Rokarolla is a new Android banking Trojan targeting 217 banking and cryptocurrency apps. It spreads via malicious websites masquerading as popular apps like TikTok and Chrome, initially installing a dropper disguised as Google Play Protect. Once installed and granted Accessibility Services, it can simulate user actions, inject overlays, intercept credentials, block calls, read and send SMS, disable Google Play Protect, and silently capture screen content. The malware dynamically downloads fake login pages to steal credentials and can operate even when the device is locked. It also replaces copied cryptocurrency wallet addresses with attacker-controlled ones and suppresses audio and notifications to avoid user detection. Rokarolla uses resilient command-and-control infrastructure and employs stealth techniques to maintain persistence and evade detection. No software flaw is exploited, so no patch is available; mitigation relies on user caution and security products detecting the malware.
This entry is a discussion post about professional cybersecurity accreditations, specifically focusing on governance, risk, and compliance certifications such as ISC2 CGRC, CISSP, and CISM. It provides advice on choosing appropriate certifications for career development in cybersecurity governance and risk management roles. There is no indication of any security vulnerability or threat in the content.
This is an announcement for the Engage 2 Hackathon scheduled in Zagreb on 20–21 October 2026. The event is a 24-hour coding competition focused on Air Traffic Management, data science, and digitalisation challenges. It targets students and young professionals aged 18 or older. There is no indication of any security vulnerability or threat associated with this event.
Brovan is a user-mode x86_64 binary emulator designed for reverse engineering and malware analysis. It supports emulation of Windows PE binaries, Linux ELF binaries, memory dumps, and even raw or unrecognized binaries. The tool allows interactive inspection of execution, syscall and function tracing, and controlled sandboxed execution without running code directly on the host CPU. It also captures emulated network traffic for analysis. Brovan aims to facilitate flexible binary research by providing full control over execution and runtime behavior in a contained environment. It is currently in early stages but actively developed and available as open source.
Kodak confirmed a data breach involving unauthorized access to a limited amount of company data. The ShinyHunters extortion gang claimed responsibility, stating they stole over 2.2 million records containing customer personally identifiable information (PII) and internal corporate data. Kodak is investigating the incident with external cybersecurity experts and cooperating with law enforcement. The company has not disclosed how the attackers gained access or whether the internal network was breached. ShinyHunters has a history of targeting multiple organizations and extorting data. Kodak has not yet provided details on remediation or mitigation.
Three recently patched vulnerabilities in Fortinet FortiSandbox are actively targeted in the wild. Two of these vulnerabilities, CVE-2026-39808 and CVE-2026-39813, are rated critical and allow authentication bypass and OS command injection, respectively. A third vulnerability, CVE-2026-25089, patched in June 2026, permits remote unauthenticated command execution. Additionally, over 30,000 Fortinet firewalls have been compromised in a campaign dubbed FortiBleed, exposing networks globally and enabling attackers to harvest credentials for further intrusions. The threat actor uses automated scanning and credential stuffing to propagate access, with indications of targeting defense industry VPNs. Exploits have been observed since June 2026, including AI-generated attempts. Fortinet has issued patches for these vulnerabilities.
The entire @mastra npm scope was hijacked, affecting 141 packages including @mastra/core. The attacker did not modify the original source code but added a malicious dependency named easy-day-js, a seemingly benign dayjs clone. The attack exploited semantic versioning by specifying a dependency version range (^1.11.21) while the latest tag pointed to a newer version (1.11.22) containing a malicious postinstall hook. This allowed the malicious code to execute during package installation without immediate detection.
On June 16, 2026, the full attendance list of Peter Thiel's private society, "Dialog," was leaked due to the list being hard-coded in the HTML of the official dialog.org website. The leak exposed the names of numerous influential individuals who were members of the society. The issue was subsequently fixed by the website owners. There is no indication of malicious activity related to the leak, and the list was preserved by a third party for archival purposes.
