🔐 Security flaws and vulnerabilities

CERT-FR (Government Center for Monitoring, Alerting and Response to Computer Attacks)

Exploit Database (Offensive Security)

🛡️ Ongoing attacks and active campaigns

The Hacker News

  • Over 250 ClickFix Domains Use Browser Fingerprinting to Hide macOS Malware Lures
    A macOS ClickFix operation spanning more than 250 front-end domains now fingerprints visitors before deciding whether to show them a malware lure, a change Microsoft Threat Intelligence tracked on infrastructure it had been watching for weeks. The server-side gate hides the malicious page from crawlers and sandboxes while presenting selected Mac users with a fake […]
  • OpenAI Disrupts Poipet Scam Network Using ChatGPT Across Multiple Fraud Schemes
    OpenAI said it disrupted a Cambodia-based scam operation that used its generative artificial intelligence (AI) chatbot ChatGPT to facilitate a wide range of investment, romance, gambling, and law enforcement impersonation schemes. To that end, it banned a coordinated network of ChatGPT accounts likely originating from Southeast Asia and operating from the city of Poipet, a […]
  • Poison Claude Sells Discounted Claude Access While Its Operator Sees Every Customer Prompt
    Cybersecurity researchers have discovered more than half-a-dozen services advertisements for illegal access to artificial intelligence (AI) models on underground cybercrime forums and messaging platforms. One such service, Poison Claude, claims to offer access to Anthropic's large language models (LLMs), including Opus 4.8, Opus 4.7, Opus 4.6, and Sonnet 4.6. "Advertisements for Poison Claude
  • Paperclip AI Flaws Let Attackers Run Host Commands via Malicious Agent Imports
    Two security flaws in Paperclip could let attackers execute commands on a network server or a developer's computer. Paperclip is an open-source control plane for teams of artificial intelligence (AI) agents, and both paths rely on importing a malicious agent and starting it. A third flaw could expose sensitive data and control-plane details through application […]
  • Veeam, Terraform MCP, Django Patch Critical Flaws, Led by CVSS 10.0 Cross-Tenant Bug
    HashiCorp, Veeam, and the Django Software Foundation have patched 11 vulnerabilities across Terraform MCP Server, Veeam Service Provider Console, and Django. The three most serious: An unauthenticated flaw in Veeam's console that hands over a managed agent's credentials, rated 9.5 A cross-tenant flaw in HashiCorp's MCP server that lets one user's Terraform token be reused […]
🛠️ Microsoft Security Update Guide (Patch Tuesday & other updates)

This feed lists security bulletins (CVE, monthly patches) released by Microsoft. It is the official source for Windows, Office, Azure security updates, etc.