Two SharePoint Flaws Chain Into Unauthenticated Server Code Execution
Rapid7 joined a SharePoint identity bypass to unsafe .NET type creation. August's cumulative updates complete Microsoft's two-cycle fix.
Read article →identity
Authentication, access, credentials, and identity systems.
Gunra Steals Cloud Data and Deletes Backups Before Encryption
Government agencies traced Gunra from exploited edge devices through credential theft, cloud exfiltration, backup deletion, and cross-platform ransomware.
Read article →
Remus Malware Stores Command Server Addresses in Ethereum Contracts
Remus uses an Ethereum smart contract to resolve changing command infrastructure before stealing browser sessions, credentials, and wallet data.
Read article →
Windows Hello Keys Let Signed-In Code Create Persistent Entra Access
Code in a signed-in Windows session can invoke a TPM-backed Windows Hello for Business key, authenticate without a device identity claim, and create a path to durable Entra access.
Read article →
Researchers Forge WSUS Updates Through Standalone Microsoft SQL Server
SpecterOps shows how relayed WSUS machine-account access can forge targeted updates and bypass payload signature checks when SUSDB runs on a separate SQL Server.
Read article →
Unit 42 Extracted the Master Key Protecting Google's Synced Passkeys
Unit 42 showed three post-compromise paths from Chrome's local passkey state to silent assertions, substituted verification keys, or the master secret protecting synced credentials.
Read article →
N-central Attacks Reached Customer PCs After the First Fix Fell Short
N-central operators need Hotfix 2 build 2026.3.1.10 and a downstream endpoint hunt because the new release supersedes the first hotfix.
Read article →
Certighost Lets a Domain User Impersonate a Domain Controller
A crafted AD CS chase sent the CA to rogue directory services. July updates add a real-DC check, but defenders still need issuance and replication evidence.
Read article →
Compromised Microsoft 365 Mailboxes Spread QR-Code Phishing
Talos tied QR-code PDFs to credential theft, inbox-rule changes, SharePoint staging and new phishing sent from compromised Microsoft 365 mailboxes.
Read article →
Crafted ChatGPT Link Created a Scheduled Workspace Agent in Tests
Zenity found URL parameters that preselected a template and auto-submitted instructions inside a logged-in user's Workspace Agents builder.
Read article →
Google Sued a Phishing Service Behind 2.5 Million Scam Texts
A civil lawsuit targets a Telegram-based phishing-kit operation that Google links to 2.5 million texts and more than one million fraudulent URLs.
Read article →
Microsoft Entra Actor Token Impersonated a Global Admin in Testing
CVE-2025-55241 allowed an Entra actor token from one tenant to impersonate users in another through the legacy Azure AD Graph API.
Read article →
Klue Breach Exposed Salesforce Data Through Stolen OAuth Tokens
A forgotten Klue credential led to customer OAuth token theft and direct access to Salesforce CRM data across several companies.
Read article →Showing 53–65 of 65