notice: please create a custom view template for the cybersec class view-cybersec.html
Malicious File in Downloads Folder Tries to Trick AI Coding Agent Into Installing Malware
A malicious instruction file sitting in a developer's Downloads folder tried to make their AI coding agent install a known-malicious npm package, security firm Forever Security said in a report published last week.
The company caught the attempt on a real customer's machine and stopped the agent before any code ran. It could not determine how the file got into the folder.
The file
8:10 am, October 26, 2026
guid
https://thehackernews.com/2026/10/malicious-file-in-downloads-folder.html
source_url
https://thehackernews.com/2026/10/malicious-file-in-downloads-folder.html
id: 3791
uid: pMWn0
insdate: 2026-10-26 08:10:05
title: Malicious File in Downloads Folder Tries to Trick AI Coding Agent Into Installing Malware
additional: A malicious instruction file sitting in a developer's Downloads folder tried to make their AI coding agent install a known-malicious npm package, security firm Forever Security said in a report published last week.
The company caught the attempt on a real customer's machine and stopped the agent before any code ran. It could not determine how the file got into the folder.
The file
category: Cybersecurity
md5:
guid: https://thehackernews.com/2026/10/malicious-file-in-downloads-folder.html
source_url: https://thehackernews.com/2026/10/malicious-file-in-downloads-folder.html
updated:
image:
author_name:
author_link:
uid: pMWn0
insdate: 2026-10-26 08:10:05
title: Malicious File in Downloads Folder Tries to Trick AI Coding Agent Into Installing Malware
additional: A malicious instruction file sitting in a developer's Downloads folder tried to make their AI coding agent install a known-malicious npm package, security firm Forever Security said in a report published last week.
The company caught the attempt on a real customer's machine and stopped the agent before any code ran. It could not determine how the file got into the folder.
The file
category: Cybersecurity
md5:
guid: https://thehackernews.com/2026/10/malicious-file-in-downloads-folder.html
source_url: https://thehackernews.com/2026/10/malicious-file-in-downloads-folder.html
updated:
image:
author_name:
author_link:
Add Comment
AI Testing
Page Views
This page has been viewed 2 times.
Search cybersec
Category List cybersec
- Cybersecurity
- "City-Forum" data-theft attacks target Salesforce, ServiceNow portals
- "Comment stuffing" in an HTML phishing attachment as a mechanism for evading AI-based detection?, (Fri, Jul 10th)
- $13.74M Hack Shuts Down Sanctioned Grinex Exchange After Intelligence Claims
- $285 Million Drift Hack Traced to Six-Month DPRK Social Engineering Operation
- [GUEST DIARY] Tearing apart website fraud to see how it works., (Wed, May 13th)
- [Guest Diary] New Malware Libraries means New Signatures, (Fri, May 15th)
- [Guest Diary] Beyond Cryptojacking: Telegram tdata as a Credential Harvesting Vector, Lessons from a Honeypot Incident, (Wed, Apr 22nd)
- [Guest Diary] Compromised DVRs and Finding Them in the Wild, (Thu, Apr 16th)
- _HELP_ME_ESCAPE_FROM_BELARUS_PLEASE_ [Guest Diary], (Tue, Jul 7th)
- 'Ghostcommit' hides prompt injection in images to fool AI agents, steal secrets
- 'NoVoice' Android malware on Google Play infected 2.3 million devices
- (Reliable)? php2shell exploitability, (Fri, Oct 23rd)
- /proxy/ URL scans with IP addresses, (Mon, Mar 16th)
- 100+ Compromised Websites Use Fake Cloudflare Checks to Deliver LunexStealer
- 101 Malicious npm Packages Add Developers' WhatsApp Accounts to Groups Without Consent
- 108 Malicious Chrome Extensions Steal Google and Telegram Data, Affecting 20,000 Users
- 11 Old Microsoft-Signed Linux UEFI Shims Could Let Attackers Bypass Secure Boot
- 13 Malicious Packagist Packages Target Unpatched iPhones to Steal Crypto Wallet Seeds
- 13-year-old bug in ActiveMQ lets hackers remotely execute commands
- 14 Trojanized npm Packages Drop RedC2 4.0 Linux Backdoor With AI-Assisted C2
- 144 Mastra npm Packages Compromised via Hijacked Contributor Account
- 148 npm Packages Disguised as Student Proxies Turned Browsers Into a DDoS Botnet
- 149 Hacktivist DDoS Attacks Hit 110 Organizations in 16 Countries After Middle East Conflict
- 15-Year-Old GhostLock Flaw Enables Root and Container Escape on Most Linux Distros
- 15-year-old detained over French govt agency data breach
- 152 Chrome Wallpaper Extensions with 105K Installs Linked to Adware and Fake Traffic
- 16 Malicious Firefox Extensions Pose as Rabby and OKX Wallets to Steal Recovery Phrases
- 16 Typosquatted RubyGems Packages Steal Browser Credentials and Crypto Wallets
- 16-Year-Old Linux KVM Flaw Lets Guest VMs Escape to Host on Intel and AMD x86 Systems
- 17,000 URLs Reveal How ClickFix Turns Trusted Websites Into Malware Traps: Report by CTM360
- 18 Malicious npm Packages Deliver Cross-Platform RAT to Alibaba Tool Users
- 18-Year-Old Linux SCTP Flaw Could Let Local Users Gain Root and Escape Containers
- 18-Year-Old NGINX Rewrite Module Flaw Enables Unauthenticated RCE
- 18-year-old NGINX vulnerability allows DoS, potential RCE
- 19 Chrome and Edge Extensions Found With Wallet-Stealing and Crypto-Draining Code
- 19-Year-Old Scattered Spider Suspect Extradited to Face U.S. Hacking Charges
- 20+ Hijacked Government Websites Became an Attack Channel
- 2026 Browser Data Reveals Major Enterprise Security Blind Spots
- 2026 Cybersecurity Assessment: The Gap Between Awareness and Resilience
- 2026: The Year of AI-Assisted Attacks
- 22 BRIDGE:BREAK Flaws Expose 20,000 Lantronix and Silex Serial-to-IP Converters
