Anthropic’s Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits An unreleased Anthropic AI model found security flaws in Chrome, Safari, Android, Windows, and Linux and chained them into working proof-of-concept exploits, the company said in its latest report. The exploits were built in the lab [...]

American Organizations Under Attack: Skyw4lker Device Code Phishing Campaign Exposed Modern phishing campaigns can compromise American businesses without relying on traditional credential theft. Attackers can abuse legitimate cloud services, authentication mechanisms, and trusted business workflows to gain access to corporate accounts while leaving fewer obvious signs behind. This article covers [...]

Adobe Patches Eight Critical Campaign Classic Vulnerabilities Adobe has released patches to address multiple critical security flaws in Campaign Classic. If successfully exploited, these flaws could result in arbitrary code execution, security feature bypass, and privilege escalation. List of Vulnerabilities Adobe identified a total of eight vulnerabilities: CVE-2026-104351 (CVSS score: [...]

Placeholder Domain third-party[.]com Now Serving Malicious Content Across 1,700+ Repositories The domain third-party[.]com, commonly used as a documentation placeholder, has been observed serving a ClickFix lure to Windows browsers while displaying a harmless decoy to other users. The domain appears in references across more than 1,700 repositories. Research Commentary “third-party[.]com [...]

ThreatsDay: AI Search Poisoning, AI Coding Tool Leaking Repos, One-Click Code Execution and 13 More Stories This week, the dangerous stuff keeps arriving dressed as something boring. An update. A login box. A search answer. A coding tool. A link you have clicked a hundred times before. That is the [...]

Unpatched OnePlus Flaws Let Installed Android Apps Gain Root Without Permissions A OnePlus 15 running the latest OxygenOS can be rooted by a malicious app the owner installs — one that asks for no special permissions. A researcher, Rasmus Moorats, chained two flaws in OnePlus’s own software to gain root [...]

New cPanel Flaw Lets a Hosting Account Run Code as Root, Take Full Server Control A flaw in cPanel’s CalDAV and CardDAV service lets anyone with a cPanel hosting account run code as root and take “full control of the server,” the company said on September 22. A second bug [...]

Compromised MemTensor Packages Deliver sckit Credential Stealer via npm and PyPI Unknown threat actors have managed to compromise two legitimate MemTensor packages across the npm and Python Package Index (PyPI) repositories to push a platform-specific Go-based implant dubbed sckit, designed for Windows, Linux, and macOS. Details from Security Researchers According [...]

Windows Malware Uses AI Models to Decide Its Next Move A Windows malware called CLOSEDQUORUM is built to take orders from a vote of up to four AI models instead of an attacker’s server, Cisco Talos said on September 22. The models can choose to steal Windows credentials, saved browser [...]

Malicious npm Package Poses as Twilio Bug-Bounty Probe, Can Exfiltrate Credentials Cybersecurity researchers have disclosed details of a malicious npm package named tw-pkgprobe-7731 that masquerades as a security tool targeting developers integrating Twilio into their applications, while stealthily attempting to harvest sensitive data. The package, named tw-pkgprobe-7731, was first uploaded [...]