notice: please create a custom view template for the cybersec class view-cybersec.html
Gheist Uses Stolen GitHub Tokens to Steal Private Repository Secrets via Actions Logs
An automated campaign is using stolen GitHub tokens to plant workflows that print a repository's secrets into its GitHub Actions logs, which the attackers then download before deleting the runs. The attacks have succeeded in private repositories and GitHub Enterprise environments, according to an analysis by cloud security company Wiz.
A GitHub safeguard that pauses
10:10 am, October 26, 2026
guid
https://thehackernews.com/2026/10/gheist-uses-stolen-github-tokens-to.html
source_url
https://thehackernews.com/2026/10/gheist-uses-stolen-github-tokens-to.html
id: 3795
uid: 2qD6o
insdate: 2026-10-26 10:10:17
title: Gheist Uses Stolen GitHub Tokens to Steal Private Repository Secrets via Actions Logs
additional: An automated campaign is using stolen GitHub tokens to plant workflows that print a repository's secrets into its GitHub Actions logs, which the attackers then download before deleting the runs. The attacks have succeeded in private repositories and GitHub Enterprise environments, according to an analysis by cloud security company Wiz.
A GitHub safeguard that pauses
category: Cybersecurity
md5:
guid: https://thehackernews.com/2026/10/gheist-uses-stolen-github-tokens-to.html
source_url: https://thehackernews.com/2026/10/gheist-uses-stolen-github-tokens-to.html
updated:
image:
author_name:
author_link:
uid: 2qD6o
insdate: 2026-10-26 10:10:17
title: Gheist Uses Stolen GitHub Tokens to Steal Private Repository Secrets via Actions Logs
additional: An automated campaign is using stolen GitHub tokens to plant workflows that print a repository's secrets into its GitHub Actions logs, which the attackers then download before deleting the runs. The attacks have succeeded in private repositories and GitHub Enterprise environments, according to an analysis by cloud security company Wiz.
A GitHub safeguard that pauses
category: Cybersecurity
md5:
guid: https://thehackernews.com/2026/10/gheist-uses-stolen-github-tokens-to.html
source_url: https://thehackernews.com/2026/10/gheist-uses-stolen-github-tokens-to.html
updated:
image:
author_name:
author_link:
Add Comment
AI Testing
Page Views
This page has been viewed 2 times.
Search cybersec
Category List cybersec
- Cybersecurity
- "City-Forum" data-theft attacks target Salesforce, ServiceNow portals
- "Comment stuffing" in an HTML phishing attachment as a mechanism for evading AI-based detection?, (Fri, Jul 10th)
- $13.74M Hack Shuts Down Sanctioned Grinex Exchange After Intelligence Claims
- $285 Million Drift Hack Traced to Six-Month DPRK Social Engineering Operation
- [GUEST DIARY] Tearing apart website fraud to see how it works., (Wed, May 13th)
- [Guest Diary] New Malware Libraries means New Signatures, (Fri, May 15th)
- [Guest Diary] Beyond Cryptojacking: Telegram tdata as a Credential Harvesting Vector, Lessons from a Honeypot Incident, (Wed, Apr 22nd)
- [Guest Diary] Compromised DVRs and Finding Them in the Wild, (Thu, Apr 16th)
- _HELP_ME_ESCAPE_FROM_BELARUS_PLEASE_ [Guest Diary], (Tue, Jul 7th)
- 'Ghostcommit' hides prompt injection in images to fool AI agents, steal secrets
- 'NoVoice' Android malware on Google Play infected 2.3 million devices
- (Reliable)? php2shell exploitability, (Fri, Oct 23rd)
- /proxy/ URL scans with IP addresses, (Mon, Mar 16th)
- 100+ Compromised Websites Use Fake Cloudflare Checks to Deliver LunexStealer
- 101 Malicious npm Packages Add Developers' WhatsApp Accounts to Groups Without Consent
- 108 Malicious Chrome Extensions Steal Google and Telegram Data, Affecting 20,000 Users
- 11 Old Microsoft-Signed Linux UEFI Shims Could Let Attackers Bypass Secure Boot
- 13 Malicious Packagist Packages Target Unpatched iPhones to Steal Crypto Wallet Seeds
- 13-year-old bug in ActiveMQ lets hackers remotely execute commands
- 14 Trojanized npm Packages Drop RedC2 4.0 Linux Backdoor With AI-Assisted C2
- 144 Mastra npm Packages Compromised via Hijacked Contributor Account
- 148 npm Packages Disguised as Student Proxies Turned Browsers Into a DDoS Botnet
- 149 Hacktivist DDoS Attacks Hit 110 Organizations in 16 Countries After Middle East Conflict
- 15-Year-Old GhostLock Flaw Enables Root and Container Escape on Most Linux Distros
- 15-year-old detained over French govt agency data breach
- 152 Chrome Wallpaper Extensions with 105K Installs Linked to Adware and Fake Traffic
- 16 Malicious Firefox Extensions Pose as Rabby and OKX Wallets to Steal Recovery Phrases
- 16 Typosquatted RubyGems Packages Steal Browser Credentials and Crypto Wallets
- 16-Year-Old Linux KVM Flaw Lets Guest VMs Escape to Host on Intel and AMD x86 Systems
- 17,000 URLs Reveal How ClickFix Turns Trusted Websites Into Malware Traps: Report by CTM360
- 18 Malicious npm Packages Deliver Cross-Platform RAT to Alibaba Tool Users
- 18-Year-Old Linux SCTP Flaw Could Let Local Users Gain Root and Escape Containers
- 18-Year-Old NGINX Rewrite Module Flaw Enables Unauthenticated RCE
- 18-year-old NGINX vulnerability allows DoS, potential RCE
- 19 Chrome and Edge Extensions Found With Wallet-Stealing and Crypto-Draining Code
- 19-Year-Old Scattered Spider Suspect Extradited to Face U.S. Hacking Charges
- 20+ Hijacked Government Websites Became an Attack Channel
- 2026 Browser Data Reveals Major Enterprise Security Blind Spots
- 2026 Cybersecurity Assessment: The Gap Between Awareness and Resilience
- 2026: The Year of AI-Assisted Attacks
- 22 BRIDGE:BREAK Flaws Expose 20,000 Lantronix and Silex Serial-to-IP Converters
- 22 BRIDGE:BREAK Flaws Expose Thousands of Lantronix and Silex Serial-to-IP Converters
- 22 Seconds to Compromise: How Automated SSH Actors Move From Login to Persistence Before You Can Blink [Guest Diary], (Thu, Aug 6th)
- 220 million traveler records exposed in Vietnam-linked APIS leak
- 236,000 DCloud Uni-App Sites Used in Crypto Scams, Phishing, and Wallet Drainers
- 23andMe to pay $18 million in new genetics data breach settlement
- 24 npm Packages Abuse unpkg Mirrors to Host Fake Cloudflare CAPTCHA Pages
- 24,650 Internet-Exposed BMCs Disclose IPMI Password Hashes Before Login
- 26 FakeWallet Apps Found on Apple App Store Targeting Crypto Seed Phrases
- 282 iOS AI Apps Leak API Keys and Open AI Proxy Access in Network Traffic Study
- 29-Year-Old Squid Proxy Bug 'Squidbleed' Can Leak Cleartext HTTP Requests
- 3 Reasons Attackers Are Using Your Trusted Tools Against You (And Why You Don’t See It Coming)
- 3 SOC Process Fixes That Unlock Tier 1 Productivity
- 3 SOC Steps that Shut Down Incident Risks Early
- 3 Ways AI Powers Service Desk Attacks and How to Prevent Them
- 30,000 Facebook Accounts Hacked via Google AppSheet Phishing Campaign
- 36 Malicious npm Packages Exploited Redis, PostgreSQL to Deploy Persistent Implants
- 39 New Methods That Compromise Passkey Authentication
- 3BB Attacker Used MeshCentral Backdoor for Root Access, Targeted Subscriber Credentials
- 40 Malicious Firefox Extensions Pose as Web3 Products to Steal Wallet Secrets
- 400+ Arch Linux AUR Packages Hijacked to Install Rust Credential Stealer
- 5 Learnings from the First-Ever Gartner Market Guide for Guardian Agents
- 5 Places where Mature SOCs Keep MTTR Fast and Others Waste Time
- 5 Steps to Managing Shadow AI Tools Without Slowing Down Employees
- 5 Ways Zero Trust Maximizes Identity Security
- 5 reasons Microsoft 365 backup isn’t enough for business data protection
- 54 EDR Killers Use BYOVD to Exploit 34 Signed Vulnerable Drivers and Disable Security
- 54 EDR Killers Use BYOVD to Exploit 35 Signed Vulnerable Drivers and Disable Security
- 545 Hackers Tested It First. Now XRanges for AI Scores Your Security Agent
- 6 Reasons Why Device Code Phishing is the Fastest-Growing Threat of 2026
- 68-year-old imprisoned after making $1.3 million by pirating IPTV services
- 7 Ways to Prevent Privilege Escalation via Password Resets
- 7-Eleven confirms data breach claimed by the ShinyHunters gang
- 7-Eleven data breach exposes personal information of 185,000 people
- 73 Seconds to Breach, 24 Hours to Patch: The Case for Autonomous Validation
- 73% of Organizations Say They Are Not Fully Ready for a Major Cyberattack
- 737 Chrome VPN Extensions Caught Routing Traffic Through Proxies. Check If You Have One
- 77 Open VSX extensions found harvesting developer info
- 80,000+ Organizations Had AI Logins Stolen: From Shadow AI to LLMjacking
- 9 Critical IP KVM Flaws Enable Unauthenticated Root Access Across Four Vendors
- 9-Year-Old Linux Kernel Flaw Enables Root Command Execution on Major Distros
- A .WAV With A Payload, (Tue, Apr 21st)
- A Closer Look at Malware From the Macfinger ClickFix Campaign, (Fri, Sep 25th)
- A Glimpse into the “Search Your Target” Market for Stolen Credentials
- A Leaked GitLab Issue Email Address Lets Anyone Push Code and Run CI Jobs as You
- A Little Bit Pivoting: What Web Shells are Attackers Looking for?, (Tue, Apr 7th)
- A Malicious SIM Card Can Run Attacker Code Inside the Modems Behind Cellular IoT Devices
- A Malicious Webpage Could Poison Your Local AI Model Behind NVIDIA NemoClaw
- A React-based phishing page with credential exfiltration via EmailJS, (Fri, Mar 13th)
- A Record-Breaking Patch Tuesday for June 2026
- A polymorphic phishing page (that occasionally breaks itself), (Thu, Aug 27th)
- ACR Stealer Uses ClickFix Lures to Steal Browser Tokens and Microsoft 365 Files
- ADT confirms data breach after ShinyHunters leak threat
- AI "Mind Viruses" Can Spread Between Agents Through Persistent Prompt Files
- AI 'watermark removers' flood the web. Almost none can prove they work.