- 22 BRIDGE:BREAK Flaws Expose Thousands of Lantronix and Silex Serial-to-IP Converters
- 22 Seconds to Compromise: How Automated SSH Actors Move From Login to Persistence Before You Can Blink [Guest Diary], (Thu, Aug 6th)
- 220 million traveler records exposed in Vietnam-linked APIS leak
- 236,000 DCloud Uni-App Sites Used in Crypto Scams, Phishing, and Wallet Drainers
- 23andMe to pay $18 million in new genetics data breach settlement
- 24 npm Packages Abuse unpkg Mirrors to Host Fake Cloudflare CAPTCHA Pages
- 24,650 Internet-Exposed BMCs Disclose IPMI Password Hashes Before Login
- 26 FakeWallet Apps Found on Apple App Store Targeting Crypto Seed Phrases
- 282 iOS AI Apps Leak API Keys and Open AI Proxy Access in Network Traffic Study
- 29-Year-Old Squid Proxy Bug 'Squidbleed' Can Leak Cleartext HTTP Requests
- 3 Reasons Attackers Are Using Your Trusted Tools Against You (And Why You Don’t See It Coming)
- 3 SOC Process Fixes That Unlock Tier 1 Productivity
- 3 SOC Steps that Shut Down Incident Risks Early
- 3 Ways AI Powers Service Desk Attacks and How to Prevent Them
- 30,000 Facebook Accounts Hacked via Google AppSheet Phishing Campaign
- 36 Malicious npm Packages Exploited Redis, PostgreSQL to Deploy Persistent Implants
- 39 New Methods That Compromise Passkey Authentication
- 3BB Attacker Used MeshCentral Backdoor for Root Access, Targeted Subscriber Credentials
- 40 Malicious Firefox Extensions Pose as Web3 Products to Steal Wallet Secrets
- 400+ Arch Linux AUR Packages Hijacked to Install Rust Credential Stealer
- 5 Learnings from the First-Ever Gartner Market Guide for Guardian Agents
- 5 Places where Mature SOCs Keep MTTR Fast and Others Waste Time
- 5 Steps to Managing Shadow AI Tools Without Slowing Down Employees
- 5 Ways Zero Trust Maximizes Identity Security
- 5 reasons Microsoft 365 backup isn’t enough for business data protection
- 54 EDR Killers Use BYOVD to Exploit 34 Signed Vulnerable Drivers and Disable Security
- 54 EDR Killers Use BYOVD to Exploit 35 Signed Vulnerable Drivers and Disable Security
- 545 Hackers Tested It First. Now XRanges for AI Scores Your Security Agent
- 6 Reasons Why Device Code Phishing is the Fastest-Growing Threat of 2026
- 68-year-old imprisoned after making $1.3 million by pirating IPTV services
- 7 Ways to Prevent Privilege Escalation via Password Resets
- 7-Eleven confirms data breach claimed by the ShinyHunters gang
- 7-Eleven data breach exposes personal information of 185,000 people
- 73 Seconds to Breach, 24 Hours to Patch: The Case for Autonomous Validation
- 73% of Organizations Say They Are Not Fully Ready for a Major Cyberattack
- 737 Chrome VPN Extensions Caught Routing Traffic Through Proxies. Check If You Have One
- 77 Open VSX extensions found harvesting developer info
- 80,000+ Organizations Had AI Logins Stolen: From Shadow AI to LLMjacking
- 9 Critical IP KVM Flaws Enable Unauthenticated Root Access Across Four Vendors
- 9-Year-Old Linux Kernel Flaw Enables Root Command Execution on Major Distros
- A .WAV With A Payload, (Tue, Apr 21st)
- A Closer Look at Malware From the Macfinger ClickFix Campaign, (Fri, Sep 25th)
- A Glimpse into the “Search Your Target” Market for Stolen Credentials
- A Leaked GitLab Issue Email Address Lets Anyone Push Code and Run CI Jobs as You
- A Little Bit Pivoting: What Web Shells are Attackers Looking for?, (Tue, Apr 7th)
- A Malicious SIM Card Can Run Attacker Code Inside the Modems Behind Cellular IoT Devices
- A Malicious Webpage Could Poison Your Local AI Model Behind NVIDIA NemoClaw
- A React-based phishing page with credential exfiltration via EmailJS, (Fri, Mar 13th)
- A Record-Breaking Patch Tuesday for June 2026
- A polymorphic phishing page (that occasionally breaks itself), (Thu, Aug 27th)
- ACR Stealer Uses ClickFix Lures to Steal Browser Tokens and Microsoft 365 Files
- ADT confirms data breach after ShinyHunters leak threat
- AI "Mind Viruses" Can Spread Between Agents Through Persistent Prompt Files
- AI 'watermark removers' flood the web. Almost none can prove they work.
- AI Agent Exploits Langflow RCE to Automate Database Ransomware Attack
- AI Agent Uncovers 21 Zero-Days in FFmpeg; Chrome Patches Record 429 Bugs
- AI Agents Are Rewriting the Rules of Lateral Movement
- AI Agents Broke the Security Playbook. Here's What Replaces It.
- AI Agents: The Next Wave Identity Dark Matter - Powerful, Invisible, and Unmanaged
- AI Attacks Move in Minutes. Join This Webinar on Building a Defense That Keeps Up
- AI Broke Vulnerability Management. That's Why CISOs Are Moving Budget to BAS.
- AI Can Find Bugs, But Human Knowledge Still Proves Them
- AI Changed the Exposure Problem. Validation Needs to Change With It.
- AI Chatbot Recommendations Redirect Users to Cryptojacking Malware Sites
- AI Coding Agents Exposed 13,000 Internal Images, Including Billing Records, on GitHub
- AI Coding Agents Found Triggering Endpoint Security Rules Built to Catch Attackers
- AI Decision Models and Their Impact on AI SOC Platforms
- AI Flaws in Amazon Bedrock, LangSmith, and SGLang Enable Data Exfiltration and RCE
- AI Is Accelerating Vulnerability Discovery. Can Defenders Keep Up?
- AI Phishing Is Crushing SOCs with Alert Volume: How to Reduce Tier 1 Overload
- AI Recommendation Poisoning: How "Ask AI" Buttons Silently Alter LLM Memory
- AI coding agents hijacked using AGENTS.md file in Downloads folder
- AI is Everywhere, But CISOs are Still Securing It with Yesterday's Skills and Tools, Study Finds
- AI's Third Wave: Coworkers Break the Security Model That Worked for Agents
- AI-Assisted HTTP Terminator Finds Novel HTTP Desync Techniques and Apache Zero-Day
- AI-Driven Exploitation is Destroying Vulnerability Management. Here’s How to Handle It.