YCombinator's Paxel tool, which analyzes AI coding sessions, transmits sensitive user data including Cloudflare OAuth tokens, git email addresses, and verbatim user prompts sent to Claude's LLM proxy servers. This data transmission occurs even before the tool's Docker container starts and includes detailed behavioral reports with bash command histories. The tool strips file contents and LLM responses but sends user input prompts unaltered. This exposure was confirmed through live HTTPS interception and packet capture. The vendor has not provided a patch or official remediation guidance at this time.
CVE-2026-39949 is an authenticated remote code execution vulnerability in Cacti versions up to and including 1.2.30. The flaw arises from unsanitized variable substitution in RRDtool command-line arguments, allowing users with graph management privileges to inject arbitrary OS commands via host metadata fields such as the device notes. Exploitation requires authenticated access with permissions to create devices and graph templates. An attacker can craft malicious input in the notes field and trigger code execution during graph rendering.
This entry is a Reddit post from a user seeking advice on pivoting into cybersecurity after three years of web and general IT experience. The post includes links to academic programs but does not describe a security vulnerability or threat.
Nocobase versions up to 2.0.57 contain two chained vulnerabilities that allow an authenticated admin to achieve remote code execution (RCE). The first vulnerability permits arbitrary file write by manipulating the file upload storage root path without validation. The second vulnerability allows local file inclusion (LFI) via an unsanitized require() call on user-supplied paths. Together, these flaws enable an attacker with admin credentials to upload and execute malicious code on the server. The issue is fixed in version 2.1.5.
A user reported issues with the Indian cybercrime complaint website (https://www.cybercrime.gov.in/Webform/Crime_AuthoLogin.aspx), describing problems such as delayed OTP delivery and the website becoming unresponsive during complaint filing. The report originates from a Reddit post with minimal discussion and no technical details or confirmed vulnerabilities. The website currently returns a 'Page Not Found' error.
A user reported installing a malicious application disguised as a James Bond 007 game from a fake site, resulting in multiple account compromises including Microsoft and Steam accounts. The attacker changed the victim's personal information and gained unauthorized access despite Google 2FA blocking some attempts. The incident was shared on Reddit's cybersecurity subreddit with minimal technical details and no known exploit or patch information.
This entry references a Reddit post titled 'wiz-solutions support engineer' that appears to be a request for interview preparation advice rather than a security threat or vulnerability.
This report highlights organized fraud syndicates operating from Myanmar, Cambodia, and Laos that target elderly victims by exploiting loneliness and cognitive decline. The criminals use legitimate remote access tools, real-time deepfakes, voice cloning, and psychological manipulation to perpetrate their schemes. The source maps the attack kill chain and proposes a defensive tool called Granny Kate to help protect elderly users. The call to action invites security researchers and developers to contribute to improving this defense. No specific software vulnerability or exploit details are provided.
The Skype data export tool reportedly returned data belonging to other users instead of the requester. Multiple users have reported receiving someone else's chat history, images, and files when using the tool. This issue was observed during the final period before the tool's shutdown in June 2026. The problem indicates a data leakage or misattribution vulnerability in the Skype data export process.
This entry describes a Discord server community focused on binary security research topics such as reverse engineering, binary obfuscation, exploit development, and malware analysis. It is a community resource rather than a security threat or vulnerability. No specific vulnerability, exploit, or attack vector is described.
Cisco disclosed a zero-day vulnerability (CVE-2026-20262) in Catalyst SD-WAN Manager that allows an attacker with valid credentials and write access to send crafted HTTP requests to an API endpoint, enabling arbitrary file write on the underlying operating system. This vulnerability can be leveraged to escalate privileges to root. Cisco discovered the flaw internally and confirmed limited exploitation in targeted attacks. The vulnerability is considered medium severity by Cisco but is rated critical here due to its exploitation and potential impact. Cisco has released patches addressing this issue. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added this vulnerability to its Known Exploited Vulnerabilities catalog, mandating remediation by June 29, 2026. This is one of multiple SD-WAN vulnerabilities exploited in 2026.
This entry describes a promotional post for a project called Threat Hub, which is a tailored threat intelligence hub offering customized threats and alerts. The content is a link post on Reddit with minimal discussion and no technical vulnerability or exploit details provided.