Guru Baran

Online maths learning platform Mathspace has confirmed a data breach that exposed the personal information of more than one million students, parents, guardians, and school staff across Australia and New Zealand, after attackers exploited a critical flaw in its internal reporting software.

Bimbo Bakeries USA, the American arm of the world's largest baking company, has confirmed that hackers stole employee data by exploiting a zero-day vulnerability in Oracle's E-Business Suite (EBS), joining a growing list of organizations swept up in the Clop ransomware gang's global extortion campaign against Oracle customers.

Researchers have unveiled a novel electromagnetic (EM) attack called InjectEave that lets an adversary eavesdrop on audio playing through wired and wireless headphones from as far as 30 meters away, even through walls, using nothing more than commercially available radio-frequency equipment.

A proof-of-concept zero-click worm dubbed “WeWorm” that it says can spread through WeChat voice calls on both iOS and Android, compromising a target’s WeChat account in seconds without the victim answering the call.

Check Point Research has uncovered a covert cross-account communication channel inside ChatGPT that allowed an attacker to hijack a victim's session and silently exfiltrate data from connected apps like Gmail, all while the victim saw nothing unusual in their conversation.

Ivanti has disclosed a wave of security advisories affecting three flagship enterprise products, Endpoint Manager Mobile, Neurons for ITSM, and Sentry, exposing organizations to risks ranging from privilege escalation to full remote code execution.

An active exploitation campaign targeting FortiGate firewalls, in which attackers weaponize a critical vulnerability to plant a custom-built Node.js remote access trojan (RAT) capable of turning compromised perimeter devices into long-term footholds for espionage and data theft.

A Russian-speaking threat actor has weaponized artificial intelligence at an unprecedented scale, deploying hundreds of autonomous AI agents to exploit critical vulnerabilities in PaperCut NG/MF print management software, compromising at least 440 servers across 395 organizations in 48 countries.

Fortinet has disclosed a high-severity certificate validation flaw in the Agentless ZTNA portal of FortiOS and FortiProxy that could let an unauthenticated remote attacker intercept traffic flowing between the ZTNA portal and the backend destination website.

Microsoft is investigating a Microsoft 365 Copilot disruption in which users may be unable to open the assistant or encounter errors while using it. The company is tracking the event as CP1470554 and pointed administrators to the Service Health Dashboard in the Microsoft 365 admin center.