- AI-Driven Pushpaganda Scam Exploits Google Discover to Spread Scareware and Ad Fraud
- AI-Found Linux Kernel Flaw Gives Local Users Root, and Can Break a Guest Out to the Host
- AI-Generated Browser Ransomware Abuses Chromium API on Windows and Android
- AI-Generated Exploit Scripts Target Siemens S7 PLCs in U.S. Critical Infrastructure
- AI-Generated Fake Login Pages Are Making Account Takeovers Easier
- AI-built ransomware toolkit automates EDR evasion, AD discovery
- AI-generated Slopoly malware used in Interlock ransomware attack
- AI-powered attack exploited PaperCut flaws to hack 395 organizations
- APT28 Deploys PRISMEX Malware in Campaign Targeting Ukraine and NATO Allies
- APT28 Uses BEARDSHELL and COVENANT Malware to Spy on Ukrainian Military
- APT28 hackers deploy customized variant of Covenant open-source tool
- APT28-Linked Campaign Deploys BadPaw Loader and MeowMeow Backdoor in Ukraine
- APT28-Linked HOOKEDGE Backdoor Targets European Government and Diplomatic Organizations
- APT41-Linked Silver Dragon Targets Governments Using Cobalt Strike and Google Drive C2
- ARTEX AI Pentesting Tool Used in Data Theft Attacks on South Korean Financial Firms
- ARTEX AI, Claude agents used in cyberattacks on South Korean banks
- ARToken PhaaS exposes EvilTokens' Microsoft 365 phishing toolkit
- ASOS confirms data breach after “HACKED” in-app notifications
- ASOS links data breach to social engineering attack, credential theft
- ATF confirms “major incident” after recent Qilin breach claims
- AWS Kiro Flaw Let a Poisoned Web Page Rewrite Its Config and Run Code
- AWS, Google, and Vercel Agent Flaws Let Attackers Trigger Tools Without Running the Model
- Abandoned Popcorn Time app exposed millions of device to RCE attacks
- Abandoned Popcorn Time app exposed millions of devices to RCE attacks
- Abbott Laboratories probes two cyber incidents amid extortion claims
- Abbott probes two cyber incidents amid extortion claims
- Accenture confirms breach after hacker offers stolen data for sale
- Acer working to patch max severity zero-days in Wave 7 routers
- Acronis cPanel Backup Plugin Vulnerability Exploited in Targeted Attacks
- Acronis warns of actively exploited flaw in its cPanel backup plugin
- Active Exploitation Attempts Target WSO2 API Manager JWT Bypass With Forged Admin Tokens
- Actively Exploited Oracle WebLogic Flaw Lets Unauthenticated Attackers Access Critical Data
- Actively Exploited nginx-ui Flaw (CVE-2026-33032) Enables Full Nginx Server Takeover
- Actively exploited Apache ActiveMQ flaw impacts 6,400 servers
- AdaptHealth confirms 4.1 million people exposed in July cyberattack
- Adding some Automation to the favicon.ico method of Host Recon, (Mon, Jun 29th)
- Adobe Acrobat Extension Flaw Let Malicious Sites Read WhatsApp Web Data
- Adobe Campaign Classic CVSS 10.0 Flaw Could Run Code Without User Interaction
- Adobe Chrome extension flaw let sites access private WhatsApp chats
- Adobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic Emerges
- Adobe Fixes 8 Critical Campaign Classic Flaws Allowing Code Execution and Security Bypass
- Adobe Patches 7 CVSS 10.0 Flaws in ColdFusion and Campaign Classic
- Adobe Patches Actively Exploited Acrobat Reader Flaw CVE-2026-34621
- Adobe Patches Magento Zero-Day Exploited to Deploy Rust Backdoor and PHP Web Shell
- Adobe Patches Three CVSS 10.0 ColdFusion and Campaign Classic Flaws
- Adobe Reader Zero-Day Exploited via Malicious PDFs Since December 2025
- Adobe fixes critical Magento zero-day exploited to backdoor servers
- Adobe patches seven max severity ColdFusion, Campaign flaws
- Adobe rolls out emergency fix for Acrobat, Reader zero-day flaw
- Advantest confirms personal information stolen in ransomware attack
- Adversarial Exposure Validation Turns Security Visibility into Confident Prioritization
- Adversaries Exploit Vacant Homes to Intercept Mail in Hybrid Cybercrime
- Aesto Health says data breach affects over 9.5 million patients
- After Mythos: New Playbooks For a Zero-Window Era
- After the Break-In: What Attackers Do Once They're Already Inside
- Agent AI is Coming. Are You Ready?
- Agentic AI Has an Identity Problem and Attackers Know It
- Agentic AI Is Transforming Defense, But Only Secure IT Infrastructure Will Maximize It
- Agentic AI: The Weapon That No Longer Needs a Warrior
- Agentic GRC: Teams Get the Tech. The Mindset Shift Is What's Missing.
- Agentjacking Attack Tricks AI Coding Agents Into Running Malicious Code
- Ahold Delhaize: Cyberattack affects services across US and Europe
- AhsayCBS Flaws Exploited to Deploy Web Shells Get New Fixes After Incomplete Patches
- AirDrop and Quick Share Flaws Let Nearby Attackers Trigger Crashes and Bypass Checks
- AitM Phishing Targets TikTok Business Accounts Using Cloudflare Turnstile Evasion
- Ajax football club hack exposed fan data, enabled ticket hijack
- Akira hackers disable EDR with Safe Mode, steal data but fail to encrypt
- Alabama man pleads guilty to hacking, extorting hundreds of women
- Alby Hub Critical Flaw Could Let Attackers Take Over Internet-Exposed Bitcoin Wallets
- Alleged Kimwolf Botmaster ‘Dort’ Arrested, Charged in U.S. and Canada
- Alleged Scattered Spider hacker extradited to the United States
- Alleged Silk Typhoon hacker extradited to US for cyberespionage
- Alleged TeamPCP Hackers Charged in Australia Over Major Supply Chain Attacks
- Alleged dev of Ploutus ATM malware appears in US court after arrest
- Amadey and StealC Malware Network Disrupted, 27M Stolen Credentials Recovered
- Amadey, StealC malware operations disrupted in Operation Endgame action
- Amazon Kiro Prompt Injection Can Exfiltrate Sensitive Data Through Kiro Powers
- Amazon Links Debug and Chalk npm Hijack to North Korea’s Sapphire Sleet
- Amazon Q Developer Flaw Could Let Malicious Repos Run Code via MCP Configs
- Amazon SES increasingly abused in phishing to evade detection
- Amazon fined $2.25M for withholding evidence from fraud victims
- Amazon links Debug, Chalk NPM supply-chain attacks to North Korean hackers
- Amazon says PHP2Shell exploitation began 4 days before patches
- Amazon: Drone strikes damaged AWS data centers in Middle East
- American Organizations Under Attack: Skyw4lker Device Code Phishing Campaign Exposed
- American utility firm Itron discloses breach of internal IT network
- Americans sentenced for running 'laptop farms' for North Korea
- Amgen says cloud data breach exposed patient health, proprietary info
- An AI Agent Found a Critical OTP Bypass in Production. The Attack Was the Easy Part.
