Search: “Parallels Desktop”

44 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Malware 35 Vulnerability 22 Ransomware 16 Threat actor 8 Exploit / PoC 7 AI industry 6 Data breach 4 Industry 4 Phishing & fraud 4 AI research 3 Policy & legal 2 AI safety & security 2 AI tools & infra 1 Tools 1

SeverityAll critical 25 high 46 medium 30 low 3 info 12

Parallels Desktop flaw hands any local user root on a Mac (CVE-2026-90894)

CVE-2026-90894 in Parallels Desktop for Mac lets any local user gain root via argument injection; patched in v27.0.0, PoC withheld.

JFrog researchers disclosed CVE-2026-90894, an argument injection flaw in Parallels Desktop for Mac v26.4.0 on Apple silicon that lets any local user gain root on the host. The chain combines a world-writable Unix socket for prl_disp_service (which runs as root), weak peer-credential authentication, and argument injection via --use-compress-program in the appliance extraction tar path. Alludo fixed the flaw in Parallels Desktop v27.0.0 in early September 2026; JFrog published technical details but withheld its proof-of-concept script.

Help Net Securityupdated Sep 16, 13:14 UTC · 12h agofirst Sep 16, 12:36 UTC · 12h agoVulnerability 4 sources CVE-2026-90894

Pwn2Own 2021 hacking contest ends with a three

The RecordNov 17, 00:00 UTC · Nov 17, 2022Vulnerability

Windows, Ubuntu, Zoom, Safari, MS Exchange Hacked at Pwn2Own 2021

The Hacker NewsApr 15, 00:00 UTC · Apr 15, 2021Vulnerability in the wild1

Windows 10, Linux, iOS, Chrome and Many Others at Hacked Tianfu Cup 2021

The Hacker NewsFeb 19, 06:10 UTC · Feb 19, 2022Vulnerability

Pwn2Own 2021: participants earned $1,2M of the $1.5M prize pool

Security AffairsApr 9, 14:12 UTC · Apr 9, 2021Ransomware

Pwn2Own 2021 Day 2 – experts earned $200K for a zero

Security AffairsApr 8, 15:38 UTC · Apr 8, 2021Vulnerability

Supply Chain Security 101: An Expert’s View

Krebs on SecurityOct 22, 14:20 UTC · Oct 22, 2018Malware

Amnesia RAT deployed in multi-stage phishing attacks against Russian users

Security AffairsJan 27, 09:50 UTC · Jan 27, 2026Malware

SEO Poisoning Campaign Targets 8,500+ SMB Users with Malware Disguised as AI Tools

The Hacker NewsJul 11, 04:03 UTC · Jul 11, 2025Malware

Analyzing the familiar tools used by the Crypt Ghouls hacktivists

Kaspersky SecurelistOct 18, 10:00 UTC · Oct 18, 2024Ransomware

Hijacked npm and Go Packages Use VS Code Tasks to Deploy Python Infostealer

The Hacker NewsJul 1, 10:25 UTC · Jul 1, 2026Malware1

Delaware County opted to pay 500K ransom to DoppelPaymer gang

Security AffairsNov 30, 08:08 UTC · Nov 30, 2020Ransomware

Microsoft warns of growing DoppelPaymer Ransomware threat

Security AffairsNov 21, 12:29 UTC · Nov 21, 2019Ransomware

UAT-5647 targets Ukrainian and Polish entities with RomCom malware variants

Cisco TalosOct 17, 10:00 UTC · Oct 17, 2024Malware

Ubuntu snap-confine Vulnerability Enables Local Root Access

Infosecurity MagazineJul 22, 10:50 UTC · Jul 22, 2026Vulnerability CVE-2026-8933

Modular macOS Stealer Uses Kill Loops to Force Password Entry

Infosecurity MagazineJul 16, 13:30 UTC · Jul 16, 2026Malware

LibreOffice: Stability, security, and continued development

Help Net SecuritySep 7, 00:00 UTC · Sep 7, 2023Vulnerability

New GigaWiper Windows Backdoor Bundles Disk Wiping, Fake Ransomware, and Spyware

The Hacker NewsJul 9, 18:08 UTC · Jul 9, 2026Ransomware

New IoT/Linux Malware Targets DVRs, Forms Botnet

Palo Alto Unit 42Jan 28, 20:33 UTC · Jan 28, 2022Malware

AI-Driven Ransomware FunkSec Targets 85 Victims Using Double Extortion Tactics

The Hacker NewsJan 11, 06:30 UTC · Jan 11, 2025Ransomware

AI-Powered Villager Pen Testing Tool Hits 11,000 PyPI Downloads Amid Abuse Concerns

