Attackers Exploit Critical Flaw in MLflow, an AI Platform Downloaded 30M Times Monthly
The MLflow SSRF flaw CVE-2026-64849 can let unauthenticated attackers access internal services and cloud metadata, potentially exposing sensitive credentials and secrets.
Fake AML Sites Trick Crypto Users Into Approving Malicious Transactions
Researchers warn of fake anti-money laundering (AML) wallet-checking sites that impersonate legitimate services and trick crypto users into approving malicious transactions or token permissions.
Hacker Leaks 1,033 Stripe Merchant API Keys and 688K Customer Records
A 33GB database linked to 669 Stripe merchants has appeared on PwnForums, containing customer data, live-mode API keys, invoices, and payment records worldwide.
Google Tests Built-In Opt-Out in Chrome for Data Sharing and Sales
Google is testing Global Privacy Control in Chrome Canary, letting users ask websites not to sell or share their data or use it for targeted advertising online.
Infostealers Hit 7.4M Hosts and Steal 1.7 Billion Credentials in 6 Months
Cybercrime accelerated in early 2026 as infostealers harvested 1.7 billion credentials and ransomware operations affected 6,256 victims in six months worldwide.
Attackers Probe Critical GeoServer SQL Injection Vulnerability
Attackers are probing internet-facing GeoServer systems for a critical SQL injection vulnerability affecting deployments that use PostGIS 12…
AI Agents Used to Compromise 85 Taiwan Government Accounts in 4 Days
Dream Group says AI agents mapped 21 Taiwanese government systems, cracked 85 accounts and stole over 2,500 personnel records in a four-day attack in July 2026.
Apple Sends Lock Screen Spyware Alerts to Users in 110 Countries
Apple has sent spyware threat notifications to users in 110 countries, with new warnings appearing directly on iPhone lock screens.
LiteLLM Breach Linked to 2,500+ Companies and 434K CI/CD Pipelines
A TeamPCP supply-chain attack on LiteLLM may have exposed 2,500+ organisations to stolen cloud credentials, AI API keys and CI/CD secrets.
Suspected APT Exploits Critical VMware vCenter Vulnerabilities in 47 Countries
QUIRSO links 361 victim IP addresses in 47 countries to a suspected APT campaign exploiting critical VMware vCenter vulnerability, CVE-2026-59310.