SECURITY 548
- Brevo Supply-Chain Attack Injected ClickFix Scripts on Customer Sites
- OpenAI Admits Its Models Lie to Cover Their Own Mistakes
- Building an AI Detection Engine That Understands Agent Intent
- Memory-safe Programming Goes from Advocacy to Adoption
- Multiple Vulnerabilities in Lite-On O-RU Firmware
- Most Fraudulent Hires Receive Credentials Before Detection
- Twitch Extension Exposes Users' OAuth Tokens
- Telegram Desktop Flaw Lets Hidden JavaScript Exfiltrate Messages From HTML Exports
- New DDRop Attack Breaks Intel TDX and AMD SEV-SNP
- Homebrew 7.0.0 Gets Built-in GUI and Better Security Controls
- Critical Dell ObjectScale Vulnerabilities Allow Malicious Users to Compromise the Affected System
- Surfshark VPN Breach Hackers Access Internal Testing Servers
- New Android Malware Encrypts Files, Steals Data, and Harasses Victims
- Multiple Vulnerabilities in SolarView Compact
- New N0va Phishkit Targets North America and EU A Growing Identity Risk for SOCs
- CVE-2026-88002 - Open WebUI Vulnerability Exposes Server to Hang
- CVE-2026-15460 - Missing Channel-State Validation in Zephyr Bluetooth Classic L2CAP Receive Path
- Massive Vietnam-Linked APIS Database Exposes Passport and Flight Data
- Hackers Breach F5 BIG-IP APM Devices to Deploy Linux Rootkit
- Mathspace Discloses Data Breach Affecting Over 1 Million People
- LG TV Flaws Could Let Attackers Listen In, Even In Standby Mode
- JSCeal Hides Crypto Malware in V8 Bytecode
- Critical Vulnerabilities in MikroTik RouterOS Being Actively Exploited
- ASUS Control Center Flaw Allows Attackers to Gain Full Admin Control
- Plex Issues Urgent Patch Warning for 300,000 Media Servers
- Contagious Interview Trojanized macOS Installers
- Multiple Vulnerabilities in XING CPTrans-ME-X
- Cybercrooks Target Fishbrain to Steal Password Hashes
- Google Drops Key Memory Protection From Pixel 11, Forcing GrapheneOS to Rethink Its Future
- CVE-2026-84482 - WWBN AVideo Cross-Site Request Forgery
- Attackers Steal METR API Key and Burn $600,000 in AI Credits
- Traefik Vulnerability Discovered in Version Through 3.7.11
- Security Incident – BGP Hijacking
- AI Killed the Typo Time to Rewrite Phishing Training
- Protect Your WhatsApp Account with New Passkey and 2FA Upgrades
- Multiple Vulnerabilities in SOY Series
- CVE-2026-82343 - Gimp Vulnerability Details
- CVE-2026-82291 - HeyForm Reflects Any Origin in CORS Responses While Allowing Credentials
- AI Girlfriend Review Site's Secrets Exposed for Three Weeks
- New GPUThor Attack Defeats NVIDIA ECC Protection for Root Access
- CHIRP Kenwood ITM Driver Eval Injection Allows Arbitrary Code Execution via Crafted Radio File
- Kubernetes 1.37 - New Security Features
- A GUID is Not a Credential Unauthenticated RCE in Veeam Service Provider Console
- LACMA Data Breach Exposed Sensitive Information
- FURUNO FA-50 Class B AIS Transponder Vulnerabilities
- iAuthFlow v2 The $10,000 Phishing Toolkit That Survives Your Password Reset
- Fake Microsoft Security Scans Trick Victims into Uninstalling Their Antivirus
- ToxicPanda Android Malware Uses VPN Permissions to Block Google Play
- Iran-linked Hackers Behind Cyber Attack That Shut Down Power Plant
- A Social Engineering Attempt Against ReliaQuest What We Found
- Even MOAR Powershell Analyzing Entra Logins
- A Low-Tech Solution from the Past May Be Your Best Defense Against AI Deepfakes
- Researcher Tricks Apple's Find My into Sharing Location Data with Linux
- Manic The Android Malware That Exfiltrates Data Even When the Phone Is Offline
- BTR Reforged Weaponizing Defender's Remediation Driver as a Kernel Operation Primitive
- 9 Million Images of People's Faces Exposed by Reverse Lookup Service
- Simple Scans for Cloud Metadata Service
- NASA Ground Control Software Flaw Enables Unauthenticated Commands
- Be Careful What You Put in 'Anyone with the Link' Google Docs
- Your Controls Block Known Attacks. What About the Behavior?
