Login Subscribe

7secure Coverage

Articles

Search and filter the broader reporting stream across incidents, AI security, policy, and operational coverage.

Samsung Patches TV ACR After Texas Privacy Breach

Samsung Patches TV ACR After Texas Privacy Breach

A Texas privacy investigation revealed that Samsung’s Automatic Content Recognition (ACR) feature on its smart TVs was capturing viewing data without user consent and sending it to external servers. In response, Samsung issued a firmware update that disables ACR by default, halting the unauthorized collection and transmission of metadata.

Vulnerabilities & Exploits

OAuth Redirect Abuse Bypasses Defenses, Powers New Phishing Campaigns

OAuth Redirect Abuse Bypasses Defenses, Powers New Phishing Campaigns

Microsoft researchers discovered that threat actors are weaponizing OAuth’s redirect_uri parameter to create phishing links that appear to come from trusted cloud services. By registering or compromising legitimate client IDs and then swapping the redirect endpoint for a malicious domain, the attackers can deliver payloads after the user

Malware & Ransomware

LummaStealer Returns, Bundled with CastleLoader – New Social‑Engineering Threat

LummaStealer Returns, Bundled with CastleLoader – New Social‑Engineering Threat

Bitdefender’s latest lab report confirms that the long‑dormant LummaStealer trojan has resurfaced, this time shipped alongside the CastleLoader dropper. Attackers are using highly tailored phishing emails and malicious document macros to deliver the combined payload. Once executed, CastleLoader establishes a stealthy foothold, then fetches and launches LummaStealer, which

Compliance & Regulation

CrowdStrike Secures UK NCSC CIR Certification, Boosting IR Credibility

CrowdStrike Secures UK NCSC CIR Certification, Boosting IR Credibility

CrowdStrike announced it has received the UK National Cyber Security Centre’s Cyber Incident Response (CIR) assurance. This independent validation confirms that the company’s incident‑response services, including the Falcon platform and response teams, meet the government’s stringent standards for capability, governance, and operational readiness. The certification demonstrates

Vulnerabilities & Exploits

AI Model Theft and Roundcube Webmail Exploits Surge in March

AI Model Theft and Roundcube Webmail Exploits Surge in March

Checkpoint’s March threat report warns of a coordinated campaign that combines two distinct attack vectors. Adversaries are creating fraudulent accounts on cloud platforms to download and exfiltrate large AI models, while a separate group is actively exploiting two publicly disclosed vulnerabilities in Roundcube Webmail to gain unauthorized access to

Vulnerabilities & Exploits

Chrome Extension Hijack Exploits New Gemini Panel, Threatening Sessions and Prompt Data

Chrome Extension Hijack Exploits New Gemini Panel, Threatening Sessions and Prompt Data

Palo Alto Networks discovered that malicious Chrome extensions can intercept and manipulate the newly added Gemini panel. By injecting script into the panel’s UI, the extensions can hijack active user sessions, capture authentication tokens, and siphon AI model prompts entered by the user. The flaw arises from insufficient isolation

Vulnerabilities & Exploits

GoAnywhere MFT Zero‑Day Lets Attackers Slip Past Firewalls

GoAnywhere MFT Zero‑Day Lets Attackers Slip Past Firewalls

In September 2025 a previously unknown flaw in the GoAnywhere Managed File Transfer (MFT) license‑servlet was weaponized. The vulnerability allowed an unauthenticated remote attacker to upload malicious payloads and achieve arbitrary code execution on the MFT server. Because the servlet is reachable through the standard HTTPS port, the exploit

Threat Intelligence

Proxy‑Based Surge Scans Target SonicWall Firewalls in Coordinated Recon Campaign

Proxy‑Based Surge Scans Target SonicWall Firewalls in Coordinated Recon Campaign

GreyNoise has identified a coordinated reconnaissance effort that leverages legitimate proxy services to flood target networks with high‑volume scan traffic aimed at SonicWall firewalls. The actors enumerate device models, firmware versions, and exposed management interfaces by issuing repeated connection attempts through diverse proxy nodes, making the traffic appear as