Attackers are now exploiting CVE-2026-48282, a maximum-severity Adobe ColdFusion vulnerability that can lead to remote code execution on unpatched servers. Adobe released fixes this week and urged administrators to install them quickly.
Scammers are planting fake purchase receipts inside the Shop app to push callback phishing attacks, with victims urged to call fake support numbers or install remote access software.
A malware campaign is using compromised WhatsApp accounts to send fake business documents that hide VBScript files, leading to remote access on Windows PCs. The activity has been seen across multiple countries and uses localized filenames to trick recipients into opening the attachment.
WhatsApp says it detected and blocked new spear-phishing campaigns allegedly tied to NSO Group, after users reported social engineering attempts aimed at pushing them to external websites.
OpenAI has started rolling out Lockdown Mode, an optional ChatGPT security setting aimed at users and organizations that need tighter protection against prompt injection attacks.
Microsoft has rolled out mitigations for YellowKey, a publicly disclosed Windows zero-day that can bypass BitLocker on systems with physical access. The company says the fix centers on stopping the FsTx Auto Recovery Utility from launching inside WinRE, while researchers say the flaw exposes a deeper issue with Transactional NTFS replay.
Bangladesh has been added as the 43rd government on Have I Been Pwned’s free government service, giving BGD e-GOV CIRT API access to query government domains and monitor them for future breaches.