- Why Facebook's War on Ad Blockers Could Help Scammers
- CVE-2026-69148 - MLflow Vulnerability Exposes User Artifacts
- Large-scale DDoS Attacks Disrupted Threema Secure Messaging Service
- WhatsApp is Testing a New Warning for Scam Messages
- Apple Sends Out Threat Notifications to Users Targeted by Spyware
- Who's Tracking You? Use This New Service to Find Out
- Vulnerabilities in Mira Hormone Monitor and Android App
- Delta Probes Wi-Fi Deauth Attack on Flight Carrying DEF CON Attendees
- Enriched URL Reports VirusTotal URL Scanning 2.0
- CVE-2026-73249 - calibre Content Server Vulnerability
- Edge is Dropping Older Extensions, Affecting Popular Privacy Tools
- Hackers Breach TrueConf to Trojanize Client Installers with Backdoors
- Atlassian Rovo Can Be Tricked Into Sending Jira and Confluence Data to Attackers
- Atlassian Rovo Can Be Tricked Into Sending Jira and Confluence Data to Attackers
- When Agentic Glue Melts Exploiting Cloudflare Code Mode and Workers
- CrowdStrike Threat Hunts for Shell Command Obfuscation on VMware ESX
- Amazon and Apple Impersonated in $149.99 Unauthorized Charge Scam
- Exposed SISVISA Database Leaks 102,000 Brazilian Health Surveillance Records
- CVE-2026-7406 - BMP File Parsing Untrusted Pointer Dereference in Autodesk Products
- ENDLESSDOORS Is Phoning Home. Pick Up.
- Don't Revoke That Token Yet Inside the keyv/cacheable npm Worm
- New XCSSET Variant Targets macOS Developers via Compromised Xcode Projects
- Massive ChainDrop npm Supply-Chain Attack Infects Hundreds of Packages
- How Aqua Detected a Cryptomining Attack in Memory
- Multiple Vulnerabilities in DEEBOT PRO M1, DEEBOT PRO K1VAC and ECOVACS PRO App
- CVE-2026-11836 - Production Debug-Unlock Token Verification Missing Device Binding
- Zero Networks Enhances AI Security with 'Least Agency' Controls
- Hackers Exploit N-able N-central Flaw After Initial Fix Falls Short
- Google Password Manager Attacks Could Let Malware Hijack Passkey-Protected Accounts
- Google Chrome May Soon Block New Tab Hijacker Extensions by Default
- SplitVPN Data Breach Exposes 865k Users' Personal Records
- Watchfire Controller Software Vulnerability Alert
- Microsoft Copilot for Word Can Copy Hidden Prompts Into New Documents
- Securing Agents Across Perplexity's Client Endpoints with Numbat
- CVE-2026-14643 undici Vulnerable to Cross-User Information Disclosure
- Multiple Vulnerabilities in ELECOM Wireless LAN Routers and Access Points
- New Crypter-as-a-Service Cruciferra Fuels Stealthy Malware Attacks Worldwide
- MikroTik RouterOS and Cloud Hosted Router Vulnerability Advisory
- CubePilot Drone Software Developer Hit by DNS Hijacking
- Java Spring Boot Heapdump Scans Expose Sensitive Data
- GitHub Introduces 3-Day Dependabot Cooldown to Combat Malware
- Confused Deputy' Flaws Persist in Google Cloud and Microsoft Azure
- CVE-2026-17497 - NoteGen Arbitrary OS Command Execution via Tauri Shell
- Pope's Official Prayer App Leaks 700K+ Users' Info
- Call of Duty Mobile Scam Uses Fake Free Points to Steal Player Accounts
- Bing Images Flaws Let Crafted SVGs Run Commands as SYSTEM on Microsoft's Servers
- WhatsApp Web Chats Exposed by Adobe's Acrobat Extension Flaw
- Millions of Cars Could Be Tracked and Unlocked by a Hidden Security Flaw
- Oracle Hospitality Simphony Multiple Vulnerabilities Discovered
- Vulnerabilities in Tycon Systems TPDIN-Monitor-WEB2
- AI Music Platform Suno Exposes 55 Million Users in Data Breach
- Critical Vulnerability CVE-2026-60324 in MySQL Server
- CVE-2026-47134 - ClearanceKit Vulnerability Exposed
- Scans for Hikvision Intelligent Security API
- GitHub-native Command-and-Control Framework OctoC2 Released
- Shark Vacuum Flaw Exposes Cameras, Home Maps and Wi-Fi Passwords
- HollowByte DDoS Flaw Bloats OpenSSL Server Memory
- HollowByte DDoS Flaw Bloats OpenSSL Server Memory with 11-Byte Payload
- SALTO ProAccess Space Vulnerability Alert
- CVE-2026-44436 - Quicly Vulnerability Exposed
- OkoBot New Sophisticated Malware Framework Targets Cryptocurrency Users
- CVE-2026-62314 - Anubis Policy Bypass via Client Controlled X-Original-URI Header
- The Serpent's Tongue Luring the Python Out of Its Den
- No Single Pane of Glass Anatomy of an Azure Permission Takeover
- New MemGhost Attack Plants Persistent False Memories in AI Agents Through One Email
- Someone Is Scanning for Your MCP Servers and AI Assistant Credentials
- CVE-2026-58408 - ChurchCRM Vulnerability Exposes PII
- Critical U-Boot Bugs Undermine Secure Boot on Millions of Devices
- CVE-2026-10660 - Memory Corruption in Bluetooth BAP Broadcast Assistant
- Progress Urges ShareFile Admins to Shut Down Servers Over Credible Threat
- Post-quantum HTTPS Migration Faces Enterprise Browser Challenges
- Laser Attack Resets Tangem Wallet Passwords on Cards That Can't Be Patched
- Researcher Finds 9 Vulnerabilities in ATM Security Software
- Telegram-Hosted RedWing Malware Lets Anyone Rent Android Spyware Tools
- What Happens if China Hacks the US Water Supply? I Went to a Secret War Game to Find Out
- CVE-2026-55428 - Coder Vulnerability Route Hijacking Risk
- Backdoor Found in the Firmware for These Wi-Fi Routers. And There's No Patch
- How Hackers Just Dumped Apple’s Tightly Guarded iPhone 18 Pro Secrets on the Dark Web
- Opera GX Flaw Lets Sites Auto-Install Mods to Steal Data
- How to Tell if an Image is AI-Generated
- Confidential Computing's Core Trust Mechanism is Broken
- Unpatched Flaws Disclosed in Filesystem Bundled Into Millions of Embedded Devices
- New CitrixBleed-like NetScaler Flaw Sees Exploit Attempts in the Wild
- Google Takes Action Against Malicious Residential Proxy Networks
- Fake Google and Cloudflare Verification Pages Spread Multiple Malware Families
- CVE-2026-13768 - Gardyn IoT Hub Use of Hard-coded Credentials
- Kubota Hackers Had Month-Long Access to Network Systems
- Chrome Needs Another Whopper Update to Fix 382 Security Bugs
- Why Are WordPress Sites Still Running EOL PHP?
