Fake ChatGPT, Gemini, and Claude Ad Portals Capture Credentials and MFA Codes
Researchers have described a human-operated phishing platform that impersonates advertising products associated with AI services including ChatGPT, Gemini, Claude, Perplexity, and Meta. The operation is designed to capture credentials and…
SonicWall Patches CVSS 10.0 Pre-Authentication SSRF Flaw in SMA1000 Appliances
SonicWall has released fixes for four SMA1000 vulnerabilities, including a pre-authentication server-side request forgery issue rated CVSS 10.0. The company said the flaws were not known to be exploited at…
Attackers Hijack .gh, .sl, and .as Registries to Obtain Certificates for Google Domains
Attackers reportedly compromised country-code registry infrastructure for .gh, .sl, and .as and obtained certificates for Google domains. Let’s Encrypt staff said certificates for Google and YouTube were issued and later…
Unpatched Critical LMCache Flaw Lets Unauthenticated Attackers Run Code Remotely
JFrog disclosed CVE-2026-105192, a critical vulnerability in LMCache that can allow unauthenticated remote code execution. The issue affects LMCache versions 0.3.9 through 0.5.5, according to the disclosure, and was rated…
Anthropic Expands Claude Access for Vetted Cyber Teams as Glasswing Finds 129,000 Flaws
Anthropic has expanded its Cyber Verification Program, offering qualifying cybersecurity professionals access to advanced cyber capabilities and reduced-blocking classifiers. The company says the program builds on Project Glasswing, whose participants…
Fake AI Advertising Portals Target Passwords and MFA Codes, Researchers Say
Researchers have reported a phishing operation using fake advertising portals branded around prominent AI products, including ChatGPT, Claude, and Gemini. The lures promise advertising or campaign-management features, then direct targets…
Microsoft Says AI Is Compressing Parts of the Post-Compromise Attack Lifecycle
Microsoft’s Digital Defense Report 2026 says threat actors are using AI to compress portions of the attack lifecycle, including vulnerability discovery, phishing customization, malware creation, credential discovery, lateral movement, and…
Report Highlights Security Gaps in Public MCP Server Marketplaces
A new review of publicly listed Model Context Protocol (MCP) servers argues that the ecosystem’s rapid growth has outpaced marketplace security controls. MCP is widely used to connect models and…
LibreOffice Fixed a Spreadsheet Code-Execution Flaw; OpenOffice Users Need a Workaround
Researchers demonstrated that a malicious spreadsheet can cause code execution when opened in LibreOffice or Apache OpenOffice if Java support is enabled, without the usual macro warning. The issue is…
Veeam Patch Addresses Critical Backup Server RCE and Other Security Flaws
Veeam released Backup & Replication 12.3.2 P4 (build 12.3.2.4934) with fixes for four reported vulnerabilities. The most severe, CVE-2025-64393, is rated 9.4 and concerns insecure deserialization in the Mount Service…