- An AI SOC Evaluation Guide for Security Leaders
- An Abandoned CDN Domain Was Re-Registered. Thousands of Sites Still Call It.
- An Adaptive Cyber Analytics UI for Web Honeypot Logs [Guest Diary], (Wed, May 6th)
- An Example of Stack String in High Level Language, (Sat, May 23rd)
- Analog Devices discloses data breach, says operations unaffected
- Analysis of 216M Security Findings Shows a 4x Increase In Critical Risk (2026 Report)
- Analysis of a Year of Files Uploaded to DShield Sensors, (Wed, May 27th)
- Analysis of one billion CISA KEV remediation records exposes limits of human-scale security
- Analyzing "Zombie Zip" Files (CVE-2026-0866), (Wed, Mar 11th)
- Android 17 Adds OS-Wide ECH to Hide Website Visits From Network Providers
- Android 17 Advanced Protection Locks Accessibility Services to Verified Accessibility Tools
- Android 17 Blocks Non-Accessibility Apps from Accessibility API to Prevent Malware Abuse
- Android 17 adds ECH support to make web browsing harder to track
- Android 17 to expand banking scam call and privacy protections
- Android Adds Intrusion Logging for Sophisticated Spyware Forensics
- Android Car Malware Spreads Through Built-In Updaters for Ad Fraud, Proxy Botnet
- Android Developer Verification Rollout Begins Ahead of September Enforcement
- Android Spyware Asin Targets Arabic Users via Fake News, PDF and War Map Apps
- Android gets AI defenses against messaging scams, fake calls
- Android gets patches for Qualcomm zero-day exploited in attacks
- Android malware combo takes out loans and relays victims' credit cards
- AnonyMousKIT PhaaS uses voice AI agents to phish iPhone passcodes
- Another Universal Linux Local Privilege Escalation (LPE) Vulnerability: Dirty Frag, (Fri, May 8th)
- Anthropic Cuts Live Internet Access for Internal AI Tests After Claude Exploits Injection Flaws
- Anthropic Discloses Fourth AI Hacking Incident Involving Claude Opus 4.6
- Anthropic Expands Claude Access for Vetted Cyber Teams as Glasswing Finds 129,000 Flaws
- Anthropic Finds 22 Firefox Vulnerabilities Using Claude Opus 4.6 AI Model
- Anthropic Launches Free AI Vulnerability Scanner for Open-Source Projects
- Anthropic MCP Design Vulnerability Enables RCE, Threatening AI Supply Chain
- Anthropic Releases Claude Fable 5, Its Most Powerful AI Yet, With Cyber Safeguards
- Anthropic Restores Claude Fable 5 After U.S. Lifts Jailbreak-Linked Export Controls
- Anthropic Says Claude Mistook the Open Internet for a CTF and Breached Three Organizations
- Anthropic Says Seven China-Based AI Labs Ran Industrial-Scale Claude Distillation Attacks
- Anthropic Warns Small AI Models Could Soon Form Self-Propagating IoT Botnets
- Anthropic and OpenAI Models Still Attempt Restricted Actions in Safety Tests
- Anthropic asks Claude users to share voice data for AI model training
- Anthropic confirms Claude Mythos-class models will roll out to the public
- Anthropic confirms Claude is down in major outage affecting multiple services
- Anthropic confirms Claude is down worldwide
- Anthropic confirms Claude is down, multiple models affected
- Anthropic is cutting Claude Code's current weekly limits by 17%
- Anthropic is testing desktop-like Claude Cowork for mobile
- Anthropic rolls out Claude Fable 5, but it's available for a limited time
- Anthropic rolls out Sonnet 5 with near-Opus 4.8 performance at a lower price
- Anthropic rolls out up to $250 in free Claude Code credits, but only for cloud sessions
- Anthropic takes risky AI tests offline after models breach govt sites
- Anthropic to restore Claude Fable access on Wednesday
- Anthropic turns Claude into an AI marketplace with 2,000+ plugins and connectors
- Anthropic wants Claude to analyze your bank account and financial data
- Anthropic warns infostealer malware is hijacking Claude sessions to drain usage
- Anthropic warns self-replicating AI could spread to your smart devices
- Anthropic's Claude Mythos Finds Thousands of Zero-Day Flaws Across Major Systems
- Anthropic's Claude breached 3 orgs, uploaded PyPI malware during tests
- Anthropic's Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits
- Anthropic’s restricted Claude Mythos model may be coming to Claude Code
- Anti-DDoS Firm Heaped Attacks on Brazilian ISPs
- Anti-piracy coalition takes down AnimePlay app with 5 million users
- Antino Backdoor Uses Outlook and OneDrive for C2 in China-Nexus Espionage Campaign
- Anubis ransomware claims Coca-Cola Fairlife attack, threatens data leak
- Apache ActiveMQ CVE-2026-34197 Added to CISA KEV Amid Active Exploitation
- Apple Backports Fix for Exploited CoreGraphics Flaw to Older iPhones and iPads
- Apple CoreGraphics PoC Emerges as WhatsApp PDF Checks Hint at Possible Delivery Path
- Apple Emergency Patch for iOS 26, macOS26, macOS15 (CVE-2026-86950), (Mon, Sep 28th)
- Apple Emergency Patch for iOS 26/macOS26/macOS15 (CVE-2026-86950), (Mon, Sep 28th)
- Apple Expands iOS 18.7.7 Update to More Devices to Block DarkSword Exploit
- Apple Fixes Hide My Email Bug That Exposed Real Addresses in Mail Logs
- Apple Fixes WebKit Vulnerability Enabling Same-Origin Policy Bypass on iOS and macOS
- Apple Fixes iOS Flaw That Let FBI Recover Deleted Signal Messages
- Apple Issues Security Updates for Older iOS Devices Targeted by Coruna WebKit Exploit
- Apple Patches (almost) everything again. March 2026 edition., (Wed, Mar 25th)
- Apple Patches 30+ iOS, macOS, Safari Flaws, Including AI-Discovered WebKit Bugs
