PaperCut confirmed the active exploitation of two flaws in NG and MF. Emergency Patch Release 2 is also intended for organizations that already deployed the original emergency fix.
Manchester Airports Group confirmed a cyber incident involving customer data. The FulcrumSec group claimed responsibility, but its claims about the volume and scope of the data remain only partially verified.
Socket’s analysis describes 19 malicious extensions with modular malware that could steal login credentials, sessions and crypto wallet data.
Wiz honeypot telemetry showed persistent attempts to exploit AI and MCP services. Researchers also recorded attacks targeting two LiteLLM vulnerabilities for which fixes are available.
Following a cyber incident in the state administrative network, Berlin confirmed an extortion attempt. The city will not meet the demands, while the investigation has uncovered another data leak.
Security bulletin QSB-118 warns of a flaw when transferring a file from dom0 to a malicious qube. Under certain conditions, it allows an arbitrary command to be executed in dom0.
The California Legislature approved AB 1856, which would exempt software distributed with rights to copy, redistribute, and modify it from age-signal requirements. The bill is not yet law.
A federal court in California halted Pentagon measures against Anthropic. Judge Rita Lin called the government’s actions unconstitutional retaliation for the company’s protected speech.
The Australian Federal Police and Western Australia Police Force have charged two men as part of an investigation into the TeamPCP campaign. U.S. authorities have also unsealed an indictment against Ruben Ian Thomson.
Ledger’s security bulletin warns of a bug in the Ethereum app versions 1.19.0 through 1.22.2. A fix is available in version 1.22.3.