Ethan Andrews

Researchers identified multiple vulnerabilities in the Cursor AI IDE, including workspace binary planting and malicious MCP server installations, leading to remote code execution.

An unknown Chinese-speaking APT group is targeting Russian critical sectors by exploiting the ViPNet update system to deploy a suite of malicious modules including HelloInjector and HelloProxy.

A 16-year-old use-after-free vulnerability in the Linux KVM shadow MMU (CVE-2026-53359) allows guest VMs to escape to the host on x86 Intel and AMD systems.

The GoSerpent campaign utilizes a sophisticated suite of Go-based backdoors and specialized loaders to collect and exfiltrate sensitive data from government and diplomatic entities in Southeast Asia.

The Forg365 Phishing-as-a-Service platform utilizes AI-assisted lures, device-code flow abuse, and a custom browser extension to compromise and maintain access to Microsoft 365 environments.

CrashStealer is a native C++ macOS information stealer that impersonates Apple crash-reporting tools and uses notarized droppers to harvest credentials, keychain data, and crypto wallets.

The n8n workflow automation platform's Enterprise token exchange feature failed to validate the JWT issuer claim, allowing cross-issuer account takeovers.

The China-linked threat actor Silver Fox (UTG-Q-1000) is utilizing SEO poisoning and counterfeit installers to deliver a modular Rust-based RAT called MODBEACON featuring gRPC-encrypted communications.

The Helix data extortion group uses social engineering and device code phishing to hijack Microsoft 365 accounts and exfiltrate sensitive SharePoint data.

An unauthenticated remote attacker can achieve kernel-mode code execution or denial-of-service by exploiting an integer overflow in the Windows HTTP.sys driver over TLS connections.