Cybersecurity News
-
WhatsApp Says 1 Billion Users Have Set Up Passwordless Sign-In as It Expands Security Features
WhatsApp said more than 1 billion people have now set up passkeys for their accounts, marking a major adoption milestone for the passwordless sign-in technology. Passkeys allow users to verify their identity…
-
Two Flaws in WordPress Plugin miniOrange SSO Could Allow Admin Takeover
Two critical authentication bypass vulnerabilities in the miniOrange SAML Single Sign On plugin could allow unauthenticated attackers to access affected WordPress sites as existing users, including administrators. Tracked as CVE-2026-61979 and CVE-2026-15981,…
-
Malware Hijacks Android Car Update System for Ad Fraud and Proxy Botnet
Cybersecurity researchers have uncovered malware spreading through the built-in software update system of Android-based car head units, turning infected devices into tools for ad fraud and a proxy botnet. Kaspersky discovered the…
-
Microsoft Defender Driver Can Be Repurposed to Weaken Security Protections
Security researchers have found that a legitimate Microsoft Defender driver can be repurposed to perform highly privileged file and Registry operations, potentially allowing attackers with existing administrator access to weaken security protections.…
-
Why You Should Avoid Replying to Suspicious Texts
A text arrives from an unfamiliar number and appears to have been sent to the wrong person. Replying with a polite “wrong number” may seem harmless, but security researchers say some of…
-
Isolated-vm Flaw Could Let Sandboxed JavaScript Escape to Host
Security researchers at Endor Labs have disclosed a vulnerability in the popular isolated-vm Node.js library that can allow sandboxed JavaScript to break out of its restricted environment and interfere with the host…
-
Critical Elementor Pro Vulnerability Could Allow Remote Code Execution
A critical security flaw in Elementor Pro could allow unauthenticated attackers to upload malicious files to vulnerable WordPress websites and potentially take control of the underlying server. Tracked as CVE-2026-32475, the vulnerability…
-
Encrypted Prompt-Injection Attack Raises Data Privacy Concerns for xAI’s Grok
Security researchers have demonstrated a prompt-injection technique that may allow a malicious web page to trick xAI’s Grok chatbot into exposing information from an active conversation. AI security company Adversa AI calls…
-
Apple Releases iPhone and Mac Security Updates to Fix Code Execution Flaw
Apple has released new security updates for iPhone, iPad and Mac devices, addressing a number of vulnerabilities including an image-processing flaw that could allow arbitrary code execution. iOS 26.6.1 and iPadOS 26.6.1,…