LIVE

NEWS_FEED

Featured

FEATUREDThreat Intel2026-03-1916 min read

DarkSword iPhone Spyware Exposed. Russia-Linked Group Weaponized Ukrainian Websites to Silently Compromise 220 Million Vulnerable Devices

A full-chain iOS exploit called DarkSword has been silently compromising iPhones since November 2025, deployed through watering hole attacks on Ukrainian news and government websites by the Russia-linked group UNC6353. The exploit chains six zero-day vulnerabilities to achieve kernel privileges and deploys three malware families that steal everything from crypto wallets to iCloud data before self-destructing within minutes. An estimated 220 million iPhones running iOS 18.4 through 18.7 were in the blast radius.

#DarkSword#iOS-exploit#zero-click

Read Report

Latest Intel

Every Default Ubuntu Desktop Installation Since 24.04 Has a Root Privilege Escalation Bug. Here Is How It Works.

Vulnerability

2026-03-19·13m read

Every Default Ubuntu Desktop Installation Since 24.04 Has a Root Privilege Escalation Bug. Here Is How It Works.

A high-severity local privilege escalation flaw (CVE-2026-3888, CVSS 7.8) in default Ubuntu Desktop 24.04+ installations lets any unprivileged user gain full root access. The bug exploits a race condition between snap-confine and systemd-tmpfiles, where a deleted /tmp/.snap directory can be recreated with malicious content that gets bind-mounted as root during Snap sandbox initialization. Patches are available now.

#CVE-2026-3888#Ubuntu

Read

CVE-2026-32746 — Critical Unpatched Telnetd Flaw Enables Pre-Auth Root RCE via a Single Packet to Port 23

Vulnerability

2026-03-18·16m read

CVE-2026-32746 — Critical Unpatched Telnetd Flaw Enables Pre-Auth Root RCE via a Single Packet to Port 23

A critical pre-authentication buffer overflow (CVE-2026-32746, CVSS 9.8) in GNU inetutils telnetd through version 2.7 allows unauthenticated remote attackers to achieve root-level code execution by sending a single crafted packet during the Telnet handshake — before any login prompt appears. The flaw in the LINEMODE SLC handler is currently unpatched. This is the second critical telnetd RCE in 2026 — the first (CVE-2026-24061) is already under active exploitation in the wild.

#CVE-2026-32746#telnetd

Read

GlassWorm Hits React Native — Two Popular npm Packages Backdoored with Multi-Stage Credential Stealer via Solana Blockchain C2

Malware

2026-03-18·22m read

GlassWorm Hits React Native — Two Popular npm Packages Backdoored with Multi-Stage Credential Stealer via Solana Blockchain C2

The GlassWorm campaign has compromised two widely-used React Native npm packages — react-native-country-select@0.3.91 and react-native-international-phone-number@0.11.8 — injecting a multi-stage Windows credential and cryptocurrency stealer that uses the Solana blockchain as its primary C2 channel. Over 134,000 monthly downloads were in the blast radius. The attack executes on a simple `npm install` with zero visual indicators — no malicious code is visible in any editor or code review tool.

Intuitive Surgical Hit by Phishing Attack — Employee Credentials Stolen, Customer and Corporate Data Exposed

Intuitive Surgical, the maker of da Vinci robotic surgical systems, has disclosed a targeted phishing attack that compromised an employee's credentials and allowed unauthorized access to its internal administrative network. Employee records and limited customer business and contact information were accessed — but the company's surgical platforms and hospital networks were not affected, due to network segmentation that held.

#data-breach#healthcare

Read

More Stories

Data Breach2026-03-17 · 20m read

Stryker Wiper Attack — Iran-Linked Handala Group Weaponizes Microsoft Intune to Mass-Wipe 200,000+ Devices Across 79 Countries

Iran-linked hacktivist group Handala (Void Manticore / Storm-0842) claimed responsibility for a devastating wiper attack on medical technology giant Stryker Corporation. The attackers weaponized Microsoft Intune's legitimate remote wipe capability to factory-reset over 200,000 devices — servers, laptops, and mobile phones — across 79 countries, while claiming to exfiltrate 50 TB of data. No traditional malware was used. The attack represents a paradigm shift in destructive operations: identity compromise as a weapon of mass disruption.

Threat Intel2026-03-17 · 34m read

Threat Intel Weekly #11 — Week ending 17 Mar 2026

This week: two Chrome zero-days (EPSS 27% — top 1% globally) with an incomplete initial patch, a CVSS 9.9 n8n sandbox escape exploited by MuddyWater and Zerobot v9 botnet hitting 24,700+ exposed instances, a WordPress LMS OAuth bypass hit 300 times in 24h, unauthenticated Modbus RCE on energy meters, and a CVSS 10.0 pre-auth n8n companion CVE you may have missed.

Privacy2026-03-14 · 6m read

Meta Kills Instagram End-to-End Encryption on May 8, 2026 — What It Means for Your Privacy

Meta has officially announced that Instagram Direct will end support for end-to-end encrypted chats on May 8, 2026. The rollback removes the privacy layer that prevented Meta and third parties from reading message contents — and users who don't export their data before the deadline may permanently lose access to their encrypted chat history.

Data Breach2026-03-14 · 6m read

Telus Digital Confirms Security Breach as ShinyHunters Claim 1 Petabyte of Stolen Data

Canadian BPO giant Telus Digital has confirmed a multi-month security incident after the ShinyHunters group claimed to have exfiltrated nearly 1 petabyte of data including source code, telecom records, and sensitive customer data for 28 global brands — all via GCP credentials stolen in a 2025 supply-chain attack.

Threat Intel2026-03-08 · 17m read

Threat Intel Weekly #09 — Week ending 08 Mar 2026

This week's digest covers 14 CVEs published between 2026-03-01 and 2026-03-08, including a critical unauthenticated RCE in IDExpert MFA Agent, a zero-day in DB-GPT, phar deserialization in Chamilo LMS, and 7 new CISA KEV additions spanning VMware Aria Operations, Qualcomm chipsets, Rockwell Logix, and Hikvision cameras.

Threat Intel2026-02-24 · 8m read

Threat Intel Weekly #08 — Week ending 24 Feb 2026

This week's digest covers 8 critical and 6 high-severity CVEs published between 2026-02-17 and 2026-02-24, plus 8 new CISA Known Exploited Vulnerabilities. Add your summary here.

Vulnerability2026-02-20 · 4m read

Critical Jenkins Vulnerability Exposes Build Environments to XSS Attacks

A newly published Jenkins security advisory has confirmed multiple vulnerabilities in Jenkins Core, including a high-impact stored Cross-Site Scripting (XSS) flaw that could allow attackers to compromise CI/CD build environments.

Malware2026-02-16 · 5m read

New ZeroDayRAT Mobile Spyware Enables Full-Spectrum Surveillance on Android and iOS

A new cross-platform mobile RAT dubbed ZeroDayRAT provides attackers with live camera/mic streaming, SMS/OTP interception, crypto wallet theft, and banking overlay attacks across Android 5-16 and iOS up to version 26.

Malware2026-02-15 · 4m read

Malicious Campaign Uses Claude AI Artifacts and Google Ads to Deliver MacSync Infostealer

A sophisticated malvertising campaign abuses Google Ads and public Claude AI Artifacts to trick macOS users into executing terminal commands that install the MacSync infostealer, targeting credentials and hardware crypto wallets.