#The Hacker News
All CosmicBytez Labs articles tagged #The Hacker News, across news, security advisories, how-to guides, and projects.
- News
ThreatsDay Bulletin: Adobe RCE, DNS Wallet Theft, NVIDIA Container Escape, Self-Healing Backdoor and 23 More
This week's bulletin covers an Adobe AEM RCE chain, a DNS-based crypto wallet drainer, an NVIDIA container escape, a self-healing WP backdoor, plus 23 more.
- News
Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE
CVE-2026-85097 (CVSS 10.0), a critical flaw in the Bricksforge WordPress plugin, is under active exploitation enabling unauthenticated RCE.
- News
Credential-Stealing GitHub Actions Workflows Planted in Tens of Thousands of Repositories
GhostAction hijacked pyxel's and Uber athenadriver's maintainer accounts, pushing credential-stealing workflows to hundreds of repos in a 500-account wave.
- News
FBI, Allies Expose China-Linked Flax Typhoon Portal Selling Stolen Email Access
FBI and 6 allied nations say China's Integrity Tech ran a portal selling access to emails stolen from Southeast Asian governments and healthcare systems.
- News
ThreatsDay Recap: Ransomware Affiliate Betrayal, WhatsApp RAT & More
Weekly roundup: a ransomware affiliate's betrayal, a new WhatsApp RAT, exposed attacker tools, Qilin's extradition, and more supply-chain abuse.
- News
Fake ChatGPT, Gemini, and Claude Ad Portals Capture Credentials and MFA Codes
Island researchers disclosed a human-operated phishing platform impersonating ChatGPT, Gemini, and Claude ad portals to steal logins and MFA codes.
- News
Android 17 Advanced Protection Locks Accessibility Services to Verified Tools
Android 17's Advanced Protection mode now restricts the AccessibilityService API to verified Accessibility Tools, closing a top banking-trojan vector.
- News
Critical FortiMail Zero-Day CVE-2026-104286 Actively Exploited, No Patch Yet
CISA added CVSS 9.8 FortiMail flaw CVE-2026-104286 to its KEV catalog after active exploitation; Fortinet has no fix, only workarounds.
- News
Bitget Confirms Third-Party Zero-Day Behind $387.5 Million Cryptocurrency Theft
Bitget says attackers used a zero-day in third-party security tools to steal $387.5M from hot wallets, per SlowMist and Mandiant findings.
- News
ThreatsDay: AI-Powered Zero-Day Chain, 543K Live Secrets, Model Inspection RCE and 13 More Stories
This week: an AI agent chained two Zammad zero-days to root in seconds, 543,699 live secrets sat exposed on GitHub, plus an Unsloth Studio model-inspection RCE.
- News
Hackers Use NeedyMantis to Maintain Long-Term Access in Breached Networks
Microsoft links its NeedyMantis implant to Storm-3069, found via DLL sideloading against telecoms, universities, and nonprofits since October 2025.
- News
Compromised GitHub Actions Came Back Online and Resumed Executing Mini Shai-Hulud Malware
Two actions-cool GitHub Actions, compromised in May 2026, silently reactivated their credential-stealing payload after repos were restored uncleaned.
- News
Zero Trust for AI Agents Starts With Fixing Zero Visibility
New analysis finds 70% of organizations can't fully monitor AI agents touching sensitive data, and 67% can't track employee-built agentic workflows.
- News
Roundcube Pre-Auth SQL Injection Flaw Actively Exploited in the Wild
The Canadian Centre for Cyber Security warns CVE-2026-48842, a pre-auth SQL injection flaw in Roundcube webmail, is being exploited in the wild.
- News
Attackers Exploit Issabel Framework Flaw Enabling Unauthenticated OS Command Execution
A hardcoded JWT signing key in Issabel Framework lets attackers forge tokens and hijack Asterisk to run OS commands, under active exploitation.
- News
Weekly Recap: Chrome 0-Day, Router Hijacks, Coder Supply Chain Attack, and More
This week's roundup: a sixth Chrome zero-day, mass MikroTik router hijacking, a Coder registry compromise, and N-able's third N-central RCE.