- AI Agent Exploits Langflow RCE to Automate Database Ransomware Attack
- AI Agent Uncovers 21 Zero-Days in FFmpeg; Chrome Patches Record 429 Bugs
- AI Agents Are Rewriting the Rules of Lateral Movement
- AI Agents Broke the Security Playbook. Here's What Replaces It.
- AI Agents: The Next Wave Identity Dark Matter - Powerful, Invisible, and Unmanaged
- AI Attacks Move in Minutes. Join This Webinar on Building a Defense That Keeps Up
- AI Broke Vulnerability Management. That's Why CISOs Are Moving Budget to BAS.
- AI Can Find Bugs, But Human Knowledge Still Proves Them
- AI Changed the Exposure Problem. Validation Needs to Change With It.
- AI Chatbot Recommendations Redirect Users to Cryptojacking Malware Sites
- AI Coding Agents Exposed 13,000 Internal Images, Including Billing Records, on GitHub
- AI Coding Agents Found Triggering Endpoint Security Rules Built to Catch Attackers
- AI Decision Models and Their Impact on AI SOC Platforms
- AI Flaws in Amazon Bedrock, LangSmith, and SGLang Enable Data Exfiltration and RCE
- AI Is Accelerating Vulnerability Discovery. Can Defenders Keep Up?
- AI Phishing Is Crushing SOCs with Alert Volume: How to Reduce Tier 1 Overload
- AI Recommendation Poisoning: How "Ask AI" Buttons Silently Alter LLM Memory
- AI coding agents hijacked using AGENTS.md file in Downloads folder
- AI is Everywhere, But CISOs are Still Securing It with Yesterday's Skills and Tools, Study Finds
- AI's Third Wave: Coworkers Break the Security Model That Worked for Agents
- AI-Assisted HTTP Terminator Finds Novel HTTP Desync Techniques and Apache Zero-Day
- AI-Driven Exploitation is Destroying Vulnerability Management. Here’s How to Handle It.
- AI-Driven Pushpaganda Scam Exploits Google Discover to Spread Scareware and Ad Fraud
- AI-Found Linux Kernel Flaw Gives Local Users Root, and Can Break a Guest Out to the Host
- AI-Generated Browser Ransomware Abuses Chromium API on Windows and Android
- AI-Generated Exploit Scripts Target Siemens S7 PLCs in U.S. Critical Infrastructure
- AI-Generated Fake Login Pages Are Making Account Takeovers Easier
- AI-built ransomware toolkit automates EDR evasion, AD discovery
- AI-generated Slopoly malware used in Interlock ransomware attack
- AI-powered attack exploited PaperCut flaws to hack 395 organizations
- APT28 Deploys PRISMEX Malware in Campaign Targeting Ukraine and NATO Allies
- APT28 Uses BEARDSHELL and COVENANT Malware to Spy on Ukrainian Military
- APT28 hackers deploy customized variant of Covenant open-source tool
- APT28-Linked Campaign Deploys BadPaw Loader and MeowMeow Backdoor in Ukraine
- APT28-Linked HOOKEDGE Backdoor Targets European Government and Diplomatic Organizations
- APT41-Linked Silver Dragon Targets Governments Using Cobalt Strike and Google Drive C2
- ARTEX AI Pentesting Tool Used in Data Theft Attacks on South Korean Financial Firms
- ARTEX AI, Claude agents used in cyberattacks on South Korean banks
- ARToken PhaaS exposes EvilTokens' Microsoft 365 phishing toolkit
- ASOS confirms data breach after “HACKED” in-app notifications
- ASOS links data breach to social engineering attack, credential theft
- ATF confirms “major incident” after recent Qilin breach claims
- AWS Kiro Flaw Let a Poisoned Web Page Rewrite Its Config and Run Code
- AWS, Google, and Vercel Agent Flaws Let Attackers Trigger Tools Without Running the Model
- Abandoned Popcorn Time app exposed millions of device to RCE attacks
- Abandoned Popcorn Time app exposed millions of devices to RCE attacks
- Abbott Laboratories probes two cyber incidents amid extortion claims
- Abbott probes two cyber incidents amid extortion claims
- Accenture confirms breach after hacker offers stolen data for sale
- Acer working to patch max severity zero-days in Wave 7 routers
- Acronis cPanel Backup Plugin Vulnerability Exploited in Targeted Attacks
- Acronis warns of actively exploited flaw in its cPanel backup plugin
- Active Exploitation Attempts Target WSO2 API Manager JWT Bypass With Forged Admin Tokens
- Actively Exploited Oracle WebLogic Flaw Lets Unauthenticated Attackers Access Critical Data
- Actively Exploited nginx-ui Flaw (CVE-2026-33032) Enables Full Nginx Server Takeover
- Actively exploited Apache ActiveMQ flaw impacts 6,400 servers
- AdaptHealth confirms 4.1 million people exposed in July cyberattack
- Adding some Automation to the favicon.ico method of Host Recon, (Mon, Jun 29th)
- Adobe Acrobat Extension Flaw Let Malicious Sites Read WhatsApp Web Data
- Adobe Campaign Classic CVSS 10.0 Flaw Could Run Code Without User Interaction
- Adobe Chrome extension flaw let sites access private WhatsApp chats
- Adobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic Emerges
- Adobe Fixes 8 Critical Campaign Classic Flaws Allowing Code Execution and Security Bypass
- Adobe Patches 7 CVSS 10.0 Flaws in ColdFusion and Campaign Classic
- Adobe Patches Actively Exploited Acrobat Reader Flaw CVE-2026-34621
- Adobe Patches Magento Zero-Day Exploited to Deploy Rust Backdoor and PHP Web Shell
- Adobe Patches Three CVSS 10.0 ColdFusion and Campaign Classic Flaws
- Adobe Reader Zero-Day Exploited via Malicious PDFs Since December 2025
- Adobe fixes critical Magento zero-day exploited to backdoor servers
- Adobe patches seven max severity ColdFusion, Campaign flaws
- Adobe rolls out emergency fix for Acrobat, Reader zero-day flaw
- Advantest confirms personal information stolen in ransomware attack
- Adversarial Exposure Validation Turns Security Visibility into Confident Prioritization
- Adversaries Exploit Vacant Homes to Intercept Mail in Hybrid Cybercrime
- Aesto Health says data breach affects over 9.5 million patients
- After Mythos: New Playbooks For a Zero-Window Era
- After the Break-In: What Attackers Do Once They're Already Inside
- Agent AI is Coming. Are You Ready?
- Agentic AI Has an Identity Problem and Attackers Know It
- Agentic AI Is Transforming Defense, But Only Secure IT Infrastructure Will Maximize It
- Agentic AI: The Weapon That No Longer Needs a Warrior
- Agentic GRC: Teams Get the Tech. The Mindset Shift Is What's Missing.
- Agentjacking Attack Tricks AI Coding Agents Into Running Malicious Code
- Ahold Delhaize: Cyberattack affects services across US and Europe
- AhsayCBS Flaws Exploited to Deploy Web Shells Get New Fixes After Incomplete Patches
- AirDrop and Quick Share Flaws Let Nearby Attackers Trigger Crashes and Bypass Checks
- AitM Phishing Targets TikTok Business Accounts Using Cloudflare Turnstile Evasion
- Ajax football club hack exposed fan data, enabled ticket hijack
- Akira hackers disable EDR with Safe Mode, steal data but fail to encrypt
- Alabama man pleads guilty to hacking, extorting hundreds of women
- Alby Hub Critical Flaw Could Let Attackers Take Over Internet-Exposed Bitcoin Wallets
- Alleged Kimwolf Botmaster ‘Dort’ Arrested, Charged in U.S. and Canada
- Alleged Scattered Spider hacker extradited to the United States
- Alleged Silk Typhoon hacker extradited to US for cyberespionage
- Alleged TeamPCP Hackers Charged in Australia Over Major Supply Chain Attacks
- Alleged dev of Ploutus ATM malware appears in US court after arrest
- Amadey and StealC Malware Network Disrupted, 27M Stolen Credentials Recovered
- Amadey, StealC malware operations disrupted in Operation Endgame action
- Amazon Kiro Prompt Injection Can Exfiltrate Sensitive Data Through Kiro Powers
- Amazon Links Debug and Chalk npm Hijack to North Korea’s Sapphire Sleet
- Amazon Q Developer Flaw Could Let Malicious Repos Run Code via MCP Configs
- Amazon SES increasingly abused in phishing to evade detection
- Amazon fined $2.25M for withholding evidence from fraud victims
- Amazon links Debug, Chalk NPM supply-chain attacks to North Korean hackers
- Amazon says PHP2Shell exploitation began 4 days before patches
- Amazon: Drone strikes damaged AWS data centers in Middle East
- American Organizations Under Attack: Skyw4lker Device Code Phishing Campaign Exposed
- American utility firm Itron discloses breach of internal IT network
- Americans sentenced for running 'laptop farms' for North Korea
- Amgen says cloud data breach exposed patient health, proprietary info
- An AI Agent Found a Critical OTP Bypass in Production. The Attack Was the Easy Part.
- An AI SOC Evaluation Guide for Security Leaders
- An Abandoned CDN Domain Was Re-Registered. Thousands of Sites Still Call It.
