3+ day, 12+ hour ago   (616+ words) Nearly one in 10 internet-exposed LiteLLM AI gateways accepted the widely documented default master key, sk-1234, or required no authentication, creating a direct path to LLMjacking, sensitive credential exposure, and in vulnerable versions root-level code execution inside the gateway container. Their…...

3+ day, 14+ hour ago   (557+ words) A phishing campaign that moves the credential-harvesting page out of attacker-controlled web infrastructure and into the victim’s browser. Unlike ordinary phishing kits, which host cloned login portals on domains that can eventually be detected and disrupted, this campaign delivers malicious…...

4+ day, 14+ hour ago   (549+ words) Security researchers have revealed a recently patched flaw in ChatGPT’s isolation system that could have allowed attackers to access data from a victim’s connected Gmail account and send it to a separate ChatGPT account through a hidden cross-account channel. Check…...

4+ day, 17+ hour ago   (312+ words) cPanel has disclosed CVE-2026-67401, a SQL injection vulnerability in its EmailTrack functionality. This flaw allows an authenticated account holder to create arbitrary files on a server, which can ultimately enable them to execute code with root privileges. The issue, published…...

5+ day, 13+ hour ago   (565+ words) WhatsApp is developing a guest-call feature that would let people without a WhatsApp account join encrypted calls through a web link. This capability would extend WhatsApp’s existing Call Links feature to include guests, letting invited participants join calls directly from…...

5+ day, 14+ hour ago   (801+ words) DNS security delivers more blocked attacks per dollar than any other network control when you buy the right shape at the right tier. Published per-user tier: DNSFilter and SafeDNS publish per-user monthly pricing (single-digit dollars, volume breaks); Cloudflare Gateway runs…...

6+ day, 14+ hour ago   (524+ words) Roundcube has released security updates 1.6.19 and 1.7.4, which address 12 vulnerabilities affecting its 1.6 LTS and 1.7 Webmail branches. The flaws include a zero-click stored cross-site scripting (XSS) vulnerability, several bypasses of remote content filtering, email header injection bugs, cross-user contact access issues, and…...

6+ day, 15+ hour ago   (1571+ words) Best value overall: Tailscale. It publishes its pricing, has a genuinely usable free tier for small teams, and its per-service access model is more secure than the network-level access a traditional VPN gives you. Best free option: WireGuard, if you…...

6+ day, 13+ hour ago   (632+ words) The campaign’s central advantage is that it presents trusted Google-owned domains at nearly every point a gateway, proxy, or analyst is likely to inspect. Rather than relying on a malicious URL evading detection, the actors use legitimate redirect and tracking…...

6+ day, 17+ hour ago   (605+ words) A previously undocumented Linux espionage toolkit linked with medium confidence to DPRK-aligned threat actors has been used to compromise South Korean organizations in the automotive and media sectors. The campaign is notable because it does not exploit a flaw in…...