Since mid-August 2026, a phishing operation has been harvesting live Google sessions from corporate users. Every signal defenders usually rely on to judge a link returned a reassuring answer, and the operator built the chain that way on purpose. Material Security’s Threat Research team identified the campaign and has taken

The US Cybersecurity and Infrastructure Security Agency (CISA) warned federal agencies that attackers have started exploiting a recently patched high-severity WordPress vulnerability in the wild. Tracked as CVE-2026-119977, this high-severity WordPress Core flaw stems from a Time-of-check Time-of-use (TOCTOU) race condition and was reported by Picus Security researcher Umut Bayram.

European law enforcement authorities arrested seven suspects and seized more than 100 servers in a joint action targeting an unnamed company suspected of providing fraudulent trading websites to criminal gangs. Supported by Europol and Eurojust, this coordinated international action involved authorities from Albania, Cyprus, Finland, Germany, Kosovo, and North Macedonia

Google has expanded its Cloud Vulnerability Reward Program (VRP) with a new top-tier reward for high-impact architectural security flaws. Starting this month, researchers can earn $250,000 for Root-in-Cloud bugs, including tenant-isolation bypasses and complex cross-service logic flaws that let attackers gain full administrative control over arbitrary Google Cloud organizations. “To

Hackers who breached Harvard University’s Alumni Affairs and Development systems in November 2025 stole data linked to more than 850,000 unique email addresses, according to breach notification service Have I Been Pwned. Harvard is a private Ivy League research university with over 20,000 faculty and staff, over 24,500 undergraduate and

Chinese hackers used ARTEX, an open-source, multi-agent AI penetration-testing framework, in attacks against more than 200 organizations across 14 countries. The operation began on October 17 and targeted government ministries, telecommunications providers, and organizations in the pharmaceutical, semiconductor, defense, nuclear, and financial sectors. The threat actor compromised at least nine

A critical flaw dubbed ‘HTTP2Shell’ in Brotli, the C decoder library built into Node.js, could allow attackers to corrupt memory and access sensitive data. The security issue is tracked as CVE-2026-111497 and is also known as “Broccoli2Shell” and “Node2Shell.” It affects Brotli versions 1.0.3 through 1.0.9, 1.1.0, and 1.2.0. The

Researchers found a malicious AGENTS markdown instruction file in a customer’s Downloads folder that tricked an AI coding agent into installing a rogue npm package. They reproduced the attack against OpenAI Codex and demonstrated a related technique against Claude Code to leak OAuth tokens and hijack the account using only

Microsoft says IT admins can re-enable the retired Exchange Web Services (EWS) API in Exchange Online to fix EWS apps that have stopped working. EWS is an API for developing apps that can access Exchange mailbox items (e.g., email messages, meetings, and contacts) from Exchange Online and on-premises Exchange servers.