- An Adaptive Cyber Analytics UI for Web Honeypot Logs [Guest Diary], (Wed, May 6th)
- An Example of Stack String in High Level Language, (Sat, May 23rd)
- Analog Devices discloses data breach, says operations unaffected
- Analysis of 216M Security Findings Shows a 4x Increase In Critical Risk (2026 Report)
- Analysis of a Year of Files Uploaded to DShield Sensors, (Wed, May 27th)
- Analysis of one billion CISA KEV remediation records exposes limits of human-scale security
- Analyzing "Zombie Zip" Files (CVE-2026-0866), (Wed, Mar 11th)
- Android 17 Adds OS-Wide ECH to Hide Website Visits From Network Providers
- Android 17 Advanced Protection Locks Accessibility Services to Verified Accessibility Tools
- Android 17 Blocks Non-Accessibility Apps from Accessibility API to Prevent Malware Abuse
- Android 17 adds ECH support to make web browsing harder to track
- Android 17 to expand banking scam call and privacy protections
- Android Adds Intrusion Logging for Sophisticated Spyware Forensics
- Android Car Malware Spreads Through Built-In Updaters for Ad Fraud, Proxy Botnet
- Android Developer Verification Rollout Begins Ahead of September Enforcement
- Android Spyware Asin Targets Arabic Users via Fake News, PDF and War Map Apps
- Android gets AI defenses against messaging scams, fake calls
- Android gets patches for Qualcomm zero-day exploited in attacks
- Android malware combo takes out loans and relays victims' credit cards
- AnonyMousKIT PhaaS uses voice AI agents to phish iPhone passcodes
- Another Universal Linux Local Privilege Escalation (LPE) Vulnerability: Dirty Frag, (Fri, May 8th)
- Anthropic Cuts Live Internet Access for Internal AI Tests After Claude Exploits Injection Flaws
- Anthropic Discloses Fourth AI Hacking Incident Involving Claude Opus 4.6
- Anthropic Expands Claude Access for Vetted Cyber Teams as Glasswing Finds 129,000 Flaws
- Anthropic Finds 22 Firefox Vulnerabilities Using Claude Opus 4.6 AI Model
- Anthropic Launches Free AI Vulnerability Scanner for Open-Source Projects
- Anthropic MCP Design Vulnerability Enables RCE, Threatening AI Supply Chain
- Anthropic Releases Claude Fable 5, Its Most Powerful AI Yet, With Cyber Safeguards
- Anthropic Restores Claude Fable 5 After U.S. Lifts Jailbreak-Linked Export Controls
- Anthropic Says Claude Mistook the Open Internet for a CTF and Breached Three Organizations
- Anthropic Says Seven China-Based AI Labs Ran Industrial-Scale Claude Distillation Attacks
- Anthropic Warns Small AI Models Could Soon Form Self-Propagating IoT Botnets
- Anthropic and OpenAI Models Still Attempt Restricted Actions in Safety Tests
- Anthropic asks Claude users to share voice data for AI model training
- Anthropic confirms Claude Mythos-class models will roll out to the public
- Anthropic confirms Claude is down in major outage affecting multiple services
- Anthropic confirms Claude is down worldwide
- Anthropic confirms Claude is down, multiple models affected
- Anthropic is cutting Claude Code's current weekly limits by 17%
- Anthropic is testing desktop-like Claude Cowork for mobile
- Anthropic rolls out Claude Fable 5, but it's available for a limited time
- Anthropic rolls out Sonnet 5 with near-Opus 4.8 performance at a lower price
- Anthropic rolls out up to $250 in free Claude Code credits, but only for cloud sessions
- Anthropic takes risky AI tests offline after models breach govt sites
- Anthropic to restore Claude Fable access on Wednesday
- Anthropic turns Claude into an AI marketplace with 2,000+ plugins and connectors
- Anthropic wants Claude to analyze your bank account and financial data
- Anthropic warns infostealer malware is hijacking Claude sessions to drain usage
- Anthropic warns self-replicating AI could spread to your smart devices
- Anthropic's Claude Mythos Finds Thousands of Zero-Day Flaws Across Major Systems
- Anthropic's Claude breached 3 orgs, uploaded PyPI malware during tests
- Anthropic's Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits
- Anthropic’s restricted Claude Mythos model may be coming to Claude Code
- Anti-DDoS Firm Heaped Attacks on Brazilian ISPs
- Anti-piracy coalition takes down AnimePlay app with 5 million users
- Antino Backdoor Uses Outlook and OneDrive for C2 in China-Nexus Espionage Campaign
- Anubis ransomware claims Coca-Cola Fairlife attack, threatens data leak
- Apache ActiveMQ CVE-2026-34197 Added to CISA KEV Amid Active Exploitation
- Apple Backports Fix for Exploited CoreGraphics Flaw to Older iPhones and iPads
- Apple CoreGraphics PoC Emerges as WhatsApp PDF Checks Hint at Possible Delivery Path
- Apple Emergency Patch for iOS 26, macOS26, macOS15 (CVE-2026-86950), (Mon, Sep 28th)
- Apple Emergency Patch for iOS 26/macOS26/macOS15 (CVE-2026-86950), (Mon, Sep 28th)
- Apple Expands iOS 18.7.7 Update to More Devices to Block DarkSword Exploit
- Apple Fixes Hide My Email Bug That Exposed Real Addresses in Mail Logs
- Apple Fixes WebKit Vulnerability Enabling Same-Origin Policy Bypass on iOS and macOS
- Apple Fixes iOS Flaw That Let FBI Recover Deleted Signal Messages
- Apple Issues Security Updates for Older iOS Devices Targeted by Coruna WebKit Exploit
- Apple Patches (almost) everything again. March 2026 edition., (Wed, Mar 25th)
- Apple Patches 30+ iOS, macOS, Safari Flaws, Including AI-Discovered WebKit Bugs
- Apple Patches Beats Studio Buds Flaw Letting Nearby Attackers Spy via Microphone
- Apple Patches CoreGraphics Flaw Possibly Exploited in Targeted Attacks
- Apple Patches Everything (July 2026), (Wed, Jul 29th)
- Apple Patches Everything, (Mon, May 11th)
- Apple Patches Exploited Notification Flaw, (Thu, Apr 23rd)
- Apple Patches for October 2026, (Mon, Oct 26th)
- Apple Patches iOS Flaw That Stored Deleted Signal Notifications in FBI Forensic Case
- Apple Patches iOS and macOS, (Mon, Aug 17th)
- Apple Plans Tighter macOS Full Disk Access Controls Over AI Agent Data Access
- Apple Screen Sharing Security, (Mon, Aug 17th)
- Apple Sends Lock Screen Alerts to Outdated iPhones Over Active Web-Based Exploits
- Apple Updates Everything, (Mon, Sep 14th)
- Apple Warns Older iPhones Vulnerable to Coruna, DarkSword Exploit Kit Attacks
- Apple account change alerts abused to send phishing emails
- Apple adds macOS Terminal warning to block ClickFix attacks
- Apple backports CoreGraphics zero-day patches to older iPhones
- Apple blocked over $11 billion in App Store fraud in 6 years
- Apple expands iOS 18 updates to more iPhones to block DarkSword attacks
- Apple fixes Beats Studio Buds flaw that let hackers spy on conversations
- Apple fixes bug that let the FBI recover deleted Signal messages
- Apple fixes iOS bug that retained deleted notification data
- Apple iCloud Private Relay Can Expose Real IPs Through WebKit Proxy Bypasses
- Apple patches CoreGraphics zero-day flaw exploited in attacks
- Apple patches older iPhones and iPads against Coruna exploits
- Apple pushes first Background Security Improvements update to fix WebKit flaw
- Apple sends new ‘Threat Notification’ alerts over mercenary spyware attacks
- Apple sued over fake App Store crypto wallet app stealing $1.8M in Bitcoin
- Application Control Bypass for Data Exfiltration, (Tue, Mar 31st)
- AppsFlyer Web SDK hijacked to spread crypto-stealing JavaScript code
- April KB5083769 Windows 11 update causes backup software failures
- April Patch Tuesday Fixes Critical Flaws Across SAP, Adobe, Microsoft, Fortinet, and More
- Arch Linux disables AUR package adoption to stop malware flood
- Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks
- Arista patches VeloCloud Orchestrator zero-day exploited in attacks
- Arista patches actively exploited VeloCloud Orchestrator zero-day
- Arista patches new VeloCloud Orchestrator zero-day exploited in attacks
- Armenia Detains Russian Tourist on U.S. Warrant for REvil Hacker, Lawyers Say Wrong Man
- Armored Likho Targets Government Agencies, Power Sector with BusySnake Stealer
- Artifactory flaws chained in attacks deploying backdoor malware
- AryStinger Malware Infects 4,300 Legacy Routers to Build Reconnaissance Proxy Network
- AryStinger botnet infected thousands of D-Link routers worldwide
- AssuranceAmerica data breach exposes records of 6.9 million drivers
- AsyncAPI npm packages infected with credential-stealing malware
- Atlassian Data Center Flaw Draws Exploitation Attempts Within Two Hours of Public Details
- Atlassian Rovo Can Be Tricked Into Sending Jira and Confluence Data to Attackers
- Atlassian warns of critical file-access flaw in Jira, Confluence
- Atomic MacOS (AMOS) stealer infection, (Sun, Aug 2nd)
- Attack Chains, Not Just Attack Surfaces: Why Testing Individual Techniques Misses the Point
- Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access, Only Two Patched So Far
- Attacker Hijacks AI Coding Assistant Session, Spreads Shai-Hulud Across About 100 Repositories
- Attacker Uses Suspected AI-Generated PowerShell Script to Map Active Directory
- Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix Lures
- Attackers Abuse MSP360 to Deploy ScreenConnect in Dual-RMM Phishing Attacks
- Attackers Abuse UpdraftCentral Keys to Plant Backdoors on WordPress Sites
- Attackers Breached JetBrains Cadence via Unpatched TeamCity, Extracting AWS Credentials
- Attackers Bypass WAFs to Exploit Oracle PeopleSoft Flaw and Deploy Web Shells
- Attackers Chain JFrog Artifactory Flaws to Gain Admin Control and Plant Backdoors
- Attackers Chain Two PaperCut Flaws to Execute Code Without Authentication
- Attackers Compile khunt Inside Oracle to Turn SQL Injection Into Windows SYSTEM Access
