, utilizing a mix of common usernames and a persistent malware infrastructure. Recent activities also show attempts to identify blockchain accounts with funds.

Researchers found that hackers are using the React2Shell vulnerability to compromise NGINX web servers, redirecting traffic for malicious purposes. This can lead to malware infections and damage to an organization's reputation. CSOs are advised to secure server configurations and apply the latest security patches.

Attackers exploited vulnerabilities in SolarWinds Web Help Desk to steal high-privilege credentials from various organizations. Microsoft is investigating which specific flaws were used, as multiple recent and old CVEs are in play. Security teams are advised to apply patches and monitor for unauthorized remote management tools.

Microsoft has addressed multiple zero-day vulnerabilities in Windows and Office that hackers are actively exploiting. These flaws allow attackers to execute malware with minimal user interaction, primarily through malicious links and files. Security experts warn of a high risk of system compromise and ransomware deployment.

Google patched 107 vulnerabilities in Android, including two high-severity flaws currently being exploited. Users should check their Android version and update to at least the 2025-12-05 patch level to ensure these issues are resolved. It's important to only install apps from trusted sources and keep devices up to date for security.

Research reveals over 4,500 Clawdbot/Moltbot instances are publicly exposed, allowing attackers to extract sensitive data like API keys and WhatsApp session credentials. The vulnerabilities stem from insecure design, misconfigured dashboards, and excessive permissions. Immediate action is recommended for users to mitigate risks.

The article discusses the vulnerabilities associated with TCC (Transparency, Consent, and Control) on macOS, which regulates app access to sensitive user data. It highlights the misconceptions among developers regarding TCC's importance in protecting user privacy and outlines various scenarios where malware could exploit TCC bypasses.

The article discusses the evolution of malware, highlighting a new variant known as ClickFix that emerged from the notorious MonsterRat. It examines the techniques used by this malware to exploit vulnerabilities and the implications for cybersecurity.

A new strain of malware named "Gayfemboy," based on the Mirai botnet, has been identified targeting vulnerabilities in devices from various vendors including DrayTek and TP-Link. The malware has shown evolved techniques for obfuscation, self-protection, and remote control, enabling attackers to gain control over infected systems and conduct DDoS attacks across multiple sectors worldwide.

AgentHopper, an AI virus concept, was developed to exploit multiple coding agents through prompt injection vulnerabilities. This research highlights the ease of creating such malware and emphasizes the need for improved security measures in AI products to prevent potential exploits. The post also provides insights into the propagation mechanism of AgentHopper and offers mitigations for developers.

A recent supply chain attack has compromised several npm packages, allowing the distribution of backdoor malware. This incident highlights vulnerabilities in the software supply chain, emphasizing the need for enhanced security measures in package management systems.

A report has revealed that 40 npm packages have been compromised as part of a supply chain attack, exposing vulnerabilities that could potentially affect thousands of projects. The malicious packages were designed to steal sensitive data and create backdoors for attackers, highlighting the ongoing risks in open-source software ecosystems. Developers are urged to review their dependencies and ensure they are not using affected packages.

The article discusses the vulnerabilities associated with AgentFlayer, a malware designed to exploit weaknesses in Android devices. It highlights the methods used by the malware to gain unauthorized access and the potential impact on users' data security. Recommendations for mitigating these risks are also provided.

Hackers are compromising end-of-life SonicWall Secure Mobile Access appliances, exploiting leaked administrator credentials and potentially using a custom backdoor malware called Overstep. Google’s Threat Intelligence Group urges organizations to analyze their devices for signs of compromise, as many details about the attacks and vulnerabilities remain unclear.

SystemBC is a proxy botnet that exploits vulnerable commercial virtual private servers (VPS) to maintain an average of 1,500 bots daily, facilitating high volumes of malicious traffic. With over 80 command-and-control servers, it has been utilized by various threat actors, including ransomware gangs, and is characterized by long infection lifetimes and numerous unpatched vulnerabilities in compromised systems. Researchers highlight that SystemBC's operations are designed for volume rather than stealth, making detection challenging for security efforts.