- Vulnerabilities in OFFIS DCMTK Toolkit
- StoneFly Storage Concentrator Vulnerabilities Exposed
- RPG Maker MV and MZ Vulnerable to OS Command Injection
- Apple Fixes WebKit Flaws in iOS and macOS, With Help From AI Tools
- CVE-2026-10648 - Critical NULL-pointer Dereference Vulnerability in MCUmgr
- Adding Automation to the Favicon.ico Method of Host Recon
- macOS Flaw Allowed Standard Users to Disable CrowdStrike and Kandji Security Tools
- Gamaredon in 2025 Leveraging Tunnels, Workers, Dead Drops, and New Alliances
- Suspected Cyberattack Sends Fake Emergency Alert to Phones Across Brazil
- Fake Domain Renewal Emails Trick Website Owners into Paying Scammers
- Introduction to COM Usage by Windows Threats
- One-two Punch Delivered in Global Operation Disrupts Cybercrime Assembly Line
- Malicious Edge Extension Abuses Native Messaging as Bridge to Malware
- Linux Process Name Masquerading
- Meta Pauses Controversial Employee-Tracking Program After Security Review
- Nearly Half of LG Smart TV Apps Contain Residential Proxy SDKs
- JaredFromSubway MEV Bot Hacked in $15 Million Crypto Theft
- FFmpeg Fixes PixelSmash Flaw in Widely Used Video Decoder
- 29-Year-Old Squid Proxy Bug 'Squidbleed' Can Leak Cleartext HTTP Requests
- Unpatchable 'usbliter8' Exploit Breaks Apple A12 and A13 SecureROM Boot Chain
- Large-Scale Malware Distribution Campaign on GitHub Uncovered
- New Abuse of the ClickOnce Technology, Part 1 The Inner Workings of ClickOnce Application Deployment
- Apple Patches High-Severity Eavesdropping Vulnerability in Beats Studio Buds
- How Orca Traced an nginx Flaw to 1.45 Million Tengine Servers
- CVE-2026-44587 - CarrierWave Bypass Vulnerability
- Users Cry Foul After AMD Stripped Memory Crypto from Its Consumer CPUs
- Adriatic Port Cyber-Attack by Anubis Sparks Warning Over Maritime Security Risks
- CVE-2026-12191 - Vulnerability in Comma AI Openpilot
- Phone Battery Draining Fast? Malware Is One of 8 Possible Factors - How to Tell for Sure
- Weekly Metasploit Update New Kerberos/Certificate Tracing Options and Multiple New Modules
- China-Linked Hackers Backdoored Linux Login Software to Hide for Nearly a Decade
- Beware of Fake Verification Pages Stealing Steam Accounts
- Alert Exploitation of CVE-2026-34197 in Apache ActiveMQ
- 21,786 Home Cameras Exposed No Password, No Warning
- Yarbo Android/iOS Mobile Application and Cloud Infrastructure Vulnerabilities
- How to Defend ARM64 Cloud Infrastructure from ITScape
- A Tale of Two Eras
- Who Runs the Ransomware Group 'The Gentlemen'?