- Attackers Don't Just Send Phishing Emails. They Weaponize Your SOC's Workload
- Attackers Exploit 'Ill Bloom' Vulnerability to Drain $3.1 Million From Cryptocurrency Wallets
- Attackers Exploit 'Ill Bloom' Vulnerability to Drain Over $5 Million From Cryptocurrency Wallets
- Attackers Exploit AhsayCBS Flaws to Deploy XMRig Miners Disguised as Microsoft Edge
- Attackers Exploit Arista VeloCloud Orchestrator Command Injection Flaw
- Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE
- Attackers Exploit Critical JFrog Artifactory Flaw to Mint Admin Tokens Days After Disclosure
- Attackers Exploit Critical Langflow and Rails Flaws in Credential-Probing and C2 Activity
- Attackers Exploit Critical Switchvox Flaw to Deploy Reverse Shells Without Credentials
- Attackers Exploit Issabel Framework Flaw Enabling Unauthenticated OS Command Execution
- Attackers Exploit MLflow SSRF Flaw to Steal Cloud Credentials and Secrets
- Attackers Exploit NetScaler Flaw for Root Access, Deploy WHIPSHOT and SLAPSHOT
- Attackers Exploit PaperCut Flaws to Steal Credentials From Schools and Universities
- Attackers Exploit SharePoint Authentication Bypass After Public PoC Release
- Attackers Exploit SimpleHelp CVE-2026-48558 to Deploy TaskWeaver and Djinn Stealer
- Attackers Exploit Three Fortinet FortiSandbox Flaws, One Patched Last Week
- Attackers Exploit Two SonicWall SMA 1000 Zero-Days That May Form an Attack Chain
- Attackers Exploit VMware vCenter Vulnerability to Gain Persistent Remote Access
- Attackers Exploit WooCommerce Wholesale Lead Capture Flaw to Plant PHP Web Shells
- Attackers Exploit WordPress CVE-2026-87902 Within Hours of Disclosure
- Attackers Exploit Zimbra Flaw to Deploy Web Shells and Harvest Authentication Secrets
- Attackers Exploit Zimbra SNMP Flaw for Unauthenticated Remote Code Execution
- Attackers Heat French Supermarket Fridges Up to 50°C by Hijacking Danfoss Controllers
- Attackers Hijack .gh, .sl, and .as Registries to Obtain Certificates for Google Domains
- Attackers Hijack Dahua IP Cameras in Ukraine Using P2P Access and Auth Weaknesses
- Attackers Hijack MikroTik Routers Through Internet-Exposed SSH Without Authentication
- Attackers Hijacked Over 300 Tor Exit Relays to Intercept SSH Connections
- Attackers Steal METR API Key and Consume AI Credits Worth About $600,000
- Attackers Tampered with AOMEI Backupper's Update Servers for Minutes to Deliver a Backdoor
- Attackers Target Rejetto HFS Flaw That Enables Admin Session Forgery and RCE
- Attackers Target miniOrange SAML Flaws That Can Grant WordPress Admin Access
- Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks
- Attackers Use LLM Agent for Post-Exploitation After Marimo CVE-2026-39987 Exploit
- Attackers Use Malicious Terraform Providers to Deliver Go Malware via HashiCorp Registry
- Attackers Use Microsoft Teams IT Support Scams to Deploy Malware and Ransomware
- Attackers Use Passkey Phishing to Hijack Microsoft Cloud Accounts and Exfiltrate Data
- Attackers Weaponize GitHub Actions Runners to Target cPanel and WHM Servers
- Attackers conceal phishing lures using invisible Unicode characters
- Attempts to Exploit Exposed "Vite" Installs (CVE-2025-30208), (Thu, Apr 2nd)
- August updates trigger 0xc0000409 errors on Windows Server 2016
- Aura confirms data breach exposing 900,000 marketing contacts
- Aurora Ransomware Operators Use Cursor AI in Attacks Against 10 Targets
- Australia Gets Into Amadey Malware Backend, Cuts Off Access to 180,000 Infected Computers
- Australia arrests alleged TeamPCP hackers behind supply-chain attacks
- Australia warns of ClickFix attacks pushing Vidar Stealer malware
- Australia warns of global campaign targeting vulnerable CMS platforms
- Australian energy provider Origin says data breach exposes client data
- Authorities Disrupt SocksEscort Proxy Botnet Exploiting 369,000 IPs Across 163 Countries
- Authorities Turn Sality's P2P Network Against Itself, Cutting Off New Malware Payloads
- Authorities dismantle 'AudiA6' ransomware crypto-laundering service
- Authorities disrupt nearly 11,000 cybercrime networks in Africa
- Authorities disrupt router DNS hijacks used to steal Microsoft 365 logins
- AutoIT Payload Injector , (Tue, Jul 28th)
- AutoJack Attack Lets One Web Page Hijack AI Agent for Host Code Execution
- Automated AI agent used to breach cybersecurity nonprofit DIVD
- Autonomous AI Agents Compromise Thousands of Credentials in Under Six Hours
- Autonomous AI Tool Finds 2-Year-Old RCE Flaw in Redis (CVE-2026-23479)
- Autonomous AI agents tried to hack US, Canadian government websites
- Avada Builder WordPress plugin flaws allow site credential theft
- Axios Supply Chain Attack Pushes Cross-Platform RAT via Compromised npm Account
- Axios npm hack used fake Teams error fix to hijack maintainer account
- Azerbaijani Energy Firm Hit by Repeated Microsoft Exchange Exploitation
- Azure CLI Password Spray Hits at Least 78 Microsoft Accounts in 81M+ Attempts
- Azure Cosmos DB Flaw Exposed Platform-Wide Key That Could Access Any Database
- BAE Systems cyberattack disrupts US federal court operations
- BGP Hijack Delivers Malicious Virtualizor Update That Establishes Persistent Root Access
- BKA Identifies REvil Leaders Behind 130 German Ransomware Attacks
- BTMOB Android malware service generates custom phishing payloads
- Backdoored PyTorch Lightning package drops credential stealer
- Backdoored Smart Slider 3 Pro Update Distributed via Compromised Nextend Servers
- Backdoored Telnyx PyPI package pushes malware hidden in WAV audio
- BambooToken Malware Uses MQTT to Control Windows and Linux Systems
- BambooToken malware controls Windows and Linux systems via MQTT
- BdThemes Supply Chain Attack Poisons JSON to Create Rogue WordPress Admins
- BdThemes plugins supply-chain hack creates rogue WordPress admins
- Bearlyfy Hits 70+ Russian Firms with Custom GenieLocker Ransomware
- Bearlyfy Hits Russian Firms with Custom GenieLocker Ransomware
- BengalSEO Poisons Bing Search Results to Deliver MayaBot and Tech Support Scams
- Berlin Refuses to Pay Hackers Who Stole Data From the City's State Network
- Berlin confirms data theft after Rhysida ransomware attack claims
- Betterleaks, a new open-source secrets scanner to replace Gitleaks
- Between alerts: What Attackers Do in the Spaces Ordinary Detection Misses
- Beyond the Zero-Day: See Your Network Like an Attacker | Webinar with HD Moore
- BeyondTrust Patches Critical Auth Bypass Flaws in Remote Support and PRA
- BeyondTrust patches zero-day exploited in attacks since August
- BeyondTrust warns of critical flaws in remote access software
- BigBear Microsoft 365 phishing service bypassed MFA at 258 organizations
- BigCommerce alerts merchants of data breach linked to Ribon apps
- Bing AI promoted fake OpenClaw GitHub repo pushing info-stealing malware
- Bing Images Flaws Let Crafted SVGs Run Commands as SYSTEM on Microsoft's Servers
- Bitget Confirms Third-Party Zero-Day Behind $387.5 Million Cryptocurrency Theft
- Bitget Says Attacker Exploited Third-Party Security Product Flaw to Steal $388M
- Bitget Says Suspected North Korean Hackers Stole $351.6M After Backend Compromise
- Bitget hacked via zero-day in third-party security products
- Bitget resumes Bitcoin withdrawals after $387.5 million crypto heist
- Bitrefill blames North Korean Lazarus group for cyberattack
- Bitter-Linked Hack-for-Hire Campaign Targets Journalists Across MENA Region
- Bitwarden CLI Compromised in Ongoing Checkmarx Supply Chain Campaign
- Bitwarden CLI npm package compromised to steal developer credentials
- Bitwarden adds support for passkey login on Windows 11
- BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations
- BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot
- Blackfield ransomware asks Nidec Corporation for $2 million ransom
- Block the Prompt, Not the Work: The End of "Doctor No"
- BlueNoroff Zoom Phishing Kit Profiles Crypto Wallets Before Malware Delivery
- Bluekit phishing kit adopts browser-in-the-middle for login theft
- Boston Scientific says cyberattack disrupted operations globally
- Botnet Hunting for Vulnerabilities in Diagnostic Tools, (Tue, Aug 4th)
- BraZetsu Malware Turns Compromised Windows Hosts Into Criminal Marketplace Inventory
- BragJack attacks hijack AI browser agents through malicious extensions
- Brave Software releases Origin for a paid, bloat-free browsing experience
- Brave browser adds email aliases to help users evade tracking
- Brazilian LofyGang Resurfaces After Three Years With Minecraft LofyStealer Campaign
- Breach at the Beach: Play the Ultimate Entra ID CTF
- Breeze Comet Executes Hundreds of Fraudulent Transactions via Brazilian Payment Systems
- Brevo supply-chain attack injected ClickFix scripts on customer sites
- Bridging the AI Agent Authority Gap: Continuous Observability as the Decision Engine
- Bring Your Own Agent: Your Employees' Assistants Are Already Logged In
- British Scattered Spider hacker pleads guilty to crypto theft charges
- Broken VECT 2.0 ransomware acts as a data wiper for large files
- Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software
- Browser Extensions Are the New AI Consumption Channel That No One Is Talking About
- Bruteforce Scans for CrushFTP , (Tue, Mar 3rd)
- Bubble AI app builder abused to steal Microsoft account credentials
- Building a High-Impact Tier 1: The 3 Steps CISOs Must Follow
- Bullhorn takes staffing platform offline to contain cyberattack
- Burger King Japan data breach exposes 11 million customer records