- Apple Patches Beats Studio Buds Flaw Letting Nearby Attackers Spy via Microphone
- Apple Patches CoreGraphics Flaw Possibly Exploited in Targeted Attacks
- Apple Patches Everything (July 2026), (Wed, Jul 29th)
- Apple Patches Everything, (Mon, May 11th)
- Apple Patches Exploited Notification Flaw, (Thu, Apr 23rd)
- Apple Patches for October 2026, (Mon, Oct 26th)
- Apple Patches iOS Flaw That Stored Deleted Signal Notifications in FBI Forensic Case
- Apple Patches iOS and macOS, (Mon, Aug 17th)
- Apple Plans Tighter macOS Full Disk Access Controls Over AI Agent Data Access
- Apple Screen Sharing Security, (Mon, Aug 17th)
- Apple Sends Lock Screen Alerts to Outdated iPhones Over Active Web-Based Exploits
- Apple Updates Everything, (Mon, Sep 14th)
- Apple Warns Older iPhones Vulnerable to Coruna, DarkSword Exploit Kit Attacks
- Apple account change alerts abused to send phishing emails
- Apple adds macOS Terminal warning to block ClickFix attacks
- Apple backports CoreGraphics zero-day patches to older iPhones
- Apple blocked over $11 billion in App Store fraud in 6 years
- Apple expands iOS 18 updates to more iPhones to block DarkSword attacks
- Apple fixes Beats Studio Buds flaw that let hackers spy on conversations
- Apple fixes bug that let the FBI recover deleted Signal messages
- Apple fixes iOS bug that retained deleted notification data
- Apple iCloud Private Relay Can Expose Real IPs Through WebKit Proxy Bypasses
- Apple patches CoreGraphics zero-day flaw exploited in attacks
- Apple patches older iPhones and iPads against Coruna exploits
- Apple pushes first Background Security Improvements update to fix WebKit flaw
- Apple sends new ‘Threat Notification’ alerts over mercenary spyware attacks
- Apple sued over fake App Store crypto wallet app stealing $1.8M in Bitcoin
- Application Control Bypass for Data Exfiltration, (Tue, Mar 31st)
- AppsFlyer Web SDK hijacked to spread crypto-stealing JavaScript code
- April KB5083769 Windows 11 update causes backup software failures
- April Patch Tuesday Fixes Critical Flaws Across SAP, Adobe, Microsoft, Fortinet, and More
- Arch Linux disables AUR package adoption to stop malware flood
- Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks
- Arista patches VeloCloud Orchestrator zero-day exploited in attacks
- Arista patches actively exploited VeloCloud Orchestrator zero-day
- Arista patches new VeloCloud Orchestrator zero-day exploited in attacks
- Armenia Detains Russian Tourist on U.S. Warrant for REvil Hacker, Lawyers Say Wrong Man
- Armored Likho Targets Government Agencies, Power Sector with BusySnake Stealer
- Artifactory flaws chained in attacks deploying backdoor malware
- AryStinger Malware Infects 4,300 Legacy Routers to Build Reconnaissance Proxy Network
- AryStinger botnet infected thousands of D-Link routers worldwide
- AssuranceAmerica data breach exposes records of 6.9 million drivers
- AsyncAPI npm packages infected with credential-stealing malware
- Atlassian Data Center Flaw Draws Exploitation Attempts Within Two Hours of Public Details
- Atlassian Rovo Can Be Tricked Into Sending Jira and Confluence Data to Attackers
- Atlassian warns of critical file-access flaw in Jira, Confluence
- Atomic MacOS (AMOS) stealer infection, (Sun, Aug 2nd)
- Attack Chains, Not Just Attack Surfaces: Why Testing Individual Techniques Misses the Point
- Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access, Only Two Patched So Far
- Attacker Hijacks AI Coding Assistant Session, Spreads Shai-Hulud Across About 100 Repositories
- Attacker Uses Suspected AI-Generated PowerShell Script to Map Active Directory
- Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix Lures
- Attackers Abuse MSP360 to Deploy ScreenConnect in Dual-RMM Phishing Attacks
- Attackers Abuse UpdraftCentral Keys to Plant Backdoors on WordPress Sites
- Attackers Breached JetBrains Cadence via Unpatched TeamCity, Extracting AWS Credentials
- Attackers Bypass WAFs to Exploit Oracle PeopleSoft Flaw and Deploy Web Shells
- Attackers Chain JFrog Artifactory Flaws to Gain Admin Control and Plant Backdoors
- Attackers Chain Two PaperCut Flaws to Execute Code Without Authentication
- Attackers Compile khunt Inside Oracle to Turn SQL Injection Into Windows SYSTEM Access
- Attackers Don't Just Send Phishing Emails. They Weaponize Your SOC's Workload
- Attackers Exploit 'Ill Bloom' Vulnerability to Drain $3.1 Million From Cryptocurrency Wallets
- Attackers Exploit 'Ill Bloom' Vulnerability to Drain Over $5 Million From Cryptocurrency Wallets
- Attackers Exploit AhsayCBS Flaws to Deploy XMRig Miners Disguised as Microsoft Edge
- Attackers Exploit Arista VeloCloud Orchestrator Command Injection Flaw
- Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE
- Attackers Exploit Critical JFrog Artifactory Flaw to Mint Admin Tokens Days After Disclosure
- Attackers Exploit Critical Langflow and Rails Flaws in Credential-Probing and C2 Activity
- Attackers Exploit Critical Switchvox Flaw to Deploy Reverse Shells Without Credentials
- Attackers Exploit Issabel Framework Flaw Enabling Unauthenticated OS Command Execution
- Attackers Exploit MLflow SSRF Flaw to Steal Cloud Credentials and Secrets
- Attackers Exploit NetScaler Flaw for Root Access, Deploy WHIPSHOT and SLAPSHOT
- Attackers Exploit PaperCut Flaws to Steal Credentials From Schools and Universities
- Attackers Exploit SharePoint Authentication Bypass After Public PoC Release
- Attackers Exploit SimpleHelp CVE-2026-48558 to Deploy TaskWeaver and Djinn Stealer