- GitHub Ends Automatic Install Script Execution for npm
- ServiceNow Discloses Security Incident Exposing Customer Data
- Microsoft’s Open Source Tools Hacked to Steal AI Developers' Passwords
- CISA Flags Fresh SolarWinds Serv-U Flaw as Actively Exploited
- Oxford University Student Data Breach via Career Platform
- Claude Opus Uncovers Critical Flaw in Zcash's Privacy Layer
- Argamal RAT Distributed with Hentai Games
- Mini Shai-Hulud Campaign Compromises Red Hat Cloud Services
- Microsoft Backs Off Legal Threats Against Windows Security Researchers After BitLocker Backlash
- Google Patches Over 100 Android Security Vulnerabilities
- Dashlane Reports Cyberattack Hackers Steal Customer Password Vaults
- CVE-2026-44825 | Apache Solr AuthTool Hardcoded Credentials Vulnerability
- Hackers Hijacked Instagram Accounts by Tricking Meta AI Support Chatbot
- Election Interlopers Register 5K+ Domains, Hope to Catch Some Voting Phish
- Critical WP Maps Pro Plugin Flaw Leads to 3,600 Attacks in One Day
- CVE-2026-10199 - Assimp glTF2Asset.h LazyDict Null Pointer Dereference
- ChatGPhish The Page Is the Payload
- CVE-2026-48810 - FreeScout Thread Edit Authorization Bypass via Missing Mailbox Check
- CVE-2026-35616 FortiClient EMS Flaw Actively Exploited in Malware Attacks
- Introducing EvidenceForge - Synthetic Security Logs That Don't Look Fake
- Sparkplug B Protocol Fuzzing with AI Assistance
- ABB LVS MConfig Vulnerability Advisory
- Eppendorf BioFlo 320 Vulnerability Alert
- Exploitation of KnowledgeDeliver via ViewState Deserialization Vulnerability
- npm Adds 2FA-Gated Publishing and Package Install Controls Against Supply Chain Attacks
- Hitachi Energy GMS600 Vulnerability Advisory
- Attackers Expose Plaintext Passwords of 46k Myspace93 Users After 2021 Breach
- Hackers Hate AI Slop Even More Than You Do
- Critical Pre-Auth RCE in ChromaDB Threatens AI Infrastructure
- Drupal Admins Rush to Patch Critical SQL Injection Vulnerability
- The Expendable Extension Name Azure VMAccess Naming Chaos, Password Resets, and a Detection Gap
- Drupal to Release Urgent Core Security Updates on May 20, Sites Told to Prepare
- Linus Torvalds Critiques AI-Powered Bug Hunters for Linux Security
- Microsoft Rejects Critical Azure Vulnerability Report, No CVE Issued
- Security Update Guide - Loading
- First Public Kernel Memory Corruption
- Zero-day Exploit Bypasses Windows 11 BitLocker Protection
- PraisonAI Vulnerability Gets Scanned Within 4 Hours of Disclosure
- Quest KACE SMA Flaw CVE-2025-32975 Exposes 60 Organizations
- Glances 4.5.2 Command Injection Vulnerability
- Coreruleset 4.21.0 - Firewall Bypass
- Bug Hunter Tracks Down Three Massive MCP Flaws
- AWS to Quick Admins Access Control Issues and Customer Impact
- CISOs Step into the AI Spotlight
- New Exim BDAT Vulnerability Exposes GnuTLS Builds to Potential Code Execution
- ABB WebPro SNMP Card PowerValue Multiple Vulnerabilities
- Yarbo Responds to Robot Flaws That Could Mow Down Their Owners
- New GhostLock Tool Abuses Windows API to Block File Access
- Active Attack Dirty Frag Linux Vulnerability Expands Post-Compromise Risk
- Google Fixes CVSS 10 Gemini CLI Vulnerability Enabling GitHub Issue-Based RCE
- Google's Android Apps Get Public Verification to Stop Supply Chain Attacks
- Before the Breach, There Was a Test Environment
- Trojan Abuses Microsoft Phone Link App to Steal Your Passwords
- Edge Browser Leaves Passwords Exposed in Plain Text, Says Researcher
- The New Ouroboros Technique and How It Fits in dMSA's Security Model
- Progress Patches Critical MOVEit Automation Bug Enabling Authentication Bypass
- DigiCert Hacked with a Malicious Screensaver File
- Microsoft Defender Flags DigiCert Certs as Trojan
- Trellix Discloses Security Breach of Code Repository
- Copy Fail Vulnerability in Major Linux Distributions
- DeepDoor Python Backdoor Evades Detection On Windows
- Agent's Claims on WhatsApp Access Spark Security Concerns
- Microsoft Won't Patch PhantomRPC - Feature or Bug?
- GitHub Rushed to Fix a Critical Vulnerability in Less Than Six Hours
- Securing RAG Pipelines in Enterprise SaaS
- HTTP Requests with X-Vercel-Set-Bypass-Cookie Header
- Robinhood Account Creation Flaw Abused to Send Phishing Emails
- Firefox Bug CVE-2026-6770 Enables Cross-Site Tracking and Tor Fingerprinting
- Canada Arrests Three for Operating SMS Blaster Device in Toronto
- ClickUp's Hardcoded API Key Exposes 959 Emails from Fortune 500 Giants
- Critical Bug in CrowdStrike LogScale Lets Attackers Access Files
- American Utility Firm Itron Discloses Breach of Internal IT Network
- Bad Memories Still Haunt AI Agents
- Bad Connection Uncovering Global Telecom Exploitation