- C0XMO botnet spreads via DD-WRT router flaw, kills rival malware
- CDN Tsunami Attack Abuses HTTP/3 Translation for Up to 350x DoS Amplification
- CERT-EU: European Commission hack exposes data of 30 EU entities
- CERT-In Mandates 12-Hour Patching for Internet-Facing Flaws Amid AI-Assisted Attacks
- CERT-In Recommends 12-Hour Patching for Internet-Facing Flaws Amid AI-Assisted Attacks
- CERT-In Warns AI Agents Accessed Sensitive Data at Indian Organizations During Testing
- CERT-UA Impersonation Campaign Spread AGEWHEEZE Malware to 1 Million Emails
- CERT/CC Warns of Hidden Admin Backdoor in Tenda Router Firmware
- CISA Adds 4 Actively Exploited Adobe, Joomla, and Langflow Flaws to KEV
- CISA Adds 4 Exploited Flaws to KEV, Sets May 2026 Federal Deadline
- CISA Adds 5 Actively Exploited Artifactory, ScreenConnect, and RouterOS Flaws to KEV
- CISA Adds 6 Known Exploited Flaws in Fortinet, Microsoft, and Adobe Software
- CISA Adds 8 Exploited Flaws to KEV, Sets April-May 2026 Federal Deadlines
- CISA Adds Actively Exploited ConnectWise and Windows Flaws to KEV
- CISA Adds Actively Exploited Linux Root Access Bug CVE-2026-31431 to KEV
- CISA Adds Actively Exploited SolarWinds Serv-U DoS Flaw to KEV Catalog
- CISA Adds Actively Exploited VMware Aria Operations Flaw CVE-2026-22719 to KEV Catalog
- CISA Adds CVE-2025-53521 to KEV After Active F5 BIG-IP APM Exploitation
- CISA Adds Cisco SD-WAN CVE-2026-20182 to KEV After Admin Access Exploits
- CISA Adds Cisco, Chrome, and Arista Flaws to KEV Catalog Amid Active Exploitation
- CISA Adds Exploited Cisco Catalyst SD-WAN Manager Auth Bypass to KEV
- CISA Adds Exploited Langflow and Trend Micro Apex One Vulnerabilities to KEV
- CISA Adds Exploited Magento RCE Flaw CVE-2026-45247 to KEV Catalog
- CISA Adds Exploited N-able N-central Flaw to KEV After Customer Compromises
- CISA Adds Exploited PTC Windchill RCE Flaw to KEV as Web Shell Attacks Continue
- CISA Adds Exploited SharePoint RCE Zero-Day CVE-2026-58644 to KEV
- CISA Adds Seven Exploited Flaws as Attackers Deploy Reverse Shells and Crypto Miners
- CISA Adds Six Exploited Flaws to KEV, Including NetScaler, Linux, and SQL Server Bugs
- CISA Admin Leaked AWS GovCloud Keys on Github
- CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution
- CISA Flags Actively Exploited Ray Flaw That Can Trigger Browser-Based RCE
- CISA Flags Actively Exploited Wing FTP Vulnerability Leaking Server Paths
- CISA Flags Actively Exploited n8n RCE Bug as 24,700 Instances Remain Exposed
- CISA Flags Apple, Craft CMS, Laravel Bugs in KEV, Orders Patching by April 3, 2026
- CISA Flags Exploited Cisco, Citrix, Fortinet Flaws, Sets Sept. 12 Federal Patch Deadline
- CISA Flags Langflow RCE, Tomcat, and N-central Flaws as Actively Exploited
- CISA Flags LiteSpeed cPanel Plugin Flaw Exploited for Root Privilege Escalation
- CISA Flags SolarWinds, Ivanti, and Workspace One Vulnerabilities as Actively Exploited
- CISA Flags TeamCity CVE-2026-63077 RCE Flaw Under Active Exploitation in the Wild
- CISA Flags Three Linux Kernel Vulnerabilities Exploited in the Wild
- CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud
- CISA Orders Federal Agencies to Patch Exploited Plex2Shell, Siemens, and SiteGuard Flaws
- CISA Red Team Compromised Two Critical Infrastructure Orgs, One Detected Nothing
- CISA Says Attackers Are Exploiting Two Critical Citrix NetScaler Flaws Globally
- CISA Urges Immediate Ivanti Connect Secure Updates as Honeypots Log 105 Exploit Attempts
- CISA Warns Critical Lantronix EDS5000 Flaw Is Being Actively Exploited
- CISA Warns Fortinet Customers as FortiBleed Hits 86,644 FortiGate Devices
- CISA Warns of Actively Exploited Joomla JCE Flaw Allowing PHP Code Execution
- CISA Warns of Zimbra, SharePoint Flaw Exploits; Cisco Zero-Day Hit in Ransomware Attacks
- CISA alerts of active exploitation of three Linux kernel flaws
- CISA confirms PHP2Shell vulnerabilities now exploited in attacks
- CISA flags Apache ActiveMQ flaw as actively exploited in attacks
- CISA flags VMware Aria Operations RCE flaw as exploited in attacks
- CISA flags Windows Task Host vulnerability as exploited in attacks
- CISA flags Wing FTP Server flaw as actively exploited in attacks
- CISA flags new SD-WAN flaw as actively exploited in attacks
- CISA flags two-year-old Oracle flaw as actively exploited in attacks
- CISA gives feds 3 days to patch Check Point VPN bug exploited as zero-day
- CISA gives feds 4 days to patch actively exploited cPanel plugin flaw
- CISA gives feds four days to patch Ivanti flaw exploited as zero-day
- CISA orders feds to patch BlueHammer flaw exploited as zero-day
- CISA orders feds to patch Citrix NetScaler RCE flaw by Saturday
- CISA orders feds to patch DarkSword iOS flaws exploited attacks
- CISA orders feds to patch Fortinet flaw exploited in attacks by Friday
- CISA orders feds to patch Windows flaw exploited as zero-day
- CISA orders feds to patch Zimbra XSS flaw exploited in attacks
- CISA orders feds to patch Zyxel flaw exploited for data theft
- CISA orders feds to patch actively exploited Citrix flaw by Thursday
- CISA orders feds to patch actively exploited Drupal vulnerability
- CISA orders feds to patch actively exploited Ivanti flaw by Sunday
- CISA orders feds to patch actively exploited Oracle flaw by Saturday
- CISA orders feds to patch actively exploited TrueConf Server flaws
- CISA orders feds to patch exploited Citrix flaws by Wednesday
- CISA orders feds to patch exploited Fortinet EMS flaw by Friday
- CISA orders feds to patch exploited Ivanti EPMM flaw by Sunday
- CISA orders feds to patch max severity ColdFusion flaw by Friday
- CISA orders feds to patch max severity Joomla plugin flaw by Friday
- CISA orders feds to patch max-severity Cisco flaw by Sunday
- CISA orders feds to patch n8n RCE flaw exploited in attacks
- CISA orders feds to prioritize patching Langflow auth bypass flaw
- CISA orders urgent action on actively exploited Langflow RCE flaw
- CISA orders urgent patching of actively exploited Zimbra flaw
- CISA says ‘Copy Fail’ flaw now exploited to root Linux systems
- CISA sets urgent deadline to fix Cisco flaw exploited in attacks
- CISA shares advice on isolating vital systems during cyberattacks
- CISA tells govt agencies to patch critical exploited flaws in 3 days
- CISA urges US orgs to secure Microsoft Intune systems after Stryker breach
- CISA urges immediate action on actively exploited Fortinet flaws
- CISA warns Fortinet users to secure devices after FortiBleed leak
- CISA warns admins to immediately fix Ivanti flaw exploited as zero-day
- CISA warns admins to patch actively exploited SharePoint flaws
- CISA warns feds to patch iOS flaws exploited in crypto-theft attacks
- CISA warns of Apple flaws exploited in spyware, crypto-theft attacks
- CISA warns of Sharepoint, WSO2, Adobe Commerce flaws exploited in attacks
- CISA warns of active attacks exploiting Android, Linux bugs
- CISA warns of actively exploited RCE flaws in Joomla extensions
- CISA warns of another cPanel plugin flaw exploited in attacks
- CISA warns of critical pre-auth RCE flaw in MikroTik RouterOS
- CISA warns of cyberattacks disrupting U.S. water utilities
- CISA warns of cyberattacks targeting fuel tank monitoring systems
- CISA warns of hackers exploiting Langflow, N-central, Apache Tomcat flaws
- CISA warns of hackers exploiting critical MLflow vulnerability
- CISA warns of hackers now exploiting critical Node2Shell flaw
- CISA warns of max severity Ubiquiti flaws exploited in attacks
- CISA: Critical VMware RCE flaw now exploited by ransomware gangs
- CISA: Hackers chain Plex flaws in Plex2Shell attacks to breach servers
- CISA: Hackers now exploit SolarWinds Serv-U flaw to crash servers
- CISA: Hackers now exploit max severity GitLab flaw in attacks
- CISA: Medusa ransomware hit over 500 critical infrastructure orgs
- CISA: Microsoft SharePoint RCE flaw now actively exploited
- CISA: Microsoft SharePoint flaw now exploited in ransomware attacks
- CISA: New Langflow flaw actively exploited to hijack AI workflows
- CISA: Ransomware gangs now exploiting critical TeamCity flaw
- CISA: Recently patched Ivanti EPM flaw now actively exploited
- CISA: SafePay ransomware hit over 600 critical infrastructure orgs
- CISA: SonicWall SMA1000 flaws now exploited by ransomware gangs
- CISA: Splunk Enterprise flaw actively exploited, patch by Sunday
- CISA: WatchGuard RCE flaw now exploited in ransomware attacks
- CISA: Windows BlueHammer flaw now exploited by ransomware gangs
- CISA: Windows Task Host flaw now exploited by ransomware gangs
- CISO's Expert Guide to Agentic Pentesting for Websites
- CJIS v6.1 Compliance: 5 Practical Priorities for Agencies
- COLDCARD security audit phishing attack installs remote access tool
- COLDCARD wallet RNG flaw likely linked to $88 million Bitcoin theft
- CPUID Breach Distributes STX RAT via Trojanized CPU-Z and HWMonitor Downloads
- CPUID hacked to deliver malware via CPU-Z, HWMonitor downloads
- CTM360 Research Reveals How Insurance Phishing Has Evolved Into Real-Time Account Hijacking
- CVE-2024-40766: The Patch Fixed the Bug. Nobody Fixed the Configuration., (Tue, Jun 23rd)
- California AG sues 23andMe over 2023 breach exposing health data
- Calling viral AI actress Tilly Norwood? Agree to a face scan first
- Can You Prove a New CVE Is Exploitable Before Attackers Do? Learn How in This Webinar
- Can the Security Platform Finally Deliver for the Mid-Market?
- Can you enforce strong Active Directory password rules without frustrating users?