- Attackers Exploit Three Fortinet FortiSandbox Flaws, One Patched Last Week
- Attackers Exploit Two SonicWall SMA 1000 Zero-Days That May Form an Attack Chain
- Attackers Exploit VMware vCenter Vulnerability to Gain Persistent Remote Access
- Attackers Exploit WooCommerce Wholesale Lead Capture Flaw to Plant PHP Web Shells
- Attackers Exploit WordPress CVE-2026-87902 Within Hours of Disclosure
- Attackers Exploit Zimbra Flaw to Deploy Web Shells and Harvest Authentication Secrets
- Attackers Exploit Zimbra SNMP Flaw for Unauthenticated Remote Code Execution
- Attackers Heat French Supermarket Fridges Up to 50°C by Hijacking Danfoss Controllers
- Attackers Hijack .gh, .sl, and .as Registries to Obtain Certificates for Google Domains
- Attackers Hijack Dahua IP Cameras in Ukraine Using P2P Access and Auth Weaknesses
- Attackers Hijack MikroTik Routers Through Internet-Exposed SSH Without Authentication
- Attackers Hijacked Over 300 Tor Exit Relays to Intercept SSH Connections
- Attackers Steal METR API Key and Consume AI Credits Worth About $600,000
- Attackers Tampered with AOMEI Backupper's Update Servers for Minutes to Deliver a Backdoor
- Attackers Target Rejetto HFS Flaw That Enables Admin Session Forgery and RCE
- Attackers Target miniOrange SAML Flaws That Can Grant WordPress Admin Access
- Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks
- Attackers Use LLM Agent for Post-Exploitation After Marimo CVE-2026-39987 Exploit
- Attackers Use Malicious Terraform Providers to Deliver Go Malware via HashiCorp Registry
- Attackers Use Microsoft Teams IT Support Scams to Deploy Malware and Ransomware
- Attackers Use Passkey Phishing to Hijack Microsoft Cloud Accounts and Exfiltrate Data
- Attackers Weaponize GitHub Actions Runners to Target cPanel and WHM Servers
- Attackers conceal phishing lures using invisible Unicode characters
- Attempts to Exploit Exposed "Vite" Installs (CVE-2025-30208), (Thu, Apr 2nd)
- August updates trigger 0xc0000409 errors on Windows Server 2016
- Aura confirms data breach exposing 900,000 marketing contacts
- Aurora Ransomware Operators Use Cursor AI in Attacks Against 10 Targets
- Australia Gets Into Amadey Malware Backend, Cuts Off Access to 180,000 Infected Computers
- Australia arrests alleged TeamPCP hackers behind supply-chain attacks
- Australia warns of ClickFix attacks pushing Vidar Stealer malware
- Australia warns of global campaign targeting vulnerable CMS platforms
- Australian energy provider Origin says data breach exposes client data
- Authorities Disrupt SocksEscort Proxy Botnet Exploiting 369,000 IPs Across 163 Countries
- Authorities Turn Sality's P2P Network Against Itself, Cutting Off New Malware Payloads
- Authorities dismantle 'AudiA6' ransomware crypto-laundering service
- Authorities disrupt nearly 11,000 cybercrime networks in Africa
- Authorities disrupt router DNS hijacks used to steal Microsoft 365 logins
- AutoIT Payload Injector , (Tue, Jul 28th)
- AutoJack Attack Lets One Web Page Hijack AI Agent for Host Code Execution
- Automated AI agent used to breach cybersecurity nonprofit DIVD
- Autonomous AI Agents Compromise Thousands of Credentials in Under Six Hours
- Autonomous AI Tool Finds 2-Year-Old RCE Flaw in Redis (CVE-2026-23479)
- Autonomous AI agents tried to hack US, Canadian government websites
- Avada Builder WordPress plugin flaws allow site credential theft
- Axios Supply Chain Attack Pushes Cross-Platform RAT via Compromised npm Account
- Axios npm hack used fake Teams error fix to hijack maintainer account
- Azerbaijani Energy Firm Hit by Repeated Microsoft Exchange Exploitation
- Azure CLI Password Spray Hits at Least 78 Microsoft Accounts in 81M+ Attempts
- Azure Cosmos DB Flaw Exposed Platform-Wide Key That Could Access Any Database
- BAE Systems cyberattack disrupts US federal court operations
- BGP Hijack Delivers Malicious Virtualizor Update That Establishes Persistent Root Access
- BKA Identifies REvil Leaders Behind 130 German Ransomware Attacks
- BTMOB Android malware service generates custom phishing payloads
- Backdoored PyTorch Lightning package drops credential stealer
- Backdoored Smart Slider 3 Pro Update Distributed via Compromised Nextend Servers
- Backdoored Telnyx PyPI package pushes malware hidden in WAV audio
- BambooToken Malware Uses MQTT to Control Windows and Linux Systems
- BambooToken malware controls Windows and Linux systems via MQTT
- BdThemes Supply Chain Attack Poisons JSON to Create Rogue WordPress Admins
- BdThemes plugins supply-chain hack creates rogue WordPress admins
- Bearlyfy Hits 70+ Russian Firms with Custom GenieLocker Ransomware
- Bearlyfy Hits Russian Firms with Custom GenieLocker Ransomware
- BengalSEO Poisons Bing Search Results to Deliver MayaBot and Tech Support Scams
- Berlin Refuses to Pay Hackers Who Stole Data From the City's State Network
- Berlin confirms data theft after Rhysida ransomware attack claims
- Betterleaks, a new open-source secrets scanner to replace Gitleaks
- Between alerts: What Attackers Do in the Spaces Ordinary Detection Misses
- Beyond the Zero-Day: See Your Network Like an Attacker | Webinar with HD Moore
- BeyondTrust Patches Critical Auth Bypass Flaws in Remote Support and PRA
- BeyondTrust patches zero-day exploited in attacks since August
- BeyondTrust warns of critical flaws in remote access software
- BigBear Microsoft 365 phishing service bypassed MFA at 258 organizations
- BigCommerce alerts merchants of data breach linked to Ribon apps
