Search: “Firefox users”

2 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Vulnerability 87 Exploit / PoC 83 Ransomware 21 Malware 20 Data breach 8 Threat actor 8 AI safety & security 2 Advisory 2 Phishing & fraud 2 Industry 2 Policy & legal 1

SeverityAll critical 202 high 21 medium 12 low 0 info 1

ThreatsDay: 200 Android Flaws, Browser-Built Phishing, 119K Scam Shops + 23 More Stories

Hacker News ThreatsDay digest: malicious browser extensions, AI-agent intrusions, NCSC shadow AI warning, M&A wire fraud, and 119,000-domain fake shops.

Socket found four malicious Chrome and Firefox extensions (J7Tracker, VREO, Orbit Tracker) stealing session tokens and wallet data from Axiom Trade and Padre users via attacker-controlled Vercel deployments. Hunt.io reported a Chinese-speaking operator using Claude Code, Alibaba Qwen, and DeepSeek with the SecFlow orchestration framework to automate intrusions against government and financial targets in Afghanistan, Thailand, Taiwan, and the US. The UK NCSC warned shadow AI use risks breaches and regulatory failure, Microsoft announced privacy-preserving Windows Age APIs, and Gen Digital described fake M&A wire-fraud scams. A 119,000-domain fake-shop operation called DoppelCart was also highlighted.

The Hacker NewsSep 10, 17:47 UTC · 6d agoIndustry in the wild

August 2026 Patch Tuesday forecast: How do we deal with the patch apocalypse?

August 2026 Patch Tuesday forecast urges risk-based triage as AI inflates CVE volume, flags actively exploited SharePoint RCE CVE-2026-50522 and LegacyHive Windows flaw.

July 2026 Patch Tuesday set records with over 600 CVEs, including 405 for Windows 11 and Server 2025, though only two were exploited zero-days and one was publicly disclosed. The author recommends prioritizing known-exploited and internet-facing vulnerabilities, matching patches to high-risk systems, and accelerating ring-based deployment toward Microsoft's suggested three-day turnaround. Notable items include actively exploited SharePoint RCE CVE-2026-50522 enabling machine key theft, the unassigned LegacyHive Windows User Profile Service flaw, and several end-of-servicing dates for Windows and Exchange.

Help Net SecurityAug 25, 06:52 UTC · 23d agoIndustry in the wildCVE-2026-505221