A Microsoft SharePoint vulnerability known as CVE-2026-65660 is now being exploited for attacks, about six weeks after Microsoft announced patches and a few days after researchers disclosed technical details. CVE-2026-65660 is a remote code execution vulnerability that was addressed by Microsoft in the August 2026 Patch Tuesday updates. The company’s advisory describes it as a … Read more
The ShinyHunters extortion gang uses a URL encryption trick to bypass web application firewall rules that mitigate the Oracle PeopleSoft CVE-2026-35273 vulnerability, allowing threat actors to re-exploit the vulnerability on vulnerable servers. Mandiant and Google’s Threat Intelligence Group (GTIG) say this new technique allowed the threat actor to once again target PeopleSoft servers that had … Read more
Secure file-sharing software company Kiteworks is asking customers worldwide to temporarily shut down their servers for a period of six hours on Saturday after receiving a threat alert of a possible impending cyberattack. According to German technology publication HeiseKiteworks CISO Frank Balonis warned customers via email that the company had received “credible threat intelligence from … Read more
The third-party.com domain, commonly used as a placeholder in developer documentation and code samples, provides a fake Cloudflare verification page that attempts to trick Windows users into running PowerShell commands. The third-party.com domain has long been used in documentation to represent any external website, API, or service, similar to how developers use domains like example.com. … Read more
Security researcher Gal Weizman of Forever Security has revealed a new attack technique that can hijack the AI ​​assistants built into popular browsers using a single malicious browser extension. The proof-of-concept, called BragJack, was demonstrated using five Chromium-based browsers or browser assistants: Google Chrome’s Gemini Live, Perplexity Comet, Microsoft Edge, Opera Neon, and Anthropic’s Claude … Read more