- News
ThreatsDay: Gogs 10.0 RCE, n8n Workflow-to-RCE, $10M Reward, GLM-5.3 AI Exploit
This week: Gogs CVSS 10.0 RCE via path traversal, n8n prototype pollution, Iran IRGC $10M bounty, and GLM-5.3 AI discovering 2,436 vulnerabilities.
- News
BdThemes Supply Chain Attack Poisons JSON to Create Rogue WordPress Admins
Cybersecurity researchers have uncovered a supply chain compromise targeting WordPress plugin vendor BdThemes, where attackers poisoned JSON configuration...
- News
Hackers Breach Polish Power Plant Controls via Private Cellular Network and Shut Turbine
Attackers penetrated the operational technology network of a Polish combined heat and power plant through the grid operator's private cellular network,...
- News
Weekly Recap: AI Goes Rogue, Metabase 0-Day, MCP Supply-Chain Attacks, and Router Backdoors
This week's security roundup covers agentic AI containment failures, a critical Metabase zero-day, malicious MCP plugins targeting AI assistants, and...
- News
CryptoJS Weak RNG Behind $5.7 Million in Drains Affects Five Crypto Wallet Apps
Security firm Coinspect has identified CryptoJS.lib.WordArray.random() — a 12-year-old weak random number generator — as the root cause behind the Ill...
- News
ThreatsDay: Odysseus RCE, Samsung One-Click Takeover, iCloud Backdoor Fight + 27 More Stories
This week's threat landscape is defined by cheap leverage: an RCE that fires before the first prompt, a Samsung vulnerability requiring a single click, an...
- News
Hackers Poison Adform Script to Swap Crypto Wallet Addresses Across Customer Sites
Attackers compromised a JavaScript file served by ad tech company Adform, turning it into a browser-side tool that silently rewrites cryptocurrency wallet...
- News
New Gitea RCE Lets Repository Writers Plant a Git Hook to Run Shell Commands
A critical remote code execution vulnerability in Gitea, tracked as CVE-2026-60004 with a CVSS score of 9.8, allows any user with ordinary repository...
- News
Russian Laundry Bear Exploited Zimbra Zero-Day to Steal Mail and 2FA Codes
A Russian state-sponsored espionage group spent months silently reading Western mailboxes through a zero-click XSS flaw in Zimbra's webmail client —...
- News
SonicWall SMA 1000 Zero-Days Exploited in the Wild Before Public Disclosure
A previously undocumented threat actor tracked as UTA0215 by Volexity exploited multiple zero-day vulnerabilities in SonicWall Secure Mobile Access 1000...
- News
ThreatsDay: Game Cheat Spyware, Spirals Ransomware, Chrome Sync Stalking
This week's threat roundup covers NuGet packages poisoned with game-cheat spyware, the Spirals ransomware deploying network-wide in under 24 hours, and...
- News
Google and Microsoft Pull ModHeader After Hidden Tracker Found in 1.6M-Install Extension
Google and Microsoft have removed ModHeader — a popular HTTP header editor with 1.6 million installs across Chrome and Edge — after researchers discovered...
- News
Attackers Exploit 'Ill Bloom' Vulnerability to Drain Over $5 Million From Cryptocurrency Wallets
Security firm Coinspect has disclosed a critical crypto wallet flaw called Ill Bloom that exploits weak pseudorandom number generation in wallet seed...
- News
Ransomware Negotiator Gets 70 Months in Prison for Aiding BlackCat Attacks
A 41-year-old former cybersecurity professional has been sentenced to 70 months in federal prison for conspiring with the now-defunct BlackCat ransomware...
- News
Hackers Weaponize Balochistan Police Portal in Multi-Group Espionage Campaigns
SentinelOne researchers have uncovered two years of sustained cyberespionage against Pakistani law enforcement — with China-nexus and India-nexus threat...
- News
China-Linked UAT-7810 Expands ORB Network With New LONGLEASH Malware
Cisco Talos researchers have identified new LONGLEASH malware deployed by Chinese APT group UAT-7810 to expand its Operational Relay Box network,...
- News
SCMBANKER Malware Uses ClickFix Lures to Target Mexican Banking Users
A new banking fraud campaign tracked as REF6045 is deploying SCMBANKER malware through fake CAPTCHA ClickFix lures to steal credentials from customers of...