- Bad Connection Uncovering Global Telecom Exploitation by Covert Surveillance Actors
- Stopping Fraud at Each Stage of the Customer Journey Without Adding Friction
- Vercel April 2026 Security Incident
- Apple Works on Fix for iPhone Passcode Bug Linked to Missing Czech Keyboard Character
- Anonymizing Network Traffic A Dive into SOCKS5 and Data Encryption
- Cookeville Medical Center Notifies Patients After July 2025 Ransomware Attack
- PHP Composer Flaws Enable Remote Command Execution via Perforce VCS
- Like handing out the blueprint to a bank vault' Why AI led one company to abandon open source
- Kraken Exchange Faces Extortion After Insider Recorded System Footage
- Personal Data of 1 Million Gym Members Compromised in Basic-Fit Security Incident
- Why Your Deprecated Endpoints Are an Attacker's Best Friend The Rise of Ghost APIs
- OpenSSF Flags Malware Campaign on Slack Posing as Linux Foundation Figures
- Treasury Secretary and Fed Chair Summon Banking Executives Over AI Security Concerns
- Google Launches Gmail End-to-End Encryption for Android and iOS
- The Mythos Inflection Point - Dealing With the Upcoming Vulnerability Disclosure Avalanche
- The Mythos Inflection Point - Dealing With the Upcoming Vulnerability Disclosure Avalanche and Compressed Exploitation Window
- Google Chrome Adds Infostealer Protection Against Session Cookie Theft
- CVE-2026-23226 How a Missing Lock in ksmbd's Channel List Exposes Your Linux SMB3 Server
- Docker CVE-2026-34040 Lets Attackers Bypass Authorization and Gain Host Access
- GPUBreach Exploit Uses GPU Memory Bit-Flips to Achieve Full System Takeover
- GPUBreach Exploit Uses GPU Memory Bit-Flips for Full System Takeover
- MCP Isn't a Protocol Problem An Identity Crisis
- Traffic Violation Scams Switch to QR Codes in New Phishing Texts
- CBP Facility Codes Leaked via Online Flashcards
- New Rowhammer Attacks Give Complete Control of Machines Running Nvidia GPUs
- Malicious Script That Gets Rid of ADS
- GIGABYTE Control Center Vulnerable to Arbitrary File Write Flaw
- New RoadK1ll WebSocket Implant Used to Pivot on Breached Networks
- LangChain Path Traversal Bug Exposes AI Pipeline Vulnerabilities
- OpenAI Patches ChatGPT Flaw That Smuggled Data Over DNS
- 15-Year-Old strongSwan Flaw Lets Attackers Crash VPNs via Integer Underflow
- New RoadK1ll WebSocket Implant Used to Pivot on Breached Networks
- LangChain Path Traversal Bug Exposes AI Pipeline Vulnerabilities
- OpenAI Patches ChatGPT Flaw That Smuggled Data Over DNS
- 15-Year-Old strongSwan Flaw Lets Attackers Crash VPNs via Integer Underflow
- These Warning Signs Could Mean Spyware Is On Your Phone - And 9 Ways To Keep It Secure
- Researchers Uncover WebRTC Skimmer Bypassing Traditional Defenses
- These Warning Signs Could Mean Spyware Is On Your Phone - And 9 Ways To Keep It Secure
- Researchers Uncover WebRTC Skimmer Bypassing Traditional Defenses
- PolyShell Attacks Target 56% of All Vulnerable Magento Stores
- PolyShell Attacks Target 56% of All Vulnerable Magento Stores
- Vibe Check AI May Replace SaaS (But Not for a While)
- Vibe Check AI May Replace SaaS (But Not for a While)
- QNAP Fixes Four Vulnerabilities Demonstrated at Pwn2Own Ireland 2025
- Critical Vulnerability CVE-2025-32975 Exploited in Quest KACE Systems
- A Declassified Look Inside the Dark Economy of Cybercrime
- QNAP Fixes Four Vulnerabilities Demonstrated at Pwn2Own Ireland 2025
- Critical Vulnerability CVE-2025-32975 Exploited in Quest KACE Systems
- A Declassified Look Inside the Dark Economy of Cybercrime
- Trivy Compromised Everything You Need to Know about the Latest Supply Chain Attack
- CVE-2026-31979 The Symlink Trap - Root Privilege Escalation in Himmelblau
- Trivy Compromised Everything You Need to Know about the Latest Supply Chain Attack
- CVE-2026-31979 The Symlink Trap - Root Privilege Escalation in Himmelblau
- Critical Ubiquiti UniFi Security Flaw Allows Potential Account Hijacking
- New 'PolyShell' Flaw Allows Unauthenticated RCE on Magento E-Stores
- Critical Ubiquiti UniFi Security Flaw Allows Potential Account Hijacking
- New 'PolyShell' Flaw Allows Unauthenticated RCE on Magento E-Stores
- Scans for Adminer Understanding the Threat
- Transparent COM Instrumentation for Malware Analysis
- Researchers Found Font-Rendering Trick to Hide Malicious Commands
- New Ubuntu Flaw Enables Local Attackers to Gain Root Access
- Interlock Ransomware Exploits Cisco FMC Zero-Day CVE-2026-20131 for Root Access
- How to Examine Polyglot Files with Spectra Analyze
- GlassWorm Attack Uses Stolen GitHub Tokens to Force-Push Malware Into Python Repos
- Flaw in UK's Corporate Registry Exposes Directors' Data
- AppsFlyer Web SDK Hijacked to Spread Crypto-Stealing JavaScript Code
