Notícias de segurança, diretamente do terreno.
Inteligência de ameaças, análises de brechas e as novidades da 4Tify — escrito pelos engenheiros que fazem o trabalho.
Ledger Pauses CryptoBilis Sales After Tampered Hardware Wallet Found
Ledger paused sales through reseller CryptoBilis after reports of stolen funds. It found an unauthorized hardware implant in at least one affected device. Here's what happened and what wallet owners should do now.
CyberXero Uses AI Agents to Hit WordPress Worldwide and Ukrainian Energy
An access broker used dozens of Claude Code agents and a 'this is my own pentest' story to automate WordPress takeovers and target Ukrainian energy providers. Over 628,000 records are linked to the campaign. Here's what happened and what to fix.
Bricksforge CVSS 10.0 Flaw Exploited for Unauthenticated RCE on WordPress
Attackers are exploiting CVE-2026-85097 in the Bricksforge WordPress plugin to upload and run PHP without logging in. Ninja Forms and WPC Product Bundles XSS flaws are also being used to plant hidden admins. Here's what to patch and what to check.
Critical SonicWall SMA 1000 Flaw Hit by Exploitation Attempts Days After Patch
Attackers began probing SonicWall SMA 1000 appliances for CVE-2026-102255, a CVSS 10.0 pre-auth SSRF, just two days after the fix shipped. Here's what it means and what to do.
Midnight Mimosa: Android Malware Preinstalled in Budget Phone Firmware
Bitdefender has uncovered Midnight Mimosa, malware built into the firmware of low-cost MediaTek Android phones. It runs ad fraud and proxyware on thousands of devices in 150+ countries, and normal uninstalling cannot remove it.
Power BI Phishing Lure Plants Rogue ScreenConnect Clients for Persistent Access
Attackers are hiding phishing links behind Microsoft Power BI reports and using them to install a pair of attacker-controlled ScreenConnect clients on Windows machines. Here is how the chain works and how to shut it down.
Casbaneiro Banking Trojan Hides Its C2 Until Victims Visit Their Bank
A new Casbaneiro campaign steals Outlook data and registers victims quietly, then opens its main command channel only when the user visits a targeted bank, so infected machines can look clean.
P7 DarkSword iOS Exploit Kit Adds Remote Control and Crypto Wallet Theft
A new DarkSword variant turns compromised iPhones into remotely tasked implants that harvest Keychain and wallet data — and it is now spreading through a hijacked analytics domain.
GhostAction returns: hijacked maintainer accounts push credential-stealing GitHub Actions workflows at scale
Attackers are using compromised maintainer accounts to add a fake "security audit" workflow that steals CI/CD secrets and credentials from git history. More than 500 accounts and tens of thousands of repositories are affected so far.
TP-Link Faces Five U.S. State Lawsuits Over Router Security and China Links
Florida, Iowa, Montana and Nebraska have joined Texas in suing TP-Link over its security and China claims. Five newly detailed Aginet flaws are the part defenders can act on now.
Public exploit drops for pre-auth AnyDesk Linux flaw that grants root
A working exploit dubbed AnyPwn now targets a pre-authentication heap overflow in AnyDesk for Linux. It was silently fixed in 8.0.3 with no CVE, so update now and restrict TCP 7070.
Flax Typhoon: Five Old Flaws Added to CISA's Exploited List, Federal Patch Deadline Is Today
CISA has added ProFTPD, ONLYOFFICE, Strapi, Apache Struts and ISC BIND flaws to KEV after confirming that the China-linked group Flax Typhoon is exploiting them. Here's what to check and fix.
GoBalance Signing Bug Lets Attackers Recover Tor .onion Master Keys
A truncated Ed25519 key in GoBalance leaks an onion site's long-term private key from one public descriptor, enabling permanent .onion address hijacks. Dread and Omega are among the services hit.
AhsayCBS Flaws Chained to Deploy Web Shells and XMRig Miners Disguised as Edge
Attackers are chaining two AhsayCBS vulnerabilities to run code on exposed backup servers. The 10.3.4 fix reportedly falls short, so restricting access to the management interface is the main defence for now.
Your Biggest AI Risk May Be the Agents Nobody Approved
AI agents are arriving inside SaaS tools you already use, mostly outside SSO and identity controls. Here's why that gap matters and how to start closing it.
Recebe o essencial, não o ruído.
Um email mensal breve: as brechas que importam, novos avisos e o que lançámos.