-
From: anyone@icloud.com — Spoofing Any Apple iCloud Sender
A SEC Consult researcher found two ways to send email from any @icloud.com address through Apple's infrastructure — even tim.cook@icloud.com — while passing SPF, DKIM and DMARC checks.
-
Critical Roundcube flaw now under active exploitation
Canada's cyber security agency warns that a Roundcube Webmail vulnerability, patched back in May, is now being used in real-world attacks.
-
Critical Cisco Secure Email Gateway Vulnerability Exploited in Attacks
Cisco has warned of active exploitation of CVE-2026-76461, rated 9.8, which allows remote command execution with root privileges through a specially crafted email.
-
He Bought the Domain noreply.net — and Companies Flooded Him with Other People's Secrets
A security researcher bought placeholder domains like noreply.net and found that organizations around the world had spent years sending confidential data there, assuming the addresses were a void.
-
Fastmail opens a European data region in Amsterdam
The email service Fastmail has given users a choice: keep the primary copy of their data in the US or in the European Union. The company has installed its own servers in Amsterdam and honestly warns that it cannot give an absolute “EU-only data” guarantee.
-
CSS in Emails: How Mail Styling Turns Into Password and Token Theft
PortSwigger researcher Gareth Heyes showed at Black Hat USA 2026 how an email's contents can break out of their bounds and hijack the webmail interface — from Outlook to Gmail and Proton Mail.
-
Chrome is testing an email verification protocol with no emails and no one-time codes
Google has launched an origin trial for the Email Verification API — a mechanism that lets a site confirm a user owns the address they entered, without sending them an email with a link or a code.