The Exploit Post

Sign in Subscribe

Latest

X Asks Users to Re-register Passkeys or Their Accounts Will Be Blocked

X Asks Users to Re-register Passkeys or Their Accounts Will Be Blocked

Social network X (formerly Twitter) has warned users they must re-register their hardware security keys and passkeys used for two-factor authentication (2FA) by November 10. Failure to comply will result in account lockouts. The warning applies only to users who rely on passkeys or hardware keys like YubiKey for 2FA.

Hackers Are Massively Exploiting Outdated WordPress Plugins

Hackers Are Massively Exploiting Outdated WordPress Plugins

Cybersecurity firm Wordfence is sounding the alarm about a large-scale malicious campaign targeting critical vulnerabilities in two popular WordPress plugins: GutenKit and Hunk Companion. In just two days, the company blocked 8.7 million attack attempts against its clients. Three Critical Vulnerabilities Under Active Exploitation Attackers are leveraging three critical

ChatGPT Atlas Browser Vulnerable to Prompt Injection via URL Bar

ChatGPT Atlas Browser Vulnerable to Prompt Injection via URL Bar

Security researchers at NeuralTrust have uncovered a critical vulnerability in OpenAI's ChatGPT Atlas agentic browser that allows attackers to execute malicious AI commands disguised as ordinary web links. The flaw exploits how Atlas processes input in its omnibox—the address bar where users enter URLs or search queries.

Chrome Zero-Day Exploit Linked to Hacking Team's Dante Spyware in Russian Espionage Campaign

Chrome Zero-Day Exploit Linked to Hacking Team's Dante Spyware in Russian Espionage Campaign

Kaspersky Lab researchers have documented the first real-world deployment of Dante, commercial spyware developed by Italian firm Memento Labs—the rebranded successor to the notorious Hacking Team. The discovery emerged from analysis of "Operation Forum Troll," a sophisticated cyber-espionage campaign targeting Russian organizations. From Scandal to Rebranding: Hacking

Firefox Mandates Data Collection Disclosures for All Extensions

Firefox Mandates Data Collection Disclosures for All Extensions

Mozilla is implementing new transparency requirements that will force Firefox extension developers to explicitly disclose what user data they collect or share with third parties. The policy takes effect November 3, 2025, for new extensions and becomes mandatory for all developers by mid-2026. How the New System Works Under the

Phishers Exploit LastPass Emergency Feature with Fake Death Certificates

Phishers Exploit LastPass Emergency Feature with Fake Death Certificates

LastPass has issued an urgent warning about a sophisticated phishing campaign that began mid-October 2025, in which attackers send fraudulent emergency access requests claiming the account holder has died. Security researchers attribute the campaign to CryptoChameleon (also tracked as UNC5356), a financially motivated threat group specializing in cryptocurrency theft. The

Critical DNS Cache Poisoning Flaws Patched in BIND, the Internet's Most Widely Used DNS Server

Critical DNS Cache Poisoning Flaws Patched in BIND, the Internet's Most Widely Used DNS Server

The Internet Systems Consortium (ISC) has released emergency security updates for BIND 9, addressing three serious vulnerabilities that could allow attackers to poison DNS caches and redirect users to malicious websites—or simply knock DNS servers offline. Two of the flaws enable cache poisoning attacks that undermine protections established nearly