- News
North Korea-Linked npm Packages Mimic Rollup Polyfills to Steal Developer Secrets
JFrog researchers attribute a fresh npm supply chain campaign to North Korea's Lazarus Group. Malicious packages impersonating Rollup polyfill tooling...
- News
North Korean Hackers Publish 108 Malicious Packages in PolinRider Campaign
Threat actors linked to North Korea's Contagious Interview campaign have published 108 malicious packages and browser extensions across npm, Packagist,...
- News
U.S. Government Entity Paid Kairos $1 Million in Data-Theft Extortion Case
A leaked negotiation chat and blockchain analysis reveal that a U.S. government entity paid approximately $1 million to the Kairos extortion group to...
- News
Oracle E-Business Suite Flaw CVE-2026-46817 Actively Exploited in the Wild
A critical CVSS 9.8 authentication bypass vulnerability in Oracle E-Business Suite's Payments module is being actively exploited in the wild, according to...
- News
236,000 DCloud Uni-App Sites Powering Crypto Scams and Wallet Drainers
Infoblox researchers have uncovered over 236,000 websites built on the legitimate DCloud Uni-App framework being weaponized for investment scams,...
- News
Gamaredon Expands Ukraine Attacks with New Malware and Cloud Abuse
Russian FSB-linked APT group Gamaredon has mounted 35 distinct spear-phishing campaigns against Ukrainian targets in 2025, deploying an expanded malware...
- News
Weekly Recap: Browser Bugs, EDR Killers, TV Botnet, OpenBSD Flaw, Android Trojan, and More
This week's threat roundup covers the Usbliter8 iPhone boot exploit, NarwhalRAT spread via fake Microsoft alerts, The Gentlemen ransomware's GentleKiller...
- News
Unpatchable 'usbliter8' Exploit Breaks Apple A12 and A13 SecureROM Boot Chain
Security researchers at Paradigm Shift have published a working exploit called usbliter8 that achieves arbitrary code execution inside the SecureROM of...
- News
AutoJack Attack Lets One Web Page Hijack AI Agent for Host Code Execution
Microsoft researchers have detailed AutoJack, a novel exploit chain that turns AI browsing agents into delivery vehicles for remote code execution by...
- News
Operation Endgame Disrupts SocGholish Servers, Cleans 14,971 WordPress Sites
A joint law enforcement operation led by Dutch authorities and including partners from Canada, Germany, and the US has disrupted SocGholish malware...
- News
The Gentlemen RaaS Uses GentleKiller EDR Framework Targeting 400 Security Processes
The Gentlemen ransomware-as-a-service operation distributes a sophisticated EDR-killing toolkit called GentleKiller to affiliates, capable of terminating...
- News
The Top 10 Attack Surface Exposures in 2026
A comprehensive breakdown of the most dangerous attack surface exposures organizations face in 2026 — from exposed admin panels and credential reuse to...
- News
Veeam Backup and Replication RCE Flaw Lets Domain Users Run Remote Code
A critical CVE-2026-44963 flaw in Veeam Backup and Replication lets low-privilege domain users achieve remote code execution on backup servers. CVSS 9.4 —...
- News
AI Agent Uncovers 21 Zero-Days in FFmpeg; Chrome Patches Record 429 Bugs
An autonomous AI security agent found 21 previously unknown vulnerabilities in FFmpeg, the media library powering countless applications. The same week…
- News
Cisco Catalyst SD-WAN Manager CVE-2026-20245 Flaw Actively Exploited – No Patch Available
Cisco has disclosed active exploitation of CVE-2026-20245, a high-severity vulnerability in Catalyst SD-WAN Manager with a CVSS score of 7.8. No patch is…
- News
Miasma Worm Hits 73 Microsoft GitHub Repositories in Major Supply Chain Attack
Microsoft's GitHub presence has become the latest target of the self-replicating Miasma supply chain worm, with 73 repositories across Azure, Azure-Samples…
- News
Pakistan-Linked SideCopy APT Targets Afghanistan Finance Ministry with Xeno RAT
Researchers have uncovered a spear-phishing campaign by the Pakistan-aligned SideCopy APT group targeting Afghanistan's Ministry of Finance with the…
- News
China-Aligned Groups Ramp Up Attacks: Operation Dragon Weave Hits Czech Republic and Taiwan
Security researchers at Seqrite Labs have uncovered Operation Dragon Weave, a new China-aligned cyber espionage campaign targeting government, research…
- News
OpenAI Codex Authentication Tokens Stolen via codexui-android npm Supply Chain Attack
Cybersecurity researchers have uncovered a malicious npm package named codexui-android that targets developers using OpenAI Codex by masquerading as a…
- News
Critical Gogs RCE Vulnerability Lets Any Authenticated User Execute Arbitrary Code
Rapid7 discloses a critical CVSS 9.4 RCE in Gogs, the popular self-hosted Git service, letting any authenticated user run arbitrary code on the server.