- Twenty Years of Cloud Security Research
- CrackArmor - Critical AppArmor Flaws Enable Local Privilege Escalation to Root
- Canadian Retail Giant Loblaw Notifies Customers of Data Breach
- This Android Vulnerability Can Break Your Lock Screen in Under 60 Seconds
- Hewlett Packard Enterprise Fixes Critical Authentication Bypass in Aruba AOS-CX
- Alert Regarding Vulnerabilities in Adobe Acrobat and Reader
- Hewlett Packard Enterprise Fixes Critical Authentication Bypass in Aruba AOS-CX
- Alert Regarding Vulnerabilities in Adobe Acrobat and Reader
- Vulnerabilities in Lantronix EDS3000PS and EDS5000
- Honeywell IQ4x BMS Controller Vulnerability Advisory
- How We Hacked McKinsey's AI Platform
- Improper File Access Permission Settings in Digital Arts Products
- Fixing Request Smuggling Vulnerabilities in Pingora OSS Deployments
- How AI Assistants are Moving the Security Goalposts
- An AI Broke Out of Its System to Mine Crypto
- High-severity Qualcomm Bug Hits Android Devices in Targeted Attacks
- Cisco Fixes Maximum-Severity Secure FMC Bugs Threatening Firewall Security
- Most Cybercriminals Are Middle-Aged New Data Reveals
- Google Quantum-Proofs HTTPS by Squeezing 15kB of Data into 700-Byte Space
- QuickLens Chrome Extension Steals Crypto and Shows ClickFix Attack
- Critical Juniper Networks PTX Flaw Allows Full Router Takeover
- The Investigative Gap - Why Forensic Context is the SOC’s Greatest Bottleneck
- Post-Exploitation at Scale - The Rise of AILM
- One-click Disaster Microsoft’s Entra Tokens at Risk
- Man Accidentally Gains Control of 7,000 Robot Vacuums
- Critical Cisco SD-WAN Bug Exploited in Zero-Day Attacks 🚨
- RoguePilot Flaw in GitHub Codespaces Enabled Copilot to Leak GITHUB_TOKEN
- Go Library Maintainer Critiques GitHub's Dependabot as a 'Noise Machine'
- How to Set Up Private DNS Mode on Your iPhone - Why You Should Do It ASAP
- 2025 - The Untold Stories of Check Point Research
- Hackers Hide Pulsar RAT Inside PNG Images in New NPM Supply Chain Attack
- Critical Vulnerabilities Found in NesterSoft WorkTime
- Predator Spyware Hides iOS Recording Indicators
- PayPal App Code Error Exposes Personal Information
- Welker OdorEyes EcoSystem Pulse Bypass System Vulnerability Alert
- Critical Grandstream VoIP Bug Highlights SMB Security Blind Spot
- Keenadu The Tablet Conqueror and Major Android Botnets
- Fake Incident Report Used in Phishing Campaign
- Critical Vulnerabilities in GE Vernova Enervista UR Setup
- Android 17 Beta Introduces Secure-By-Default Architecture
- RoguePilot - Exploiting GitHub Copilot for a Repository Takeover
- Security Flaw at DavaIndia Pharmacy Exposes Customer Data
- Eurail Confirms Stolen Traveler Data for Sale on Dark Web
- Snail Mail Phishing Targets Trezor and Ledger Users
- Security Experts Warn Discord Age Checks Create 'Identity Honey Pot'
- Microsoft Store Outlook Add-in Hijacked to Steal 4,000 Accounts
- Quick Howto - Extract URLs from RTF Files
- Password Guessing Without AI How Attackers Build Targeted Wordlists
- How the GNU C Compiler Became the Clippy of Cryptography
- BeyondTrust Fixes Critical Pre-Auth Bug Allowing Remote Code Execution
- Nearly 5 Million Web Servers Found Exposing Git Metadata – Study Reveals Widespread Risk of Code and Credential Leaks
- Eradicating Trivial Vulnerabilities at Scale
- Eradicating Trivial Vulnerabilities at Scale
- Web Traffic Hijacking Malicious Nginx Configurations Uncovered
- The Double-Edged Sword of Non-Human Identities
- DockerDash Exposes AI Supply Chain Weakness In Docker's Ask Gordon
- Wave of Citrix NetScaler Scans Utilize Thousands of Residential Proxies
- Step Finance Reports $40M Crypto Theft Due to Compromised Devices
- Multiple Vulnerabilities Found in ELECOM Wireless LAN Products
- Notepad++ Hijacked by State-Sponsored Hackers
- Mutagen Astronomy From Discovery to CISA Recognition—A Seven-Year Journey
- Mutagen Astronomy - From Discovery to CISA Recognition—A Seven-Year Journey
- Multiple Vulnerabilities Found in Cybozu Garoon
- Android RAT Uses Hugging Face to Host Malware
- 341 Malicious ClawHub Skills Discovered Stealing User Data
- Why has Microsoft been routing example.com traffic to a company in Japan?
- WhatsApp Rolls Out Lockdown-Style Security Mode to Protect Targeted Users From Spyware
- Pyodide Sandbox Escape Enables Remote Code Execution in Grist-Core
- Initial Stages of Romance Scams [Guest Diary]
- Defending with AD Tripwires - GOAD Walkthrough
- FBI Accessed Windows Laptops After Microsoft Shared BitLocker Recovery Keys
- Delta Electronics DIAView Vulnerability Advisory
- Don't click on the LastPass 'create backup' link - it's a scam
- Can you use too many LOLBins to drop some RATs?
