Salesforce Customers Targeted by Data-Theft Extortion Campaign
Hackers exploited OAuth tokens in third-party Salesforce integrations, stealing CRM data and extorting affected customers. Salesforce urges clients to rotate credentials.
Read More
Apple Hit With $634M Verdict in Masimo Blood-Oxygen Case
A California jury ordered Apple to pay Masimo $634 million for infringing a blood-oxygen monitoring patent in Apple Watch models. The verdict raises stakes in a yearslong fight over health-sensor IP, ITC import bans, and Apple’s wearable roadmap.
Smishing Triad Toll-Text Scam: What Security Teams Must Know
A sophisticated mobile-fraud campaign dubbed the Smishing Triad is spoofing toll-agency alerts and flooding users with fake unpaid-toll texts. Read on for how the scam works and how to defend your devices.
Apple Bug Bounty Adds Bonus for Lockdown Bypass Finds
Apple has expanded its bug bounty program to reward researchers up to $2 million for zero-click exploit chains. Bonuses for Lockdown Mode bypasses and beta findings may push payouts even higher.
Why new React/Next.js vulnerability is as dangerous as Log4Shell
A critical vulnerability known as React2Shell allows unauthenticated attackers to achieve full remote code execution on React and Next.js servers. This flaw affects default RSC implementations and requires immediate patching to prevent severe compromise across modern web infrastructures.
Gemini in Gmail and Drive: Admin Playbook for a Safe Rollout
Gemini’s Deep Research now taps Gmail, Drive, and Chat when users allow it. Because the agent can fuse internal messages and files with web context, output quality rises along with privacy risk. This guide shows how to roll out safely: set consent norms, restrict high-risk teams, validate audit coverage, and keep DLP and labels active so Deep Research never reads more than policy permits.
Lanscope Endpoint Manager Zero-Day Under Attack
Attackers exploit CVE-2025-61932 in Lanscope Endpoint Manager clients to run code and move laterally. Patch MR/DA endpoints now and reduce internet exposure.
North Korean State Hackers’ Cryptocurrency Theft Hits New Highs
In 2025 alone, North Korean hacker groups have stolen over $2 billion in cryptocurrency funding state operations and deepening reliance on digital crime. They target exchanges, DeFi bridges, and individual holders, laundering via mixers and OTC channels. This escalation signals a bold shift in DPRK’s cyber financing, demanding vigilance from exchanges and regulators alike.
TEE.Fail Targets DDR5 , Exposing Keys from Secure Enclaves
TEE.Fail uses a DDR5 interposer to undermine enclave confidentiality on Intel TDX and AMD SEV-SNP. Because memory encryption lacks strong integrity here, defenders should rethink secrets, strengthen attestation, and tighten physical controls.
RondoDox Botnet Exploits Routers to Create Global Proxy Army
Cybersecurity researchers have uncovered a massive router-based botnet, dubbed RondoDox, that converts compromised devices into nodes within a global proxy network. The botnet enables cybercriminals to route attacks, anonymize traffic, and monetize access to infected routers worldwide.