- News
Microsoft Slams Public Zero-Day Disclosures Amid GitHub Researcher Account Removal
Microsoft condemns uncoordinated public zero-day disclosure, urging the security community to adopt CVD after removing a researcher's GitHub account.
- News
TrapDoor Supply Chain Attack Spreads Credential-Stealing
A coordinated cross-ecosystem supply chain attack campaign dubbed TrapDoor has compromised 34 packages across 384+ versions on npm, PyPI, and Crates.io.
- News
Weekly Recap: Linux Flaws, Defender 0-Days, Router Botnets
This week's security roundup covers Linux privilege escalation zero-days, actively exploited Windows Defender vulnerabilities, router botnets hijacking DNS.
- News
Claude Mythos AI Finds 10,000 High-Severity Flaws in Widely
Anthropic has disclosed that Project Glasswing — its AI-powered vulnerability research initiative using the Claude Mythos system — has uncovered more than...
- News
Laravel-Lang PHP Packages Compromised to Deliver
Multiple PHP packages belonging to the Laravel-Lang organization have been poisoned in a software supply chain attack, delivering a cross-platform...
- News
First VPN Dismantled in Global Takedown Over Use by 25
International authorities have disrupted a criminal VPN service called First VPN that was used by more than 25 ransomware groups to conceal network...
- News
Microsoft Warns of Two Actively Exploited Defender
Microsoft has disclosed two Windows Defender vulnerabilities under active exploitation in the wild, including CVE-2026-41091 — a privilege escalation flaw...
- News
ThreatsDay Bulletin: Linux Rootkits, Router 0-Day, AI
This week's threat intelligence bulletin covers Linux rootkit campaigns, an actively exploited router zero-day, AI-assisted intrusions, new scam kit...
- News
Mini Shai-Hulud Pushes Malicious AntV npm Packages via Compromised Maintainer Account
Cybersecurity researchers have discovered a fresh Mini Shai-Hulud supply chain attack compromising the @antv npm ecosystem through a hijacked maintainer...
- News
Popular GitHub Action Tags Redirected to Imposter Commit to Steal CI/CD Credentials
Threat actors have compromised the widely-used actions-cool/issues-helper GitHub Action, redirecting every existing tag to a malicious imposter commit...
- News
SEPPMail Secure E-Mail Gateway Vulnerabilities Enable RCE
Critical security vulnerabilities in SEPPMail Secure E-Mail Gateway — an enterprise email security appliance — could allow attackers to achieve remote...
- News
Trapdoor Android Ad Fraud Scheme Hit 659 Million Daily Bid
Researchers at HUMAN Security uncovered Trapdoor, a sophisticated Android ad fraud and malvertising operation that used 455 malicious apps and 183...
- News
Developer Workstations Are Now Part of the Software Supply
Supply chain attackers are no longer just targeting repositories and CI/CD pipelines — they're going after the developer workstations that hold the keys...
- News
Ivanti, Fortinet, SAP, VMware, n8n Patch RCE, SQL
A coordinated wave of critical security patches landed this week from Ivanti, Fortinet, SAP, VMware, and n8n. Topping the list is CVE-2026-8043 in Ivanti...
- News
Weekly Recap: Exchange 0-Day, npm Worm, Fake AI Repo, Cisco
This week's cybersecurity landscape opened with a critical Microsoft Exchange spoofing zero-day under active exploitation, a coordinated npm/PyPI supply...
