OWASP CRS Flaw Lets Encoded Attacks Slip Past WAFs
A critical vulnerability (CVE-2026-21876) in the OWASP Core Rule Set lets attackers bypass charset validation, enabling encoded XSS payloads to slip past web application firewalls. The flaw resides in rule 922110, which only inspects the final part of multipart requests, leaving earlier segments unchecked. Affected CRS versions span 3.3.x‑3.3.7 and 4.0.0‑4.21.0, earning a CVSS score of 9.3. Immediate upgrades to CRS 4.22.0 or 3.3.8 are recommended to restore protection.
GenDigital Research Exposes AuraStealer Infostealer Tactics
GenDigital researchers detailed AuraStealer, a modular malware‑as‑a‑service infostealer targeting Windows 7‑11 systems. The threat spreads through “scam‑yourself” TikTok videos and cracked software, then harvests credentials, session tokens, and financial data. AuraStealer employs advanced evasion such as exception‑driven API hashing, Heaven’s...
Flare Researchers Analyze SafePay Ransomware Leak Data
Flare’s research reveals SafePay ransomware’s rapid rise in 2024‑25, focusing on small and mid‑size businesses (SMBs) through a classic double‑extortion model. By publishing over 500 victim records on Tor leak sites, the group pressures targets with regulatory, legal and reputational...
WordPress Admins Targeted by Renewal Email Phishing Scam
A sophisticated phishing campaign is targeting WordPress administrators with fake domain renewal emails. The emails direct victims to a counterfeit WordPress payment portal that harvests credit‑card details and 3‑D Secure one‑time passwords. Stolen data is immediately relayed to attacker‑controlled Telegram...
MacOS Flaw Enables Silent Bypass of Apple Privacy Controls
A newly disclosed macOS vulnerability (CVE-2025-43530) lets attackers silently bypass the Transparency, Consent, and Control (TCC) privacy framework by exploiting trusted VoiceOver services. The flaw combines a lax file‑based validation of Apple‑signed binaries with a TOCTOU race condition, enabling arbitrary...
Handala Leak Shows Telegram Account Risk, Not iPhone Hacks
Iran‑linked group Handala claimed full phone compromise of former Israeli PM Naftali Bennett and Chief of Staff Tzachi Braverman, but Kela researchers found the breach was limited to their Telegram accounts. The attackers likely used SIM‑swap, SS7 interception, phishing lures...