On Saturday, researchers from watchTowr Labs said they had credible information that attackers were exploiting an unknown RCE vulnerability in Citrix NetScaler boxes.
This vulnerability allows for unauthenticated remote code execution and shows how a missing bounds check—a classic programming error.
Cisco Talos researchers identified ClosedQuorum, a Windows implant that uses multiple LLMs to autonomously select attack actions. The catch: there’s no confirmation that it’s actually been deployed in the wild.
Read More Researchers Find Windows Malware With Autonomous C2 Functionality
Attackers impersonated LastPass Authenticator on fake GitHub pages to deliver the Rapuncel infostealer in a campaign involving 40 fake brands.
Read More Fake LastPass Authenticator Pages Deliver Rapuncel Infostealer
Let’s ask a simple question that seems to be getting lost in all of the credulous fervor around AI: How’s this working out for everyone?
Read More ‘We Have Enough AI’: Realism in a Time of Relentless Hype
Active since at least August 2025, the malware represents a functional pivot from the threat actor’s existing SparrowDoor backdoor.
A new joint advisory from multiple law enforcement agencies this week warned of an Iranian cyber campaign targeting dissidents and journalists in the U.S., UK, and elsewhere.
Read More US, UK Agencies Detail Iranian Malware Campaign Targeting Dissidents