- News
ThreatsDay Bulletin: PAN-OS RCE, Mythos cURL Bug, AI
This week's threat roundup covers an actively exploited PAN-OS RCE granting root access, Anthropic's Mythos AI finding a cURL memory safety bug, AI...
- News
Ivanti EPMM CVE-2026-6973 RCE Under Active Exploitation
Ivanti has disclosed a high-severity improper input validation vulnerability in Endpoint Manager Mobile (EPMM) that is being actively exploited in the...
- News
PAN-OS RCE Exploit Under Active Use Enabling Root Access
Palo Alto Networks has disclosed that CVE-2026-0300, a critical CVSS 9.3 buffer overflow in the PAN-OS User-ID Authentication service, is being actively...
- News
ThreatsDay Bulletin: Edge Plaintext Passwords, ICS 0-Days
This week's ThreatsDay threat roundup covers Microsoft Edge storing passwords in plaintext, industrial control system zero-days under active exploitation,...
- News
Fake Call History Apps Stole Payments From Users After 7.3
Cybersecurity researchers discovered 28 fraudulent Android apps on Google Play claiming to offer call history lookups, which instead enrolled users in...
- News
CISA Adds Actively Exploited Linux Root Access Bug
The U.S. Cybersecurity and Infrastructure Security Agency has added CVE-2026-31431, a Linux kernel privilege escalation flaw enabling root access, to its...
- News
CISA Adds Actively Exploited ConnectWise and Windows Flaws
CISA has added two actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog — CVE-2024-1708 affecting ConnectWise ScreenConnect...
- News
SAP-Related npm Packages Compromised in Credential-Stealing
Security researchers have uncovered a coordinated supply chain attack campaign dubbed 'mini Shai-H' targeting SAP-related npm packages, injecting...
- News
VECT 2.0 Ransomware Irreversibly Destroys Files Over 131KB
Threat hunters warn that VECT 2.0 ransomware contains a critical flaw in its encryption implementation that acts more like a wiper for files over 131KB...
- News
Fake CAPTCHA IRSF Scam and 120 Keitaro Campaigns Drive
Researchers at Infoblox and Confiant have uncovered a dual-threat fraud operation active since 2020: fake CAPTCHA pages secretly send up to 50...
- News
Bitwarden CLI Compromised in Ongoing Checkmarx Supply Chain
The popular Bitwarden CLI password manager package @bitwarden/cli@2026.4.0 was compromised as part of an ongoing Checkmarx supply chain campaign, with...
- News
China-Linked GopherWhisper Infects 12 Mongolian Government
A previously undocumented China-aligned APT group tracked as GopherWhisper has targeted Mongolian governmental institutions, deploying a wide array of...
- News
LMDeploy CVE-2026-33626 Flaw Exploited Within 13 Hours of Disclosure
A high-severity SSRF vulnerability in LMDeploy, a widely used open-source LLM deployment toolkit, was actively exploited in the wild less than 13 hours...
- News
ThreatsDay Bulletin: $290M DeFi Hack, macOS LotL Abuse
This week's ThreatsDay Bulletin covers the $290M KelpDAO DeFi hack tied to Lazarus Group, new macOS living-off-the-land attack techniques, ProxySmart SIM...
- News
FIRESTARTER Backdoor Hit Federal Cisco Firepower Device
CISA and the UK's NCSC have revealed that a US federal civilian agency's Cisco Firepower device running ASA software was compromised in September 2025...
- News
Anthropic MCP Design Vulnerability Enables RCE, Threatening
Cybersecurity researchers have discovered a critical by-design weakness in the Model Context Protocol architecture that enables arbitrary command...
- News
Researchers Detect ZionSiphon Malware Targeting Israeli
Cybersecurity researchers at Darktrace have identified ZionSiphon, a new malware specifically designed to target Israeli water treatment and desalination...
- News
SGLang CVE-2026-5760 (CVSS 9.8) Enables RCE via Malicious
A critical CVSS 9.8 command injection vulnerability in the SGLang AI inference framework allows attackers to achieve remote code execution by supplying a...
- News
Vercel Breach Tied to Context AI Hack Exposes Limited
Vercel's security breach originated from the compromise of Context.ai, a third-party AI tool used by a company employee, allowing attackers to gain...
