Two unpatched OnePlus flaws let an installed no-permission app gain root on stock OxygenOS phones; no real-world exploitation is known.
Get the latest international news and world events from around the world.
TeamFiltration Campaign Compromises Seven Microsoft 365 Accounts Using Default Passwords
Cybersecurity researchers have disclosed details of an active TeamFiltration campaign codenamed UNK_CondorFiltration that has targeted over 5,700 accounts across 28 Microsoft 365 tenants.
According to Proofpoint, the activity has primarily focused on Chilean retail and financial institutions. It originated from 1,487 unique AWS EC2 source IP addresses.
“The campaign compromised 7 accounts – all of which were unmanaged functional or service accounts rather than individual employee accounts – highlighting a critical exposure gap around forgotten, non-human identities carrying default or unrotated passwords and no MFA [multi-factor authentication],” the enterprise security company said in a statement.
MacSync malware uses public iCloud calendars to deliver new payloads
A new variant of the MacSync info-stealing malware targeting macOS systems now uses public iCloud calendar events to deliver fresh payloads.
MacSync is a Swift-based malware that emerged in April 2025 and has been observed recently being delivered in ClickFix campaigns disguised as Homebrew and macOS disk space analyzer tools.
Kaspersky researchers say that while earlier versions of the malware were derived from the AMOS stealer family, MacSync evolved and added new capabilities via modules.
Exposed GitLab project email addresses let attackers push code
Private GitLab email addresses that allow developers to push issues or tasks to a project are being deliberately exposed in READMEs, contributing guides, and support pages used to collect bug reports.
The addresses are part of a built-in GitLab feature called “Email work item to this project” and contain a long-lived token tied to the developer’s account.
These addresses are generated automatically and contain a string that serves as a credential for creating work items via email. When an external client sends a message to one of them, GitLab parses it into a project issue or task.
CISA: Ransomware gangs now exploiting critical TeamCity flaw
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned federal agencies on Wednesday that ransomware gangs are now also exploiting a critical JetBrains TeamCity vulnerability patched in July.
JetBrains patched the security flaw (tracked as CVE-2026–63077) on July 25 in TeamCity On-Premises versions 2025.11.7 and 2026.1.3, saying it is a critical authentication bypass vulnerability that lets attackers with HTTP(S) access execute arbitrary operating system commands.
“An unauthenticated attacker could exploit the vulnerability via the TeamCity agent polling protocol to bypass authentication checks and execute arbitrary operating system commands with the privileges of the TeamCity server process,” it said.
Picosecond pulses push superconductors beyond their critical-current limit
Superconductors can carry electrical current without resistance, but only up to a maximum value known as the critical current. The critical current is a crucial figure of merit for applications, and materials science has long been focused on increasing this limit. Researchers at the Max Planck Institute for the Structure and Dynamics of Matter (MPSD) have now shown that, in type-II superconductors, this conventional limit can be exceeded when the current is applied for only a few picoseconds.
On these ultrashort timescales, the researchers were able to access a much higher, intrinsic limit known as the depairing current. The work has now been published in Nature Physics.
Superconductivity is one of the most striking collective phenomena in quantum materials. When certain materials are cooled below a characteristic transition temperature, their electrical resistance vanishes, and electric current can flow without dissipating energy as heat. This unusual behavior arises because electrons form correlated pairs, known as Cooper pairs, which move collectively through the material like a wave. Superconductors are therefore attractive for technologies ranging from powerful magnets and sensitive detectors to quantum circuits.
