A Meta AI agent exposed sensitive company and user data to unauthorized employees for over two hours, triggering a Sev 1 incident.
Get the latest international news and world events from around the world.
Suspected Russian Hackers Abuse Google OAuth and WhatsApp Linking to Hijack Accounts
Three distinct suspected Russian cyber espionage threat clusters have been observed leveraging legitimate authentication flows to single out individuals working in academia, aerospace and defense, governments, and think tanks across Europe, as well as academia and think tanks within the U.S.
These clusters include UNC6293, UNC7005, and UNC5976.
“These clusters engage in persistent, adaptive phishing campaigns, using sophisticated social engineering tactics to compromise personal accounts across multiple platforms,” Google Threat Intelligence Group (GTIG) researchers Gabby Roncone and Wesley Shields said in a report published today.
New Cryptographic Context Injection Attack Could Let Web Pages Steal Grok Chat Data
Adversa says encrypted prompt injection can make Grok send a user’s name, location, tier, and chat prompts to an attacker-controlled server.
Hackers poison arrayref Rust crate to push infostealer malware
Hackers compromised the maintainer account behind the widely used Rust crate arrayref to introduce malware that executed on developers’ systems during compilation.
Within a 23-minute window, the attacker also poisoned two other crates, append-only-vec and internment, in the same supply-chain attack.
The arrayref crate is a popular Rust library with more than 53 million downloads over the past 90 days that is used by cryptography, graphics, and blockchain tools.
Critical Elementor Pro bug exposes WordPress sites to RCE attacks
A critical vulnerability in the Elementor Pro WordPress plugin could allow attackers to upload executable files for remote code execution on the server.
Identified as CVE-2026–32475, the flaw affects Elementor Pro versions before 4.2.2 and stems from the File Upload module, which uses separate loops for file validation and processing that handle empty filename uploads differently.
“The problem is that these two loops disagree about what to do with an empty file entry (an upload part whose filename is blank, which PHP reports as UPLOAD_ERR_NO_FILE),” clarifies a report from Patchstack, a cybersecurity company focused on the WordPress ecosystem.
Citrix urges admins to patch new NetScaler flaws as soon as possible
Citrix has warned customers to immediately secure their systems against two vulnerabilities affecting NetScaler Gateway secure remote access solutions and NetScaler ADC networking appliances.
The most severe of the two, tracked as CVE-2026–19490, can allow remote attackers without privileges to bypass authentication when the appliance is configured as an AAA virtual server or as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy), depending on the NetScaler firmware version and whether SAML Action is configured.
Admins can check if an appliance is vulnerable to attacks targeting CVE-2026–19490 by inspecting their NetScaler configuration for SAML action configuration (add authentication samlAction.• string and Auth or VPN vserver (‘add authentication vserver.*’ and ‘add vpn vserver.*’) strings.
New Manic Android malware can exfiltrate data through nearby devices
A new Android malware named Manic targeting users in multiple European countries has a fallback mechanism for exfiltrating data through nearby infected devices.
The malware has been active since at least February and combines spyware, banking fraud, and remote control capabilities.
It targets at least 169 banking, government/eID, payment, crypto wallet, messaging, and authenticator/2FA apps, with users in Ukraine being the primary focus.