- Critical TP-Link VIGI camera flaw allowed remote takeover of surveillance systems
- Leveraging Landlock telemetry for Linux detection engineering
- German Manufacturing Under Phishing Attacks - Tracking a Stealthy AsyncRAT Campaign
- A single click mounted a covert, multistage attack against Copilot
- Why iPhone users should update and restart their devices now
- Unveiling VoidLink – A Stealthy, Cloud-Native Linux Malware Framework
- CVE-2026-22200
- Fake WinRAR downloads hide malware behind a real installer
- Hackers actively exploit critical RCE flaw in legacy D-Link DSL routers
- NordVPN Denies Breach After Hacker Claims Access to Salesforce Dev Data
- China's guardian of secrets 保密管理系统
- New React Rsc Vulnerabilities Enable.Html
- NANOREMOTE, cousin of FINALDRAFT
- 7 Best Security Awareness Training Platforms For MSPs in 2026
- Multiple India-based CCTV Cameras
- Exploitation of React2Shell Surges
- Despite Microsoft’s secret patch, LNK loophole remains viable for hackers to deliver malware
- Google fixes two Android zero days exploited in attacks, 107 flaws
- Glassworm malware returns in third wave of malicious VS Code packages
- Shai-hulud 2.0 Campaign Targets Cloud and Developer Ecosystems
- Over 390 Abandoned iCalendar Sync Domains Could Expose ~4 Million Devices to Security Risks
- Old tech, new vulnerabilities - NTLM abuse, ongoing exploitation in 2025
- Russian RomCom Utilizing SocGholish to Deliver Mythic Agent to U.S. Companies Supporting Ukraine
- Is Your Android TV Streaming Box Part of a Botnet?
- Weaponized file name flaw makes updating glob an urgent job
- Critical 7 Zip Vulnerability With Public Exploit Requires Manual Update
- WrtHug Exploits Six ASUS WRT Flaws to Hijack Tens of Thousands of EoL Routers Worldwide
- Mac users warned about new DigitStealer information stealer
- Critics scoff after Microsoft warns AI feature can infect machines and pilfer data
- Active Directory Trust Misclassification - Why Old Trusts Look Like Insecure External Trusts
- Agents built into your workflow - Get Security Copilot with Microsoft 365 E5
- RondoDox Exploits Unpatched XWiki Servers to Pull More Devices Into Its Botnet
- Microsoft Patch Tuesday for November 2025 — Snort rules and prominent vulnerabilities
- Google sounds alarm on self-modifying AI malware
- How an Attacker Drained 28M from Balancer Through Rounding Error Exploitation
- Exploiting Microsoft Teams Impersonation and Spoofing Vulnerabilities Exposed
- Chrome can now store your driver's license and passport, but is that safe?
- 11 ways to delete or hide yourself from the internet - and protect your privacy
- Drawn to Danger Windows Graphics Vulnerabilities Lead to Remote Code Execution and Memory Exposure
- Attackers targeting unpatched Cisco kit notice malware implant removal, install it again
- New "Brash" Exploit Crashes Chromium Browsers Instantly with a Single Malicious URL
- TEE.Fail attack breaks confidential computing on Intel, AMD, NVIDIA CPUs
- BiDi Swap The bidirectional text trick that makes fake URLs look real
- Hackers exploit 34 zero-days on first day of Pwn2Own Ireland
- Data brokers are constantly doxing us, and we can’t do anything about it
- Whisper 2FA Behind One Million Phishing Attempts Since July
- Elasticsearch Leak Exposes 6 Billion Records from Scraping, Old and New Breaches
- Unverified COTS hardware enables persistent attacks in small satellites via SpyChain
- New Android Pixnapping attack steals MFA codes pixel-by-pixel
- New Oracle E-Business Suite Bug Could Let Hackers Access Data Without Login
- SquareX Shows AI Browsers Fall Prey to OAuth Attacks, Malware Downloads and Malicious Link Distribution
- SaaS Breaches Start with Tokens - What Security Teams Must Watch
- New Mic-E-Mouse Attack Shows Computer Mice Can Capture Conversations
- Ghost in the Cloud Weaponizing AWS X-Ray for Command & Control
- Massive network of 30,000 websites filters victims before delivering scams or malware
- Broadcom Fails to Disclose Zero-Day Exploitation of VMware Vulnerability
- SVG Security Analysis Toolkit to Detect Malicious Scripts Hidden in SVG Files
- Microsoft Flags AI-Driven Phishing LLM-Crafted SVG Files Outsmart Email Security
- Cisco warns of IOS zero-day vulnerability exploited in attacks
- US Secret Service dismantled covert communications network near the U.N. in New York
- Microsoft Fixed Entra ID Vulnerability Allowing Global Admin Impersonation
- ShadowLeak Exploit Exposed Gmail Data Through ChatGPT Agent
- Researchers expose MalTerminal, an LLM-enabled malware pioneer
- Microsoft Entra ID flaw allowed hijacking any company's tenant
- Heathrow Airport Cyberattack What Happened, Who’s Affected, and What CISOs Should Know
- Unmasking Akira The ransomware tactics you can’t afford to ignore
- Google Chrome 0-Day Vulnerability Actively Exploited in the Wild – Patch Now
- APT37 Targets Windows with Rust Backdoor and Python Loader
- Severe Hikvision HikCentral Product Flaws What You Need to Know
- Google fixes actively exploited Android flaws in September update
- Azure AD Credentials Exposed in Public App Settings File
