Information Security Magazine

Google has released a Chrome security update to fix three zero-day vulnerabilities, including a high-severity flaw with an active exploit

New ITRC research finds 81% of US small businesses suffered a data or security breach in the past year

A new malware campaign has been identified using a Python-based delivery system to deploy CastleLoader malware

Pro-Russia hacktivist groups have been observed exploiting exposed virtual network computing connections to breach OT systems

The flaw, dubbed ‘GeminiJack,’ exploits the trust boundary between user-controlled content in data sources and the AI model’s instruction processing

Sonatype has claimed that 13% of Log4j versions downloaded this year were vulnerable to the legacy critical Log4Shell bug

December’s Patch Tuesday sees the release of patches for over 50 CVEs including three zero-days

Sysdig has found sophisticated malicious campaigns exploiting React2Shell that delivered EtherRAT and suggested North Korean hackers’ involvement

Two malicious Visual Studio Code extensions, Bitcoin Black and Codo AI, have been observed harvesting sensitive user data

Cisco Talos has detected new tactics from a financially motivated actor using DeadLock ransomware

The UK’s National Cyber Security Centre has warned of the dangers of comparing prompt injection to SQL injection

Gartner has called for organizations to block today’s AI browsers on security concerns

A new version of ClayRat Android spyware features enhanced surveillance and device-control features

A data breach at Marquis Software Solutions due to a firewall flaw has affected over 780,000 people across the US

Security researchers will now be protected from prosecution in Portugal as long as they meet certain conditions

React2Shell (CVE-2025-55182) is under active exploitation by Earth Lamia and Jackpot Panda, risking over two million instances worldwide

A Home Office report has revealed racial bias in facial recognition technology used by police

Barts Health NHS Trust has revealed itself to be the latest victim of Cl0p’s Oracle EBS campaign

A critical RCE flaw in React.js, dubbed React2Shell (CVE-2025-55182), has been disclosed with a maximum CVSS score of 10.0, posing severe risks for server-side implementations

CrowdStrike warned that Warp Panda, a China-linked cyber-espionage group, is targeting US organizations to steal sensitive data and support Beijing’s strategic interests