New GPUThor Rowhammer Defeats ECC on NVIDIA RTX A6000 to Gain Host Root Access

Source: The Hacker News

Researchers demonstrated GPUThor, a Rowhammer technique that produced multi-bit errors on several NVIDIA Ampere workstation GPUs and bypassed the protection expected from ECC. With unprivileged CUDA execution, the team achieved denial of service and host privilege escalation. Defenders should limit untrusted GPU workloads, avoid cross-tenant sharing, and monitor ECC errors.

Link to article

Unpatched Calix flaw lets hackers bypass NAT to expose internal devices

Source: BleepingComputer

CVE-2026-75501 exposes a MiniUPnPd control endpoint on affected Calix GS7 XGS residential routers without authentication. Remote attackers can create persistent port-forwarding rules that bypass NAT and expose internal cameras, storage, administration interfaces, or IoT devices. No patch was available; users were advised to disable UPnP or contact their ISP.

Link to article

Russian Hackers Phish EU Officials Over Messaging Apps

Source: Dark Reading

European officials are facing spear-phishing campaigns delivered through Signal and WhatsApp, where attackers impersonate support services, demand PINs, or trick targets into linking hostile devices through QR codes. The shift moves social engineering beyond monitored email channels and highlights the need for approved government messaging platforms, device controls, and user verification procedures.

Link to article

Cyberattack Causes Global Disruption at Boston Scientific

Source: SecurityWeek

Boston Scientific disclosed a cybersecurity incident affecting IT systems and causing a global network outage. The disruption limited access to business applications, including systems used to process and ship customer orders. The medical-device company said its investigation was continuing and that the incident’s operational, financial, and possible data-breach impacts remained unknown.

Link to article

US Disrupts Chinese Hacking Platform Used in Military and Critical Infrastructure Attacks

Source: SecurityWeek

U.S. authorities seized domains supporting QScan and QTRouter, platforms tied to the China-linked QTFY group. The infrastructure scanned for vulnerable IoT devices, built an obfuscation botnet, and supported attacks against military, government, telecom, higher-education, and other critical targets. Hard-coded domain seizures reportedly rendered both services inoperable.

Link to article