- WhatsApp patches vulnerability exploited in zero-day attacks
- Apple rushes out fix for active zero-day in iOS and macOS
- Major password managers can leak logins in clickjacking attacks
- Flaws in Software Used by Hundreds of Cities and Towns Exposed Sensitive Data
- New Research Links VPN Apps, Highlights Security Deficiencies
- New Ghost-tapping Attacks Steal Customers’ Cards Linked to Services Like Apple Pay and Google Pay
- EncryptHub Abuses Brave Support in new Campaign Exploiting- MSC Eviltwin Flaw
- New 'Curly COMrades' APT Using NGEN COM Hijacking in Georgia, Moldova Attacks
- OWASP AIVSS targets agentic AI risk
- Critical Vulnerability Impacting Over 100K Sites Patched in Everest Forms Plugin
- Smart Contract Scams | Ethereum Drainers Pose as Trading Bots to Steal Crypto
- ReVault! When your SoC turns against you…
- Perplexity is using stealth, undeclared crawlers to evade website no-crawl directives
- New Plague Linux malware stealthily maintains SSH access
- Fingerprinting Malware C2s with Tags
- Critical Vulnerability in NestJS Devtools Localhost RCE via Sandbox Escape
- Dahua Camera flaws allow remote hacking. Update firmware now
- Qwins Ltd Bulletproof Hosting Provider Powering Global Malware Campaigns
- Exploiting Direct Send Attackers Abuse Microsoft 365 to Deliver Internal Phishing Attacks
- Auto-Color Backdoor How Darktrace Thwarted a Stealthy Linux Intrusion
- Attackers Actively Exploiting Critical Vulnerability in Alone Theme
- Hackers Exploit Official Gaming Mouse Software to Spread Windows-based Xred Malware
- Critical Vulnerabilities Found in Tridium Niagara Framework
- Account Takeover Vulnerability Affecting Over 400K Installations Patched in Post SMTP Plugin
- BIDI Swap Unmasking the Art of URL Misleading with Bidirectional Text Tricks
- NET RFQ Request for Quote Scammers Casting Wide Net to Steal Real Goods
- Lookout Discovers Iranian APT MuddyWater Leveraging DCHSpy During Israel-Iran Conflict
- Fake Receipts Generators the rising threat to major retail brands
- British spies and SAS named in Afghan data breach
- Zyxel security advisory for path traversal vulnerability in APs
- Tracking Protestware Spread 28 npm Packages Affected by Payload Targeting Russian-Language Users
- Konfety Returns Classic Mobile Threat with New Evasion Techniques
- Global Louis Vuitton data breach impacts UK, South Korea, and Turkey
- DOGE Denizen Marko Elez Leaked API Key for xAI
- Pre-Auth SQL Injection to RCE - Fortinet FortiWeb Fabric Connector (CVE-2025-25257)
- macOS.ZuRu Resurfaces | Modified Khepri C2 Hides Inside Doctored Termius App
- At last, a use case for AI agents with sky-high ROI Stealing crypto
- Asus and Adobe vulnerabilities
- Server with Rockerbox Tax Firm Data Exposed 286GB of Records
- Risky Bulletin Browser extensions hijacked for web scraping botnet
- Attackers Inject Code into WordPress Theme to Redirect Visitors
- Animation-Driven Tapjacking on Android
- Unmasking Insecure HTTP Data Leaks in Popular Chrome Extensions
- Large Language Models (LLMs) Are Falling for Phishing Scams What Happens When AI Gives You the Wrong URL?
- Can You Trust that Verified Symbol? Exploiting IDE Extensions is Easier Than it Should Be
- Zero-day Bluetooth gap turns millions of headphones into listening stations
- Extracting Lines of Interest From Zeek Logs
- The Case of Hidden Spam Pages
- In the Wild Malware Prototype with Embedded Prompt Injection
- Don't panic, but it's only a matter of time before critical 'CitrixBleed 2' is under attack
- Another Wave North Korean Contagious Interview Campaign Drops 35 New Malicious npm Packages
- Trix Shots Remote Code Execution on Aviatrix Controller
- ConnectUnwise Threat actors abuse ConnectWise as builder for signed malware
- Androxgh0st Continues Exploitation Operators Compromise a US University For Hosting C2 Logger
- What’s Inside the Massive Chinese Data Leak
- Fault Injection – Follow the White Rabbit
- Acer Control Center Flaw Lets Attackers Run Malicious Code as Elevated User
- The TokenBreak Attack
- Inside a Dark Adtech Empire Fed by Fake CAPTCHAs
- GitHub Device Code Phishing
- From Trust to Threat Hijacked Discord Invites Used for Multi-Stage Malware Delivery
- EchoLeak Zero-Click AI Attack in Microsoft Copilot Exposes Company Data
- The Evolution of Linux Binaries in Targeted Cloud Operations
- Researcher Found Flaw to Discover Phone Numbers Linked to Any Google Account
- Peep show 40K IoT cameras worldwide stream secrets to anyone with a browser
- Critical Vulnerability Patched in SAP NetWeaver
- Blitz Malware A Tale of Game Cheats and Code Repositories
- ClickFix Attack Exploits Fake Cloudflare Turnstile to Deliver Malware
- Same Automated Impersonation for All
- Roundcube Webmail under fire critical exploit found after a decade
- Fake WordPress Caching Plugin Used to Steal Admin Credentials
- Versa Concerto Understanding and Mitigating CVE-2025-34027
- Mark Your Calendar APT41 Innovative Tactics
- The Sharp Taste of Mimo’lette Analyzing Mimo’s Latest Campaign targeting Craft CMS
- Twenty Years of Cloud Security Research
- CrackArmor - Critical AppArmor Flaws Enable Local Privilege Escalation to Root