Researchers found that Gemini models interpret invisible Unicode "Tag" characters as commands, allowing attackers to trick AI agents into implanting backdoors.

A decade-old browser flaw, "BiDi Swap," allows attackers to craft deceptive URLs for phishing. The bug, found by Varonis, exploits mixed-text direction.

Researchers at FireTail have discovered the resurrection of an old-class flaw — ASCII Smuggling — now resurfacing in

Koi Security exposed GlassWorm, the first VSCode worm that spreads autonomously, using invisible Unicode to hide malicious code. It uses Solana blockchain and Google Calendar for a resilient C2.

The BiDi Swap attack exploits flaws in Unicode's bidirectional text rendering to make malicious URLs look legitimate, tricking users and bypassing browser security.

Making text readable for humans, but not for AI.

GlassWorm resurfaced, infecting 3 new VS Code extensions on OpenVSX. The worm uses invisible Unicode and Solana blockchain C2 to steal credentials and spread via AI-generated malicious commits on GitHub.

The Glassworm campaign targeting popular Visual Studio Code extensions has entered yet another phase — researchers are now

الحمد لله والصلاة والسلام على رسول الله وعلى آله وصحبه أما بعد

SonicWall patches critical SMA 1000 flaws, including a 7.2 SQL injection for privilege escalation and Unicode-based MFA bypasses. Secure your VPN—update now!