A glitch in Auth0 could allow attackers to spoof a legitimate website and collect sensitive information from visitors. Go to Source

Scammers recently targeted Booking.com customers via WhatsApp messages and texts asking them for full payment for holidays. Go to Source

An unspecified “private” server was found with the account data of users who signed up for the service, in the largest breach since Equifax last year. Go to Source

An analysis of 10,000 mobile apps has found that a significant portion of them are open to web API hijacking – thanks to inconsistencies between app and server logic in web APIs. Go to Source

More than 115,000 sites are still vulnerable to a highly critical Drupal bug – even though a patch was released three months ago. Go to Source

Remote code execution vulnerabilities dominate this month’s critical Android patches. Go to Source

Social media data privacy controls were the top security topic at Apple’s WWDC on Monday. Go to Source

A Microsoft Windows vulnerability enables remote attackers to execute arbitrary code – and there’s no patch yet. Go to Source

An attacker can pick up the profile picture, username and the “likes” of unsuspecting visitors who find themselves landing on a malicious website. Go to Source

The exposed information includes accounts payable and invoice data, customer support emails, password-recovery mails, links to employee manuals, staffing schedules and other internal resources. Go to Source