- Canada arrests three for operating “SMS blaster” device in Toronto
- Canada’s Spy Agency Used First-of-Its-Kind Warrant to Clean Botnet-Infected Devices
- Canadian Man Pleads Guilty in Snowflake Extortions
- Canadian pleads guilty to Snowflake cloud data-theft attacks
- Canadian retail giant Loblaw notifies customers of data breach
- Canvas Breach Disrupts Schools & Colleges Nationwide
- Canvas login portals hacked in mass ShinyHunters extortion campaign
- Capcom confirms data breach affecting 11.7 million accounts
- Captive Portal Detection, (Tue, Jul 21st)
- Carbonato Botnet Compromises Docker Hosts to Deploy Telegram-Controlled Hermes AI Agent
- Carhartt data breach exposes information of 12.9 million accounts
- Carnival Cruise confirms data breach affecting nearly 6 million people
- Casbaneiro Phishing Targets Latin America and Europe Using Dynamic PDF Lures
- Catch threats before they escalate with real-time Identity Telemetry
- Cavern C2 Uses DNS and Google Apps Script to Blend Into Legitimate Traffic
- CenterPoint Energy confirms customer data stolen in cyberattack
- Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller
- Certighost and the Privilege Hiding in Your Certificate Authority
- Chaos Ransomware Uses msaRAT to Route C2 Traffic Through Headless Chrome and Edge
- Charter Communications data breach affects 4.9 million accounts
- Charter confirms data breach after ShinyHunters extortion threat
- ChatGPT AgentForger Flaw Could Deploy Rogue Workspace Agents via a Phishing Link
- ChatGPT Astra is now rolling out to $20 Plus subscription
- ChatGPT Flaw Let a Planted Prompt Send a Victim's Gmail Data to Another Account
- ChatGPT can now connect to your personal apps to mimic writing style
- ChatGPT rolls out new $100 Pro subscription to challenge Claude
- ChatGPT share links abused to host fake outage pages to deliver malware
- ChatGPhish Vulnerability Turns ChatGPT Web Summaries Into a Phishing Surface
- Cheap Android TV Boxes Pose as Phones and Turn Owners’ Broadband Into Proxies
- Check Point Discloses Two 9.8-Rated VPN Certificate Flaws Enabling Unauthenticated RCE
- Check Point Patches Exploited SmartConsole Flaw Allowing Full Admin Access
- Check Point Warns of Management Server Zero-Day Exploited in Targeted Attacks
- Check Point links VPN zero-day attacks to Qilin ransomware gang
- Check Point warns of Management Server zero-day exploited in attacks
- Check Point warns of SmartConsole zero-day exploited in attacks
- Check Point warns of hackers exploiting Security Gateway VPN RCE flaw
- Checkmarx Confirms GitHub Repository Data Posted on Dark Web After March 23 Attack
- Checkmarx confirms LAPSUS$ hackers leaked its stolen GitHub data
- Chick-fil-A data breach affects more than 13,000 customers
- Chick-fil-A discloses data breach after credential stuffing attacks
- China's Apple App Store infiltrated by crypto-stealing wallet apps
- China-Aligned Bronze Sandcastle Abuses Sandboxie DLL Sideloading to Deploy Backdoors
- China-Aligned FamousSparrow Deploys SparroWocky Backdoor Across Latin America
- China-Aligned Groups Ramp Up Attacks: Dragon Weave Hits Czech Republic & Taiwan
- China-Aligned TA419 Targets U.S. AI Policy Experts With Microsoft AitM Phishing
- China-Linked Fire Ant Hijacks Cisco Routers to Steal Credentials and Blind Security Logs
- China-Linked GopherWhisper Infects 12 Mongolian Government Systems with Go Backdoors
- China-Linked Hackers Backdoored Linux Login Software to Hide for Nearly a Decade
- China-Linked Hackers Deploy New StormEncryptor Ransomware, Likely via N-central Flaw
- China-Linked Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy GRIMWEDGE
- China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers
- China-Linked Hackers Target Asian Governments, NATO State, Journalists, and Activists
- China-Linked Hackers Use ARTEX AI Agents in ConnectWise Supply Chain Attack
- China-Linked Hackers Use TernDoor, PeerTime, BruteEntry in South American Telecom Attacks
- China-Linked JDY Botnet Expands to 1,500+ Devices for Cyber Reconnaissance
- China-Linked Red Menshen Uses Stealthy BPFDoor Implants to Spy via Telecom Networks
- China-Linked SprySOCKS Backdoor Expands to Windows with Driver-Based Stealth
- China-Linked Storm-1175 Exploits Zero-Days to Rapidly Deploy Medusa Ransomware
- China-Linked TA416 Targets European Governments with PlugX and OAuth-Based Phishing
- China-Linked TA4922 Expands Phishing Attacks to U.K., Germany, Italy, and South Africa
- China-Linked TA4922 Expands Phishing Attacks to UK, Germany, Italy, and South Africa
- China-Linked UAT-7810 Expands ORB Network With New LONGLEASH Malware
- China-Linked UAT-8302 Targets Governments Using Shared APT Malware Across Regions
- China-Linked UNC3569 Exploited Sogou Input Method Flaw to Deploy GRAYRABBIT Backdoor
- China-Made ZBT Routers Ship With Two Implants Giving Unauthenticated Attackers Root Access
- China-Nexus JadeProx Uses New TriBack Loader in Government and Healthcare Attacks
- China-linked JDY botnet expands targeting of U.S. military networks
- Chinese APT deploys new malware to keep access to hacked networks
- Chinese Fire Ant hackers turn Cisco routers into spying platforms
- Chinese Hacker Commands DeepSeek via Telegram to Launch Autonomous Attacks
- Chinese Hackers Abused Google Workspace Rules to Steal Research and Defense Emails
- Chinese Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy CLEANGULP Malware
- Chinese Hackers Target Southeast Asian Militaries with AppleChris and MemFun Malware
- Chinese Silk Typhoon Hacker Extradited to U.S. Over COVID Research Cyberattacks
- Chinese Threat Actor Uses Leaked DarkSword Kit to Deploy GHOSTBLADE on iOS
- Chinese hackers breach REDCap servers, steal medical research
- Chinese hackers develop LONGLEASH malware to expand ORB network
- Chinese hackers exploit WordPress, Zyxel flaws to steal govt data
- Chinese hackers hijack auth flow, spy on isolated network for a decade
- Chinese hackers target telcos with new Linux, Windows malware
- Chinese hackers use SparroWocky malware in govt espionage attacks
- Chinese hackers use new Atlas RAT malware in European cyberattacks
- Chinese man extradited for role in $36 million cryptocurrency scam
- Chinese state hackers target telcos with new malware toolkit
- Chinese-Made Zbtlink Routers Ship With Backdoor That Opens Unauthenticated Root Shells
- Chinese-Speaking APT Deploys New TinyRCT Backdoor in Southeast Asia Campaign
- ChocoPoc malware delivered via trojanized exploits on GitHub
- Chrome Ad Blocker with 10M+ Installs Found with Dormant Script Injection Capability
- Chrome Extension Turns Malicious After Ownership Transfer, Enabling Code Injection and Data Theft
- Chrome V8 Zero-Day CVE-2026-11645 Exploited in the Wild - Patch Now
- Chrome V8 Zero-Day Exploited in the Wild Enables Code Execution Inside Sandbox
- Chrome Web Store extensions caught stealing crypto, browser data
- Cisco ASA and FTD Flaw Exploited in the Wild Can Trigger Remote DoS
- Cisco Catalyst SD-WAN Controller Auth Bypass Actively Exploited to Gain Admin Access
- Cisco Catalyst SD-WAN Manager CVE-2026-20245 Flaw Actively Exploited – No Patch Available
- Cisco Catalyst SD-WAN Zero-Day CVE-2026-20245 Exploited to Gain Root Access
- Cisco Confirms Active Exploitation of Two Catalyst SD-WAN Manager Vulnerabilities
- Cisco FMC Flaws Exploited to Steal Credentials and Deploy Qilin Ransomware
- Cisco FMC Zero-Day Actively Exploited, Static Credentials Could Expose Sensitive Data
- Cisco FMC flaws exploited by ransomware gang, state-sponsored hackers
- Cisco Patches 12 SD-WAN and IOS XE Flaws, Including Three 9.8 CVSS Score Bugs
- Cisco Patches 12 SD-WAN and IOS XE Flaws, Including Three 9.9 CVSS Score Bugs
- Cisco Patches 9.8 CVSS IMC and SSM Flaws Allowing Remote System Compromise
- Cisco Patches CVE-2026-20230 in Unified CM as Exploit Code Goes Public
- Cisco Patches CVSS 10.0 Secure Workload REST API Flaw Enabling Data Access
- Cisco Patches Four Critical Identity Services, Webex Flaws Enabling Code Execution
- Cisco Patches Nine Crosswork and Secure Workload Flaws, Five Scoring CVSS 10.0
- Cisco Releases Security Updates for Actively Exploited SD-WAN Manager Flaw
- Cisco Secure Email Gateway Flaw Exploited in the Wild, Enables Root Command Execution
- Cisco Unified CM Flaw Exploited After PoC Reveals File-Write Path to Root
- Cisco Unified CM flaw CVE-2026-20230 now exploited in attacks
- Cisco Warns of Active Attacks Exploiting New Critical Secure Email Gateway Vulnerability
- Cisco Warns of Attackers Exploiting Critical Authentication Bypass in SD-WAN Manager
- Cisco confirms CVE-2026-20079 Secure FMC flaw exploited in attacks
- Cisco finally confirms attackers exploiting Unified CM flaw
- Cisco fixes SD-WAN vManage flaw exploited in zero-day attacks
- Cisco flags more SD-WAN flaws as actively exploited in attacks
- Cisco patches Secure Email Gateway zero-day exploited in attacks
- Cisco patches new Secure Email Gateway zero-day exploited in attacks
- Cisco says critical Webex Services flaw requires customer action
- Cisco source code stolen in Trivy-linked dev environment breach
- Cisco warns of ASA and FTD VPN flaw exploited to crash devices
- Cisco warns of FMC static credential flaw exploited in zero-day attacks
- Cisco warns of critical Unified CM flaw with PoC exploit code
- Cisco warns of critical flaws allowing Nexus switch takeover
- Cisco warns of high-severity ClamAV flaws with public exploits
- Cisco warns of max severity ISE zero-day exploited in attacks
- Cisco warns of max severity Secure FMC flaws giving root access
- Cisco warns of new SD-WAN zero-day exploited in attacks
- Cisco warns of new critical SD-WAN flaw exploited in zero-day attacks
- Cisco warns of unpatched SD-WAN zero-day exploited in attacks
- Citizen Lab Traces Zero-Click Candiru Spyware Infections at Al Jazeera to Targeted Online Ads
- Citizen Lab: Law Enforcement Used Webloc to Track 500 Million Devices via Ad Data
- Citrix NetScaler CVE-2026-88772 Exploit Details Show Pre-Auth Path to Shellcode Execution
- Citrix NetScaler Post-Exploitation Payload Creates Superuser, Maps Web Shell to CSS-Like URLs
