The PinTheft exploit for a Linux privilege escalation is now publicly available; the vulnerability primarily affects Arch Linux because the required RDS module is enabled by default there, and users should immediately install kernel updates or disable the RDS module.

An overlooked GitHub token following the TanStack attack enabled hackers to access Grafana’s private repositories, but the company confirms no customer data or production systems were affected.

Fox Tempest operated a malware signing service for ransomware gangs, which Microsoft disrupted through Operation OpFauxSign via server takedowns and website seizures.

Chinese-aligned hacker group Webworm is arming itself in 2025 with two new backdoors: EchoCreep leverages Discord, while GraphWorm uses Microsoft’s Graph API for command-and-control communications, with the group increasingly targeting European entities and using legitimate tools for obfuscation.

The threat group Storm-2949 conducts targeted attacks on Microsoft 365 and Azure by abusing the Self-Service Password Reset system, gaining access to sensitive data with stolen credentials, and exfiltrating it across various Azure services.

Microsoft confirms that a macOS security update is causing annoying, non-closeable location prompts in Teams, and the company is working on a fix while recommending manual configuration in macOS settings as a workaround.