- Bing AI promoted fake OpenClaw GitHub repo pushing info-stealing malware
- Bing Images Flaws Let Crafted SVGs Run Commands as SYSTEM on Microsoft's Servers
- Bitget Confirms Third-Party Zero-Day Behind $387.5 Million Cryptocurrency Theft
- Bitget Says Attacker Exploited Third-Party Security Product Flaw to Steal $388M
- Bitget Says Suspected North Korean Hackers Stole $351.6M After Backend Compromise
- Bitget hacked via zero-day in third-party security products
- Bitget resumes Bitcoin withdrawals after $387.5 million crypto heist
- Bitrefill blames North Korean Lazarus group for cyberattack
- Bitter-Linked Hack-for-Hire Campaign Targets Journalists Across MENA Region
- Bitwarden CLI Compromised in Ongoing Checkmarx Supply Chain Campaign
- Bitwarden CLI npm package compromised to steal developer credentials
- Bitwarden adds support for passkey login on Windows 11
- BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations
- BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot
- Blackfield ransomware asks Nidec Corporation for $2 million ransom
- Block the Prompt, Not the Work: The End of "Doctor No"
- BlueNoroff Zoom Phishing Kit Profiles Crypto Wallets Before Malware Delivery
- Bluekit phishing kit adopts browser-in-the-middle for login theft
- Boston Scientific says cyberattack disrupted operations globally
- Botnet Hunting for Vulnerabilities in Diagnostic Tools, (Tue, Aug 4th)
- BraZetsu Malware Turns Compromised Windows Hosts Into Criminal Marketplace Inventory
- BragJack attacks hijack AI browser agents through malicious extensions
- Brave Software releases Origin for a paid, bloat-free browsing experience
- Brave browser adds email aliases to help users evade tracking
- Brazilian LofyGang Resurfaces After Three Years With Minecraft LofyStealer Campaign
- Breach at the Beach: Play the Ultimate Entra ID CTF
- Breeze Comet Executes Hundreds of Fraudulent Transactions via Brazilian Payment Systems
- Brevo supply-chain attack injected ClickFix scripts on customer sites
- Bridging the AI Agent Authority Gap: Continuous Observability as the Decision Engine
- Bring Your Own Agent: Your Employees' Assistants Are Already Logged In
- British Scattered Spider hacker pleads guilty to crypto theft charges
- Broken VECT 2.0 ransomware acts as a data wiper for large files
- Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software
- Browser Extensions Are the New AI Consumption Channel That No One Is Talking About
- Bruteforce Scans for CrushFTP , (Tue, Mar 3rd)
- Bubble AI app builder abused to steal Microsoft account credentials
- Building a High-Impact Tier 1: The 3 Steps CISOs Must Follow
- Bullhorn takes staffing platform offline to contain cyberattack
- Burger King Japan data breach exposes 11 million customer records
- C0XMO botnet spreads via DD-WRT router flaw, kills rival malware
- CDN Tsunami Attack Abuses HTTP/3 Translation for Up to 350x DoS Amplification
- CERT-EU: European Commission hack exposes data of 30 EU entities
- CERT-In Mandates 12-Hour Patching for Internet-Facing Flaws Amid AI-Assisted Attacks
- CERT-In Recommends 12-Hour Patching for Internet-Facing Flaws Amid AI-Assisted Attacks
- CERT-In Warns AI Agents Accessed Sensitive Data at Indian Organizations During Testing
- CERT-UA Impersonation Campaign Spread AGEWHEEZE Malware to 1 Million Emails
- CERT/CC Warns of Hidden Admin Backdoor in Tenda Router Firmware
- CISA Adds 4 Actively Exploited Adobe, Joomla, and Langflow Flaws to KEV
- CISA Adds 4 Exploited Flaws to KEV, Sets May 2026 Federal Deadline
- CISA Adds 5 Actively Exploited Artifactory, ScreenConnect, and RouterOS Flaws to KEV
- CISA Adds 6 Known Exploited Flaws in Fortinet, Microsoft, and Adobe Software
- CISA Adds 8 Exploited Flaws to KEV, Sets April-May 2026 Federal Deadlines
- CISA Adds Actively Exploited ConnectWise and Windows Flaws to KEV
- CISA Adds Actively Exploited Linux Root Access Bug CVE-2026-31431 to KEV
- CISA Adds Actively Exploited SolarWinds Serv-U DoS Flaw to KEV Catalog
- CISA Adds Actively Exploited VMware Aria Operations Flaw CVE-2026-22719 to KEV Catalog
- CISA Adds CVE-2025-53521 to KEV After Active F5 BIG-IP APM Exploitation
- CISA Adds Cisco SD-WAN CVE-2026-20182 to KEV After Admin Access Exploits
- CISA Adds Cisco, Chrome, and Arista Flaws to KEV Catalog Amid Active Exploitation
- CISA Adds Exploited Cisco Catalyst SD-WAN Manager Auth Bypass to KEV
- CISA Adds Exploited Langflow and Trend Micro Apex One Vulnerabilities to KEV
- CISA Adds Exploited Magento RCE Flaw CVE-2026-45247 to KEV Catalog
- CISA Adds Exploited N-able N-central Flaw to KEV After Customer Compromises
- CISA Adds Exploited PTC Windchill RCE Flaw to KEV as Web Shell Attacks Continue
- CISA Adds Exploited SharePoint RCE Zero-Day CVE-2026-58644 to KEV
- CISA Adds Seven Exploited Flaws as Attackers Deploy Reverse Shells and Crypto Miners
- CISA Adds Six Exploited Flaws to KEV, Including NetScaler, Linux, and SQL Server Bugs
- CISA Admin Leaked AWS GovCloud Keys on Github
- CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution
- CISA Flags Actively Exploited Ray Flaw That Can Trigger Browser-Based RCE
- CISA Flags Actively Exploited Wing FTP Vulnerability Leaking Server Paths
- CISA Flags Actively Exploited n8n RCE Bug as 24,700 Instances Remain Exposed
- CISA Flags Apple, Craft CMS, Laravel Bugs in KEV, Orders Patching by April 3, 2026
- CISA Flags Exploited Cisco, Citrix, Fortinet Flaws, Sets Sept. 12 Federal Patch Deadline