- News
Weekly Recap: Vercel Hack, Push Fraud, QEMU Abused, New
This week's cybersecurity recap covers the Vercel supply chain breach via a compromised AI tool, push fraud campaigns, attackers abusing QEMU virtual...
- News
Mirai Variant Nexcorium Exploits CVE-2024-3721 to Hijack
Threat actors are deploying the Nexcorium Mirai botnet variant by exploiting CVE-2024-3721 in TBK DVR devices and targeting end-of-life TP-Link Wi-Fi...
- News
Adobe Reader Zero-Day Exploited via Malicious PDFs Since
Threat actors have been exploiting an unpatched zero-day in Adobe Reader since at least November 2025, using specially crafted PDFs to fingerprint victims...
- News
EngageLab SDK Flaw Exposed 50M Android Users, Including 30M
A now-patched security vulnerability in the widely used EngageLab Android SDK allowed apps on the same device to bypass the Android security sandbox and...
- News
ThreatsDay Bulletin: Hybrid P2P Botnet, 13-Year-Old Apache
This week's ThreatsDay Bulletin from The Hacker News covers 20 active threats including a hybrid P2P DDoS botnet, a 13-year-old Apache ActiveMQ RCE flaw...
- News
Anthropic's Claude Mythos Finds Thousands of Zero-Day Flaws
Anthropic's new Project Glasswing initiative uses a preview of its frontier model Claude Mythos to autonomously discover thousands of previously unknown...
- News
APT28 Deploys PRISMEX Malware in Campaign Targeting Ukraine
Russian state-sponsored threat actor APT28 (Forest Blizzard / Pawn Storm) has launched a targeted spear-phishing campaign deploying a newly documented...
- News
China-Linked Storm-1175 Chains Zero-Days for High-Velocity
A China-based threat cluster designated Storm-1175 has been linked to high-velocity ransomware attacks deploying Medusa payloads using chained zero-day...
- News
The Hidden Cost of Recurring Credential Incidents
IBM's 2025 Cost of a Data Breach Report puts the average breach at $4.4 million — but that headline figure understates the true damage when credential...
- News
BKA Identifies REvil Leaders Behind 130 German Ransomware
Germany's Federal Criminal Police Office has publicly unmasked the real identity of "UNKN," the primary operator behind the now-defunct REvil and GandCrab...
- News
How LiteLLM Turned Developer Machines Into Credential
The TeamPCP threat actor's March 2026 supply chain attack against LiteLLM exposed a dangerous blind spot: developer workstations running local AI agents...
- News
Weekly Recap: Axios Hack, Chrome 0-Day, Fortinet Exploits
This week's biggest cybersecurity stories: a North Korean supply chain attack hit the Axios npm package, a new Chrome zero-day under active exploitation,...
- News
$285 Million Drift Hack Traced to Six-Month DPRK Social
Drift has confirmed the April 1, 2026, theft of $285 million resulted from a meticulously planned six-month North Korean social engineering operation that...
- News
36 Malicious npm Packages Exploited Redis, PostgreSQL to Deploy Persistent Implants
Cybersecurity researchers discovered 36 malicious npm packages disguised as Strapi CMS plugins that abused Redis and PostgreSQL connections to harvest...
- News
Microsoft Details Cookie-Controlled PHP Web Shells
Microsoft Defender researchers have documented a stealthy PHP web shell technique that uses HTTP cookies as a covert command-and-control channel on Linux...
- News
UNC1069 Social Engineering of Axios Maintainer Led to npm
The North Korean threat actor UNC1069 used a sophisticated, targeted social engineering campaign against the Axios npm package maintainer Jason Saayman to...
- News
Hackers Exploit CVE-2025-55182 to Breach 766 Next.js Hosts
A large-scale credential harvesting campaign has been observed exploiting the React2Shell vulnerability (CVE-2025-55182) as an initial infection vector,...
- News
The State of Trusted Open Source Report: Key Findings for 2025
Chainguard's first-ever State of Trusted Open Source report reveals critical insights into open source consumption patterns across container images,...
