Skip to content
Top 5 Critical Security Alerts
- Critical Vulnerability in Anthropic's MCP Exposes Developer Machines to Remote Exploits — A flaw (CVE-2025-49596, CVSS 9.4) in Anthropic's Model Context Protocol (MCP) Inspector project allows remote code execution. Attackers could gain complete access to the hosts. Read more
Threat Intelligence (APT, malware, ransomware)
- U.S. Sanctions Russian Bulletproof Hosting Provider for Supporting Cybercriminals Behind Ransomware — The U.S. Treasury has sanctioned Aeza Group for assisting cybercriminals, including those behind ransomware attacks. Sanctions extend to its subsidiaries. Read more
- Silver Fox Suspected in Taiwanese Campaign Using DeepSeek Lure — Attackers are using sideloading to deliver a Gh0stRAT variant, posing as a DeepSeek LLM installer. Read more
- TA829 and UNK_GreenSec Share Tactics and Infrastructure in Ongoing Malware Campaigns — Proofpoint has flagged tactical similarities between RomCom RAT actors (TA829) and UNK_GreenSec, who are delivering TransferLoader. Read more
- DoJ Disrupts North Korean IT Worker Scheme Across Multiple US States — The US conducted searches of 29 "laptop farms" across 16 states and seized 29 financial accounts used to launder funds from North Korean IT workers. Read more
- Scope, Scale of Spurious North Korean IT Workers Emerges — Microsoft warns thousands of North Korean workers have infiltrated tech, manufacturing, and transportation sectors to steal money and data. Read more
Security Breaches & Incidents
- Chrome Zero-Day, 'FoxyWallet' Firefox Attacks Threaten Browsers — Separate threats targeting Chrome (zero-day) and Firefox (malicious extensions) highlight the growing security risk for enterprises. Read more
Security Tools & Best Practices
- LevelBlue Acquires Trustwave, Forms World's Largest Independent MSSP — The combined entity will offer cyber consulting, managed detection and response, and incident response services. Read more
- How Businesses Can Align Cyber Defenses With Real Threats — Companies that understand attacker motivations and position themselves ahead of the competition will better protect their operations and reputation. Read more
- We've All Been Wrong: Phishing Training Doesn't Work — Teaching employees to detect malicious emails isn't effective; organizations need alternative options. Read more
- Ransomware Reshaped How Cyber Insurers Perform Security Assessments — Cyber insurance companies adapted to address security weaknesses highlighted by the ransomware surge. Read more
Cloud & Network Security
- That Network Traffic Looks Legit, But it Could be Hiding a Serious Threat — Nearly 80% of cyber threats mimic legitimate user behavior, making detection challenging for SOCs. Breaches at edge devices and VPN gateways have risen significantly. Read more
Emerging Security Technologies (AI, XDR, CNAPP)
- Vercel's v0 AI Tool Weaponized by Cybercriminals to Rapidly Create Fake Login Pages at Scale — Threat actors are using Vercel's v0 AI to generate functional phishing sites from simple text prompts. Read more
- Like SEO, LLMs May Soon Fall Prey to Phishing Scams — Attackers could use techniques similar to SEO poisoning to manipulate LLM responses from user prompts. Read more