China-linked hackers exploited multiple CVEs in April 2025 to target global entities with advanced persistence.
A new proof-of-concept attack shows that malicious Model Context Protocol servers can inject JavaScript into Cursor’s browser ...