Threat actors have exploited a high-level security flaw in Roundcube, the popular open source webmail client, the Canadian Center for Cyber Security warns. The security flaw is tracked as CVE-2026-48842 (CVSS score of 8.1) and is described as an SQL injection virtuser_query Plugin that can be exploited without authentication. The plugin resolves email addresses into … Read more
A new variant of the MacSync information-stealing malware targeting macOS systems is now using public iCloud calendar events to deliver new payloads. MacSync is a Swift-based malware that emerged in April 2025 and was recently delivered in ClickFix campaigns under the guise of Homebrew and macOS disk space analysis tools. Kaspersky researchers say that previous … Read more
Context Security launched public today with $4 million raised in a funding round led by 42CAP with additional support from a16z CSX and HTGF. The Munich startup, co-founded by Jens Ernstberger and Michel Osswald, has developed a runtime security platform that offers companies transparency and control over the actions of AI agents. Deployed between AI … Read more
Microsoft has released the September 2026 non-security preview update KB5124010 for Windows 11 24H2 and 25H2 with 46 changes, including Bluetooth improvements and the ability to remap the Copilot button. KB5124010 is a preview update that allows administrators and users to test Windows improvements, bug fixes, and new features before they become generally available during … Read more
Quantum computing hardware and software company IonQ says it has developed a quantum error correction decoder that runs in real time on a single conventional CPU, potentially reducing classical computing overhead that can slow down larger quantum systems. In simulations with up to 408 logical qubits, the company’s decoder increased processing time by just 0.02% … Read more
The third-party.com domain, commonly used as a placeholder in developer documentation and code samples, provides a fake Cloudflare verification page that attempts to trick Windows users into running PowerShell commands. The third-party.com domain has long been used in documentation to represent any external website, API, or service, similar to how developers use domains like example.com. … Read more
In a summer full of revelations about the rapid development of artificial intelligence, researchers were particularly alarmed that out-of-control bots found their way onto the Internet and, in at least one case, coordinated with each other. Could a swarm of AI agents take over the entire internet? It’s a possibility that could be just six … Read more
Arista Networks has released security patches for a zero-day vulnerability that is being actively exploited and impacts on-prem deployments of VeloCloud Orchestrator (VCO). VCO is a cloud-based centralized management platform that helps administrators configure, monitor, and manage VeloCloud SD-WANs (Software-Defined Wide Area Networks) and associated edge devices. Tracked as CVE-2026-93952This maximum severity error is due … Read more
Check Point on Tuesday announced urgent patches for a critical-severity vulnerability in the Management Server that was exploited in the wild as a zero-day vulnerability. The vulnerability, tracked as CVE-2026-93616 (CVSS score 9.8), is described as a directory traversal and file upload issue that could allow unauthenticated attackers to upload and execute arbitrary scripts on … Read more
Security researchers have developed an attack that allows hackers with privileged access to register a rogue third-party MFA provider that steals users’ passwords during legitimate login attempts. The technique, which Varonis Threat Labs calls TrustSink, can work with any vendor that relies on this external authentication model, although researchers demonstrated the attack using Microsoft Entra. … Read more