The Hacker NewsSep 15, 00:00 UTC · Sep 15, 2025Vulnerability in the wild1

Yubico YubiKey 5 FIPS Series extends phishing-resistant MFA to additional use cases

Help Net SecurityMay 5, 00:00 UTC · May 5, 2021Phishing & fraud

New GenieLocker ransomware for Windows, ESXi, and Linux

Kaspersky SecurelistJul 30, 08:00 UTC · Jul 30, 2026Ransomware

Kaspersky Security Bulletin 2016. The ransomware revolution

Kaspersky SecurelistDec 8, 08:54 UTC · Dec 8, 2016Ransomware

Cloud Atlas group acquires PowerCloud, ReverseSocks, SSH

Kaspersky SecurelistMay 22, 09:12 UTC · May 22, 2026Vulnerability CVE-2018-0802

Armored Likho Targets Government Agencies, Power Sector with BusySnake Stealer

The Hacker NewsJul 3, 14:36 UTC · Jul 3, 2026Malware CVE-2025-9491

Lazarus Exploits Windows Zero-Day to Gain SYSTEM Access and Deploy Backdoor

Lazarus exploits Windows AFD.sys zero-day CVE-2026-68820 in Operation Dream Job to deploy Troy backdoor at defense firms.

Check Point attributes Operation Dream Job attacks to Lazarus Group exploiting CVE-2026-68820 (CVSS 7.0), a privilege escalation flaw in Windows AFD.sys patched in August 2026 Patch Tuesday. The campaign targets defense and aerospace firms in France, Germany, Brazil, and India via trojanized PDF viewers and DLL side-loading, deploying backdoors Troy, ForestTiger, and the FudModule 3.1 kernel rootkit. Attackers also compromise WordPress, SharePoint, and Roundcube servers as C2, using CVE-2025-49113 and the RelayShell PHP web shell.

The Hacker NewsAug 15, 00:00 UTC · Aug 15, 2026Threat actor in the wildCVE-2026-68820 CVE-2025-491132

StripedFly Malware Operated Unnoticed for 5 Years, Infecting 1 Million Devices

The Hacker NewsNov 6, 13:51 UTC · Nov 6, 2023Malware

Friday Squid Blogging: Humboldt Squid Communication

Schneier on SecurityMay 29, 16:07 UTC · May 29, 2020Industry

Two Compromised joyfill npm Packages Run RAT When Imported Into Node.js

The Hacker NewsAug 4, 05:21 UTC · Aug 4, 2026Malware1

Russia-linked Sofacy APT developed a new ‘Go’ variant of Zebrocy tool

Security AffairsDec 19, 22:58 UTC · Dec 19, 2018Malware

China-Linked Jewelbug Uses XG-Web for Government Espionage and Crypto Fraud

China-linked Jewelbug runs government espionage and crypto fraud from a single XG-Web browser-based control framework.

Broadcom's Symantec and Carbon Black detail Jewelbug, a China-based hackers-for-hire group conducting espionage against governments and militaries in the Middle East, Southeast Asia, and South Asia, plus crypto fraud against Chinese-speaking victims. Operations center on XG-Web, a browser-centric remote-access and infostealing framework, with implants spanning browsers, Windows, Linux, and network devices. The group overlaps with CL-STA-0049, Ink Dragon, Earth Alux, and REF7707, and compromised a Middle Eastern government's webmail across 15 tenants.

The Hacker NewsAug 15, 00:00 UTC · Aug 15, 2026Threat actor in the wild