Author: Staff Writer

Fast Facts Multiple critical vulnerabilities in vm2 (CVEs with scores up to 10.0) enable sandbox escape, arbitrary code execution, and remote command execution via methods like "lookupGetter", "inspect", and prototype pollution. Attackers can exploit these flaws to access host system resources, run malicious code, or bypass security restrictions, severely compromising system integrity. Users are urged to update to version 3.11.2 immediately, as these vulnerabilities persist across several versions and pose a significant risk of remote exploitation. Threat Overview, Attack Techniques, and Targets A series of critical vulnerabilities have been found in the vm2 Node.js library. These flaws can allow attackers…

Fast Facts Google has rolled out Chrome 148, addressing 127 security vulnerabilities, including three critical flaws with high exploit risk, marking one of the most security-intensive updates recently. Major vulnerabilities include use-after-free bugs in Blink, Chromoting, and WebGL, and an integer overflow in Blink’s rendering engine, all patched to prevent arbitrary code execution. Over $100,000 in bug bounties was awarded to external researchers for discovering these flaws, with a single researcher receiving $55,000 for a high-severity out-of-bounds flaw in V8. Users are urged to update immediately to Chrome 148.0.7778.96/97 on Windows, Mac, and Linux, with the next update scheduled for…

Top Highlights During the Milano Cortina 2026 Winter Games, DDoS attack volume against Italian infrastructure surged 181% compared to 2025, with over 12,963 attacks during the event period, peaking at more than 2,200 attacks on February 23. Attackers predominantly used UDP flooding (85%) combined with amplification techniques such as DNS and memcached, shifting from high-bandwidth attacks pre-Games to packet rate–intensive strikes during the event. NoName057(16) was the most active threat actor, claiming 40% of attacks against Italy during the Games, primarily targeting Milan and Cortina, with their DDoS platform DDoSia mainly employed in these campaigns. The attacks exploited predictable windows…

Essential Insights Darkhub, a dark web platform on Tor, openly offers a wide range of illegal hacking services, including social media account breaches, message interception, financial manipulation, and cryptocurrency fraud, targeting both individuals and organizations. Despite marketing itself as a legitimate business, Darkhub’s infrastructure includes a publicly accessible IP address linked to a U.S.-based hosting provider known for bulletproof hosting, raising concerns about operational security and exposure. Its services, such as fund recovery and credit score manipulation, suggest scams that prey on victims of prior fraud, offering false promises of recovering stolen funds—indicating potential layers of deception. The platform’s infrastructure,…

Summary Points Armadin and CrowdStrike partner to combat AI-driven hyperattacks by integrating offensive AI testing with defensive cybersecurity measures. Armadin’s platform continuously identifies vulnerabilities using an agentic swarm, providing ongoing security insights rather than periodic assessments. The collaboration shifts cybersecurity from traditional pentesting to real-time, continuous resilience through threat simulation and proactive remediation. Industry leaders emphasize that integrating autonomous offensive and defensive AI is critical to staying ahead in a rapidly evolving cyber threat landscape. Combining Offensive and Defensive Strategies for Better Cybersecurity Recently, Armadin and CrowdStrike announced a new partnership to fight AI-driven cyberattacks. As these attacks become faster…

Quick Takeaways A defense tech company with $3.4M DoD contracts exposed sensitive military training materials and personnel data due to API endpoints lacking proper authorization controls. The vulnerability allowed low-privilege users to access data across multiple tenants, including confidential courses, operational manuals, and personally identifiable information of service members. The security lapse was detected after a 150-day disclosure process, highlighting delayed vulnerability response despite repeated warnings from security researchers. The incident underscores the risks of inadequate authorization in multi-tenant defense platforms, potentially exposing operational details and personnel information outside authorized channels. What’s the Problem? A defense technology company with Department…

Top Highlights Microsoft detected a large credential theft campaign targeting over 35,000 users worldwide, using sophisticated, enterprise-like phishing emails to lure victims. The campaign employed legitimate email services, convincing HTML templates, and urgency tactics to bypass defenses and harvest Microsoft credentials through real-time AiTM phishing. Phishing tactics evolved in 2026 with a rapid rise in QR code scams (+146%) and CAPTCHA-based attacks, primarily aiming for credential theft, with malware delivery significantly declining. Threat actors increasingly abuse trusted services like Amazon SES and alternative hosting providers, making phishing and BEC attacks more persistent and harder to detect. Microsoft Uncovers a Large-Scale…

Summary Points Attackers have found a new way to bypass Chrome’s App-Bound Encryption (ABE) security feature, which was designed to protect sensitive browser data. Traditional methods to access browser data, such as privilege escalation or code injection, have been effectively bypassed by malware authors since ABE’s implementation. The VoidStealer malware exploits a vulnerability by attaching as a debugger, pausing Chrome during data decryption, and extracting encryption keys directly from memory. This demonstrates how browsers remain a prime target for attackers, especially as enterprises increasingly rely on web applications to handle sensitive information. New Methods to Bypass Chrome’s Encryption Protection Recently,…

Top Highlights A new Mirai-derived botnet, xlabs_v1, exploits exposed Android Debug Bridge (ADB) services on IoT devices, smart TVs, and routers to conduct versatile DDoS attacks, targeting game servers and IoT hardware. The malware uses multi-architecture builds, can bypass consumer-grade DDoS protections, and features a bandwidth profiling system to tier victims for pay-per-use attacks. The botnet includes a "killer" subsystem to disable competing malware, with no persistence mechanisms, relying on re-infection via ADB exploits, highlighting a focus on flexible, targeted attack campaigns. Threat Overview, Techniques, and Targets Cybersecurity researchers identified a new botnet called xlabs_v1, which is based on the…

Quick Takeaways A critical security flaw (QVD-2026-14149) in Fanwei E-cology10 allows remote, unauthenticated attackers to execute arbitrary code, risking full server control and sensitive data exposure, with a CVSS score of 9.8/10. The vulnerability stems from a command injection weakness in the server interface, enabling attackers to run malicious commands and potentially hijack user sessions and steal credentials. The flaw affects E-cology10 versions below v20260312; a patch has been released by Weaver, urging immediate updates to mitigate the high risk of exploitation. Security experts recommend organizations audit logs for unauthorized activity and update detection tools, emphasizing swift patching to prevent…