- Citrix NetScaler Under Active Recon for CVE-2026-3055 (CVSS 9.3) Memory Overread Bug
- Citrix Patches Critical NetScaler Flaw That Could Enable RCE in SAML Deployments
- Citrix Patches Six NetScaler Flaws Allowing File Read and Denial-of-Service
- Citrix Urges Patching Critical NetScaler Flaw Allowing Unauthenticated Data Leaks
- Citrix admins warned to shut down NetScalers over 2 exploited zero-days
- Citrix confirms two NetScaler RCE zero-days exploited in attacks
- Citrix patches NetScaler SAML zero-day exploited in attacks
- Citrix urges admins to patch NetScaler flaws as soon as possible
- Citrix urges admins to patch new NetScaler flaws as soon as possible
- Citrix warns admins to patch new NetScaler RCE flaw immediately
- Cl0p Affiliates Target Internet-Exposed PTC Windchill and FlexPLM with Unauthenticated RCE
- Claimed Bug Bounty Hunter Likely Used LLM to Build PhantomRaven npm Stealer
- Claude AI Just Cracked a Post-Quantum Test Scheme and Found a Faster 7-Round AES Attack
- Claude AI finds Vim, Emacs RCE bugs that trigger on file open
- Claude Chrome extension flaw lets malicious extensions trigger AI actions
- Claude Code GitHub Action Flaw Let One Malicious Issue Hijack Repositories
- Claude Code Security and Magecart: Getting the Threat Model Right
- Claude Code Source Leaked via npm Packaging Error, Anthropic Confirms
- Claude Code and Gemini CLI Flaws Let a GitHub Issue Reach CI Workflow Secrets
- Claude Code leak used to push infostealer malware on GitHub
- Claude Code source code accidentally leaked in NPM package
- Claude Cowork Flaw Could Let AI Agent Escape Its VM and Access Mac Files
- Claude Extension Flaw Enabled Zero-Click XSS Prompt Injection via Any Website
- Claude Fable 5 isn’t permanently leaving subscriptions, Anthropic says
- Claude Fable 5 stays free for paid users until July 19 as Anthropic buys more time
- Claude Fable relaunch disappoints users with nerfed performance
- Claude Mythos 5 Tried to Backdoor a Real Open-Source Project in Testing, Then Vouched for Itself
- Claude Mythos AI Finds 10,000 High-Severity Flaws in Widely Used Software
- Claude Opus 4.6 Bypasses Gym Booking Limit, Cancels Other Users' Reservations in Tests
- Claude Opus 5 Helped Researchers Take Over OpenAI Staff Accounts via Chained Flaws
- Claude Opus 5.5 uses 95% fewer em dashes, but its answers are getting longer
- Claude Used to Automate Exploitation and Data Theft Across Multiple Victims
- Clean GitHub repo tricks AI coding agents into running malware
- Cleartext Passwords in MS Edge? In 2026?, (Mon, May 4th)
- ClickFix Attackers Exploit Siemens Software Center Flaw to Deploy Remote Access Trojan
- ClickFix Attacks Deliver macOS Stealer That Can Drain Crypto Wallets
- ClickFix Campaigns Expand Malware Delivery With New Loaders and Fake Update Lures
- ClickFix Campaigns Spread MacSync macOS Infostealer via Fake AI Tool Installers
- ClickFix Lures Deploy ChainScript RAT Using Polygon to Rotate C2 Infrastructure
- ClickFix Smuggles Payloads Through Browser Cache to Bypass Windows Run Limits
- ClickFix attack pushes macOS infostealer for crypto theft attacks
- ClickFix has never been bigger, and AI tools are its most convincing lure yet
- Clop created custom web shell for Windchill data theft attacks
- Clop ransomware targets Windchill, FlexPLM in data theft attacks
- Clop-Linked Windchill Web Shell Decrypts Credentials and Maps Engineering Data
- Closing the Identity Gaps in Critical Infrastructure Security
- CloudZ malware abuses Microsoft Phone Link to steal SMS and OTPs
- Cloudflare Fixes Flaw That Let One Container Read Another Customer's Leftover Disk Data
- Cloudflare Workers Spectre Attack Leaks JWT From Co-Located Worker at 12 Bits/Second
- Cloudflare fixes Containers cross-tenant flaw exposing customer data
- Coca-Cola confirms data theft in Fairlife ransomware attack
- Coca-Cola says Fairlife ransomware attack halts US dairy production
- Coder's registry infrastructure compromised to push malicious modules
- Cognizant TriZetto breach exposes health data of 3.4 million patients
- Cohere AI Terrarium Sandbox Flaw Enables Root Code Execution, Container Escape
- Coldcard Hardware Wallet Flaw Linked to $70 Million Bitcoin Theft in 41 Minutes
- Comcast turns your Xfinity WiFi into a home motion detector
- Compromised AsyncAPI npm Packages Deliver Multi-Stage Botnet Malware
- Compromised GitHub Actions Came Back Online and Resumed Executing Mini Shai-Hulud Malware
- Compromised MemTensor Packages Deliver sckit Credential Stealer via npm and PyPI
- Compromised Nx Console 18.95.0 Targeted VS Code Developers with Credential Stealer
- Compromised Site Management Panels are a Hot Item in Cybercrime Markets
- Compromised jscrambler 8.14.0 npm Release Drops Rust Infostealer During Install
- ConnectWise Resets Credentials as Cloud Backup Remains Offline After Security Incident
- ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants
- ConnectWise patches new flaw allowing ScreenConnect hijacking
- ConnectWise warns of new ScreenConnect flaw without patch
- ConsentFix and ClickFix: How Microsoft 365 Accounts are Hijacked in 3 Seconds
- ConsentFix v3 attacks target Azure with automated OAuth abuse
- Contagious Interview Campaign Compromises 30,000 Devices, Steals $10.71M in Crypto
- Conti ransomware gang member sentenced to 4 years in prison
- Continuing Scans for swagger.json, (Wed, Jun 3rd)
- Coordinated Cyberattack Targets 30+ Minnesota Water Systems as One Plant Goes Offline
- Cordyceps CI/CD Flaws Expose 300+ GitHub Repositories to Supply-Chain Attacks
- Corp MDM Spyware Targets Logistics Firms, Steals New SMS and Redirects Calls
- Coruna iOS Exploit Kit Uses 23 Exploits Across Five Chains Targeting iOS 13–17.2.1
- Coruna iOS Kit Reuses 2023 Triangulation Exploit Code in New Mass Attacks
- Coruna iOS exploit framework linked to Triangulation attacks
- Cosmetics giant Rituals discloses data breach affecting customers
- Cosmos EVM Flaw Exploited After Cosmos Labs Knew Every Blockchain Running It Was Vulnerable
- Council of Europe investigates ShinyHunters data breach claims
- Coupang hit with record $409 million data breach fine in Korea
- Court Filing Reveals Windows Device ID Helped FBI Trace Alleged Scattered Spider Hacker
- CrashStealer macOS Malware Uses Notarized Dropper to Pass Gatekeeper Checks
- Credential-Stealing GitHub Actions Workflows Planted in Tens of Thousands of Repositories
- Credit card theft campaign abuses Stripe to host stolen payment info
- Criminal IP Introduces AITEM as the Next Evolution of Attack Surface Management
- Criminal IP and Securonix ThreatQ Collaborate to Enhance Threat Intelligence Operations
- Critical 'HTTP2Shell' Brotli vulnerability triggers emergency patches
- Critical 16-Year-Old UEFI Flaw Can Run Code Before Secure Boot on Network-Booting Servers
- Critical Apache HTTP/2 Flaw (CVE-2026-23918) Enables DoS and Potential RCE
- Critical Atlassian Flaw Lets Unauthenticated Attackers Read Known Files Across 8 Products
- Critical Avada WordPress theme flaw enables zero-click RCE
- Critical Bifrost AI Gateway Flaw Lets Attackers Run Commands Without Credentials
- Critical BlockStrap flaw lets hackers run code on Magento servers
- Critical Check Point Management Flaw Lets Unauthenticated Attackers Run Code as Root
- Critical Check Point VPN Flaw Exploited to Bypass Passwords in IKEv1 Setups
- Critical Cisco IMC auth bypass gives attackers Admin access
- Critical Cisco Nexus 9000 Flaw Lets Unauthenticated Remote Attackers Run Code as Root
- Critical Citrix NetScaler auth bypass now leveraged in attacks
- Critical Citrix NetScaler memory flaw actively exploited in attacks
- Critical Cursor Flaws Could Let Prompt Injection Escape Sandbox and Run Commands
- Critical Docker Sandboxes Flaw Lets Malicious Guest Code Read and Modify macOS Host Files
- Critical Elementor Pro bug exposes WordPress sites to RCE attacks
- Critical Elementor Pro flaw exploited to take over WordPress sites
- Critical Everest Forms Pro flaw exploited to take over WordPress sites
- Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image
- Critical FortiMail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File Writes
- Critical FortiSIEM Flaw Gets Public Exploit PoC for Unauthenticated Remote Code Execution
- Critical Fortinet FortiSandbox flaws now exploited in attacks
- Critical Fortinet Forticlient EMS flaw now exploited in attacks
- Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases
- Critical GitLab GraphQL Flaw Could Let Unauthenticated Attackers Delete Public Projects
- Critical Gitea Flaw Let Unauthenticated Attackers Read Server Files via Org-Mode Markup
- Critical Gitea RCE Actively Exploited as Reported Attack Drops Miner-Like Payload
- Critical Gogs RCE Vulnerability Lets Any Authenticated User Execute Arbitrary Code
- Critical Keycloak Password Reset Flaw Could Let Unauthenticated Attackers Take Over Any Account
- Critical Kirki flaw exploited to hijack WordPress admin accounts
- Critical Langflow Flaw CVE-2026-33017 Triggers Attacks within 20 Hours of Disclosure
- Critical Langflow flaw exploited to steal OpenAI and AWS keys
- Critical Marimo pre-auth RCE flaw now under active exploitation
- Critical Microsoft SharePoint flaw now exploited in attacks
- Critical Microsoft Vulnerabilities Doubled: From Exposure to Escalation
- Critical MikroTik Vulnerability - Patch Now, (Sun, Sep 6th)
- Critical NGINX Vulnerability Can Crash Workers and May Allow Remote Code Execution
- Critical NetScaler Flaw Can Bypass Authentication on Certain Gateway and AAA Servers
- Critical Next.js ImageResponse Flaw Can Lead to Server Code Execution via Crafted SVG Input
- Critical Nginx UI auth bypass flaw now actively exploited in the wild
- Critical OpenWrt DHCPv6 Flaw Could Let Unauthenticated Attackers Run Code as Root
- Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) [infocon yellow], (Wed, Oct 21st)
- Critical Palo Alto VPN bug now exploited by Qilin ransomware gang
- Critical Pre-Auth RCE in Orkes Conductor Workflow Platform Exploited in the Wild