- News
CERT-UA Impersonation Campaign Spread AGEWHEEZE Malware to 1 Million Emails
Ukraine's Computer Emergency Response Team (CERT-UA) has disclosed a large-scale phishing campaign in which threat actor UAC-0255 impersonated the agency...
- News
Claude Code Source Leaked via npm Packaging Error
Anthropic confirmed that internal source code for its Claude Code AI coding assistant was accidentally published to npm due to a human packaging error. No...
- News
New Chrome Zero-Day CVE-2026-5281 Under Active Exploitation
Google has released a Chrome security update patching 21 vulnerabilities including a high-severity use-after-free zero-day in the Dawn graphics engine...
- News
DeepLoad Malware Uses ClickFix and WMI Persistence to Steal
Researchers have identified DeepLoad, a previously undocumented malware loader that combines ClickFix social engineering with WMI-based persistence to...
- News
Bearlyfy Hits Russian Firms with Custom GenieLocker
Pro-Ukrainian hacktivist group Bearlyfy has conducted over 70 cyberattacks against Russian companies since January 2025, recently deploying a custom...
- News
CISA Adds CVE-2025-53521 to KEV After Active F5 BIG-IP APM
CISA has added CVE-2025-53521, a critical vulnerability in F5 BIG-IP Access Policy Manager, to its Known Exploited Vulnerabilities catalog after...
- News
Citrix NetScaler CVE-2026-3055 (CVSS 9.3) Under Active
Security researchers at Defused Cyber and watchTowr have detected active reconnaissance targeting CVE-2026-3055, a critical CVSS 9.3 memory overread flaw...
- News
Iran-Linked Hackers Breach FBI Director's Personal Email
Iran's Handala Hack Team breached the personal email of FBI Director Kash Patel, leaking photos and documents online, while simultaneously launching a...
- News
TA446 Deploys DarkSword iOS Exploit Kit in Targeted
Proofpoint has attributed a targeted email campaign to Russian state-sponsored threat actor TA446, which is leveraging the recently disclosed DarkSword...
- News
TeamPCP Pushes Malicious Telnyx Versions to PyPI, Hides
The TeamPCP threat actor — behind previous supply chain attacks on Trivy, KICS, and litellm — has now compromised the telnyx Python package on PyPI,...
- News
WebRTC Skimmer Bypasses CSP to Steal Payment Data from E-Commerce Sites
Cybersecurity researchers have uncovered a sophisticated new payment skimmer that weaponises WebRTC data channels to exfiltrate stolen credit card data...
- News
LeakBase Admin Arrested in Russia Over Massive Stolen
Russian law enforcement has arrested the alleged administrator of LeakBase — a credential marketplace operating since 2021 with 142,000 members and...
- News
Trivy Hack Spreads Infostealer via Docker, Triggers Worm
The Trivy supply chain attack has expanded dramatically beyond GitHub Actions: malicious Docker Hub images (versions 0.69.4–0.69.6) carry an infostealer,...
- News
Weekly Recap: CI/CD Backdoor, FBI Buys Location Data
This week's cybersecurity roundup covers supply chain attacks hitting CI/CD pipelines, long-running IoT botnets finally disrupted, the FBI's warrantless...
- News
Trivy Security Scanner GitHub Actions Breached — 75 Tags
Trivy, Aqua Security's widely used open-source vulnerability scanner, was compromised a second time in a month. Attackers hijacked 75 GitHub Actions tags...
- News
GlassWorm ForceMemo: Stolen GitHub Tokens Used to Poison
The GlassWorm threat actor has launched a new sub-campaign called ForceMemo, using stolen GitHub tokens to silently force-push malware into hundreds of...
- News
Weekly Recap: Chrome 0-Days, Router Botnets, AWS Breach
This week's cybersecurity roundup covers the actively exploited Chrome zero-day CVE-2026-2441, the Aisuru router botnet record DDoS attack, a supply chain...
- News
GlassWorm Escalates: 72 Malicious Open VSX Extensions Use
The GlassWorm self-propagating worm campaign has compromised 72 Open VSX extensions using invisible Unicode Private Use Area characters and a Solana...
- News
DKnife: China-Linked AitM Framework Hijacks Router Traffic
Cisco Talos uncovers a seven-component Linux framework called DKnife that compromises routers to intercept credentials, replace downloads with trojans,...