- Critical Progress LoadMaster flaw now actively exploited in attacks
- Critical PwnEscape Linux Kernel Vulnerability Lets Guest VMs Read Host Memory
- Critical RCE flaw in Windows IKE Extension now actively exploited
- Critical Rails Flaw Could Let Unauthenticated Attackers Read Server Files via Image Uploads
- Critical ScreenConnect flaw now actively exploited in attacks
- Critical ServiceNow AI Platform Flaw Exploited for Unauthenticated Code Execution
- Critical ServiceNow code execution flaw now exploited in attacks
- Critical SharePoint RCE CVE-2026-50522 Under Active Exploitation After Public PoC
- Critical SharePoint RCE flaw exploited to steal machine keys
- Critical SimpleHelp flaw exploited to deploy new stealer malware
- Critical SonicWall SMA 1000 Flaw Targeted in 135 Exploitation Attempts After Patch
- Critical Splunk Enterprise Flaw Lets Attackers Run Code Without Authentication
- Critical TeamCity Flaw Could Let Attackers Run OS Commands Without Logging In
- Critical Unbound DNSSEC Validator Flaw Could Allow RCE via a Malicious DNS Zone
- Critical UniFi OS bug lets hackers gain root without authentication
- Critical Unpatched Flaw Leaves Hugging Face LeRobot Open to Unauthenticated RCE
- Critical Unpatched Telnetd Flaw (CVE-2026-32746) Enables Unauthenticated Root RCE
- Critical Unpatched Telnetd Flaw (CVE-2026-32746) Enables Unauthenticated Root RCE via Port 23
- Critical VMware Workstation and Fusion Flaw Lets VM Admins Execute Host Code
- Critical VMware vCenter RCE flaw exploited for reverse SSH access
- Critical WP Maps Pro Flaw Actively Exploited to Create Admin Accounts
- Critical Windows Netlogon RCE flaw now exploited in attacks
- Critical Zimbra Flaw Could Let Crafted Emails Run Malicious Code in User Sessions
- Critical Zimbra RCE flaw now actively exploited in attacks
- Critical cPanel Authentication Vulnerability Identified — Update Your Server Immediately
- Critical cPanel Flaw Could Let One Hosting Customer Take Root Control of a Whole Server
- Critical cPanel Vulnerability Weaponized to Target Government and MSP Networks
- Critical cPanel and WHM bug exploited as a zero-day, PoC now available
- Critical flaw in Protobuf library enables JavaScript code execution
- Critical flaw in wolfSSL library enables forged certificate use
- Critical macOS, SharePoint, vCenter, and Microsoft IKE Flaws Under Active Exploitation
- Critical n8n Flaws Allow Remote Code Execution and Exposure of Stored Credentials
- Critical vm2 sandbox bug lets attackers execute code on hosts
- Critical wp2shell WordPress flaws exploited to install webshells
- Critical x402 SDK Flaw Could Let Malicious APIs Drain AI Agents’ Token Balances
- Critrical cPanel flaw mass-exploited in "Sorry" ransomware attacks
- Cronos blockchain restarts after $74 million Tectonic exploit
- Cross-Platform NPM Stealer, (Fri, May 22nd)
- CrowdSec Says TanStack npm Attack Led to Copy of 170 Private GitHub Repositories
- Cruciferra Crypter Uses BYOVD and Process Ghosting to Hide Windows Malware
- Crunchyroll probes breach after hacker claims to steal 6.8M users' data
- Crypto Clipper Campaign Abuses Fake Reviews, AI Narrators, and VirusTotal Comments
- Crypto gang member gets 6.5 years for role in $230 million heist
- Crypto-exchange Kraken extorted by hackers after insider breach
- CryptoJS Weak RNG Behind $5.7 Million in Drains Affects Five Crypto Wallet Apps
- CubePilot drone software dev hit by DNS hijacking to intercept traffic
- Cursor Flaw Lets Malicious Cloned Repositories Trigger Windows Code Execution
- Cursor, Codex, Gemini CLI, Antigravity hit by sandbox escapes
- Custom ChatGPTs push ClickFix attacks to deploy RAT malware
- Cyber exec arrested in case allegedly tied to ShinyHunters hackers
- Cyber-Enabled Cargo Crime: How Cybercrime Tradecraft is Used to Steal Freight
- CyberStrikeAI Uses 44 AI Agents to Automate Hacking Operations Against Japan Targets
- CyberStrikeAI tool adopted by hackers for AI-powered attacks
- CyberXero Uses Claude Code in Campaign That Stole Over 628,000 Ukrainian Records
- Cyberattack shuts down refrigerators at French supermarkets
- Cybercrime Groups Using Vishing and SSO Abuse in Rapid SaaS Extortion Attacks
- Cybercrime service disrupted for abusing Microsoft platform to sign malware
- Cybersecurity Stars Awards 2026: Winners Announced Across 95 Categories
- Cybersecurity firms targeted by fraudulent OpenAI organization invites
- D-Link warns of max severity zero-day bug in DIR-822A routers
- DAEMON Tools Supply Chain Attack Compromises Official Installers with Malware
- DAEMON Tools devs confirm breach, release malware-free version
- DAEMON Tools trojanized in supply-chain attack to deploy backdoor
- DDoS attacks over 1 Tbps surged fivefold in the second quarter
- DEBULL Tooling Abuses Microsoft Device-Code Flow to Target M365 Accounts
- DHS bans DeepSeek products across US federal civilian agencies
- DHS confirms hackers breached HSIN info-sharing platform
- DIVD says Zammad zero-days enabled AI-driven network breach
- DOJ seizes CFAKE, SOCFAKE deepfake nude sites under TAKE IT DOWN Act
- DORA Year Two: Can Your SOC Actually See the Attack?
- DORA and operational resilience: Credential management as a financial risk control
- DOUBLECUP Uses ClickFix and Cached PNGs to Deliver CountLoader and DeviceManager RAT
- DOUBLECUP's PNG Payload, (Mon, Aug 24th)
- DPRK-Linked Hackers Use GitHub as C2 in Multi-Stage Attacks Targeting South Korea
- DPRK-Linked macOS Malvertising Uses Fake Updates to Deliver Crypto-Stealing Malware
- DRILLAPP Backdoor Targets Ukraine, Abuses Microsoft Edge Debugging for Stealth Espionage
- DShield (Cowrie) Honeypot Stats and When Sessions Disconnect, (Mon, Mar 30th)
- DShield Honeypot Update, (Mon, May 4th)
- Danger of Libredtail [Guest Diary], (Wed, Apr 29th)
- Danish university DTU breach exposes data of up to 200,000 people
- Dark web Nemesis Market vendor gets 26 years for selling drugs
- DarkSword iOS Exploit Kit Uses 6 Flaws, 3 Zero-Days for Full Device Takeover
- Dashlane Discloses Brute-Force Attack, Encrypted Vaults of Fewer Than 20 Users Downloaded
- Dashlane password manager users locked out by brute force attacks
- Data Broker Radaris Loses Domains in Privacy Fight
- Data analyst sent to prison for stealing data, extorting employer
- Data breach at edtech giant McGraw Hill affects 13.5 million accounts
- Data breach at medical billing firm MCBS affects 1.26 million people
- Data breach exposes up to 14.2 million email logins at six ISPs
- Dawn of the Apex Agentic Adversary
- Daxin Resurfaces in Taiwan Alongside Stupig Pre-Login SYSTEM Backdoor
- Day Zero Readiness: The Operational Gaps That Break Incident Response
- DeadLock Ransomware Uses Polygon Smart Contracts to Make Extortion Infra Harder to Disrupt
- DeadLock ransomware uses blockchain to resist infrastructure takedown
- DeepLoad Malware Uses ClickFix and WMI Persistence to Steal Browser Credentials
- DeepSeek Harness Flaw Let AI Agents Disable Their Own File Sandbox Without Approval
- Deepfake Voice Attacks are Outpacing Defenses: What Security Leaders Should Know
- Dell CSM Flaws Enable Unauthenticated Admin Access and Root on Kubernetes Nodes
- Dell asks admins to patch max severity CSM flaws as soon as possible
- Dell confirms its SupportAssist software causes Windows BSOD crashes
- Delta probes Wi-Fi deauth attack on flight carrying DEF CON attendees
- Denmark Says Attackers Accessed CPR Data for 8.8 Million People via Company Account
- Denmark population registry data breach affects 8.8 million people
- DentaQuest data breach exposed info of 2.6 million accounts
- Detecting IP KVMs, (Tue, Mar 24th)
- Deterministic + Agentic AI: The Architecture Exposure Validation Requires
- DevMan RaaS Portal Centralizes Payload Builds, Victim Management, and Affiliate Payouts
- Developer Workstations Are Now Part of the Software Supply Chain
- Device Code Phishing Hits 340+ Microsoft 365 Orgs Across Five Countries via OAuth Abuse
- Device code phishing attacks surge 37x as new kits spread online
- Die Linke German political party confirms data stolen by Qilin ransomware
- Differentiating Between a Targeted Intrusion and an Automated Opportunistic Scanning [Guest Diary], (Wed, Mar 4th)
- DirtyDecrypt PoC Released for Linux Kernel CVE-2026-31635 LPE Vulnerability
- Discord rolls out end-to-end encryption on voice, video calls
- Disgruntled researcher leaks “BlueHammer” Windows zero-day exploit
- DoJ Corrects China Hacking Claim, Says U.S. Agencies Were Targets, Not Victims
- DoJ Disrupts 3 Million-Device IoT Botnets Behind Record 31.4 Tbps Global DDoS Attacks
- DoJ Disrupts Southeast Asia Crypto Fraud Networks, Freezes $3.8 Million in Assets
- DoJ Seizes Huione Cloud Account Tied to Cyber Scam Money Laundering
- Docker CVE-2026-34040 Lets Attackers Bypass Authorization and Gain Host Access
- Docker Fixes Critical Two-Year-Old Hub Flaw That Let One User Push Images as Another
- Docker Hub flaw let attackers impersonate users, tamper with images
- Don't Revoke That Token Yet: Inside the keyv/cacheable npm Worm, (Wed, Aug 5th)
- DoppelCart fraud network uses 119,000 fake shops to steal credit cards
- Dormant GitHub Accounts Help Attackers Blend In While Mapping Corporate Orgs
- Dozens of Vendors Patch Security Flaws Across Enterprise Software and Network Devices
- DraftKings hacker 'Snoopy' sentenced to 18 months in prison
- DragonForce Hackers Abuse Microsoft Teams Relays to Hide Backdoor.Turn C2 Traffic
- DreamHost forces password resets in ongoing "incident"
- Drift $280M crypto theft linked to 6-month in-person operation
- Drift Loses $285 Million in Durable Nonce Social Engineering Attack Linked to DPRK
- Drift loses $280 million North Korean hackers seize Security Council powers
- Drift loses $280 million as hackers seize Security Council powers
- Dropbox accounts breached through Lenovo email verification flaw
- Drupal Core SQL Injection Bug Actively Exploited, Added to CISA KEV
- Drupal Patches Critical Core RCE Flaw with No-Login Path via Contributed Modules
- Drupal Patches Critical Field UI Flaw With Unauthenticated RCE Path via Contributed Modules