- CISA Flags Langflow RCE, Tomcat, and N-central Flaws as Actively Exploited
- CISA Flags LiteSpeed cPanel Plugin Flaw Exploited for Root Privilege Escalation
- CISA Flags SolarWinds, Ivanti, and Workspace One Vulnerabilities as Actively Exploited
- CISA Flags TeamCity CVE-2026-63077 RCE Flaw Under Active Exploitation in the Wild
- CISA Flags Three Linux Kernel Vulnerabilities Exploited in the Wild
- CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud
- CISA Orders Federal Agencies to Patch Exploited Plex2Shell, Siemens, and SiteGuard Flaws
- CISA Red Team Compromised Two Critical Infrastructure Orgs, One Detected Nothing
- CISA Says Attackers Are Exploiting Two Critical Citrix NetScaler Flaws Globally
- CISA Urges Immediate Ivanti Connect Secure Updates as Honeypots Log 105 Exploit Attempts
- CISA Warns Critical Lantronix EDS5000 Flaw Is Being Actively Exploited
- CISA Warns Fortinet Customers as FortiBleed Hits 86,644 FortiGate Devices
- CISA Warns of Actively Exploited Joomla JCE Flaw Allowing PHP Code Execution
- CISA Warns of Zimbra, SharePoint Flaw Exploits; Cisco Zero-Day Hit in Ransomware Attacks
- CISA alerts of active exploitation of three Linux kernel flaws
- CISA confirms PHP2Shell vulnerabilities now exploited in attacks
- CISA flags Apache ActiveMQ flaw as actively exploited in attacks
- CISA flags VMware Aria Operations RCE flaw as exploited in attacks
- CISA flags Windows Task Host vulnerability as exploited in attacks
- CISA flags Wing FTP Server flaw as actively exploited in attacks
- CISA flags new SD-WAN flaw as actively exploited in attacks
- CISA flags two-year-old Oracle flaw as actively exploited in attacks
- CISA gives feds 3 days to patch Check Point VPN bug exploited as zero-day
- CISA gives feds 4 days to patch actively exploited cPanel plugin flaw
- CISA gives feds four days to patch Ivanti flaw exploited as zero-day
- CISA orders feds to patch BlueHammer flaw exploited as zero-day
- CISA orders feds to patch Citrix NetScaler RCE flaw by Saturday
- CISA orders feds to patch DarkSword iOS flaws exploited attacks
- CISA orders feds to patch Fortinet flaw exploited in attacks by Friday
- CISA orders feds to patch Windows flaw exploited as zero-day
- CISA orders feds to patch Zimbra XSS flaw exploited in attacks
- CISA orders feds to patch Zyxel flaw exploited for data theft
- CISA orders feds to patch actively exploited Citrix flaw by Thursday
- CISA orders feds to patch actively exploited Drupal vulnerability
- CISA orders feds to patch actively exploited Ivanti flaw by Sunday
- CISA orders feds to patch actively exploited Oracle flaw by Saturday
- CISA orders feds to patch actively exploited TrueConf Server flaws
- CISA orders feds to patch exploited Citrix flaws by Wednesday
- CISA orders feds to patch exploited Fortinet EMS flaw by Friday
- CISA orders feds to patch exploited Ivanti EPMM flaw by Sunday
- CISA orders feds to patch max severity ColdFusion flaw by Friday
- CISA orders feds to patch max severity Joomla plugin flaw by Friday
- CISA orders feds to patch max-severity Cisco flaw by Sunday
- CISA orders feds to patch n8n RCE flaw exploited in attacks
- CISA orders feds to prioritize patching Langflow auth bypass flaw
- CISA orders urgent action on actively exploited Langflow RCE flaw
- CISA orders urgent patching of actively exploited Zimbra flaw
- CISA says ‘Copy Fail’ flaw now exploited to root Linux systems
- CISA sets urgent deadline to fix Cisco flaw exploited in attacks
- CISA shares advice on isolating vital systems during cyberattacks
- CISA tells govt agencies to patch critical exploited flaws in 3 days
- CISA urges US orgs to secure Microsoft Intune systems after Stryker breach
- CISA urges immediate action on actively exploited Fortinet flaws
- CISA warns Fortinet users to secure devices after FortiBleed leak
- CISA warns admins to immediately fix Ivanti flaw exploited as zero-day
- CISA warns admins to patch actively exploited SharePoint flaws
- CISA warns feds to patch iOS flaws exploited in crypto-theft attacks
- CISA warns of Apple flaws exploited in spyware, crypto-theft attacks
- CISA warns of Sharepoint, WSO2, Adobe Commerce flaws exploited in attacks
- CISA warns of active attacks exploiting Android, Linux bugs
- CISA warns of actively exploited RCE flaws in Joomla extensions
- CISA warns of another cPanel plugin flaw exploited in attacks
- CISA warns of critical pre-auth RCE flaw in MikroTik RouterOS
- CISA warns of cyberattacks disrupting U.S. water utilities
- CISA warns of cyberattacks targeting fuel tank monitoring systems
- CISA warns of hackers exploiting Langflow, N-central, Apache Tomcat flaws
- CISA warns of hackers exploiting critical MLflow vulnerability
- CISA warns of hackers now exploiting critical Node2Shell flaw
- CISA warns of max severity Ubiquiti flaws exploited in attacks
- CISA: Critical VMware RCE flaw now exploited by ransomware gangs
- CISA: Hackers chain Plex flaws in Plex2Shell attacks to breach servers
- CISA: Hackers now exploit SolarWinds Serv-U flaw to crash servers
- CISA: Hackers now exploit max severity GitLab flaw in attacks
- CISA: Medusa ransomware hit over 500 critical infrastructure orgs
- CISA: Microsoft SharePoint RCE flaw now actively exploited
- CISA: Microsoft SharePoint flaw now exploited in ransomware attacks
- CISA: New Langflow flaw actively exploited to hijack AI workflows
- CISA: Ransomware gangs now exploiting critical TeamCity flaw
- CISA: Recently patched Ivanti EPM flaw now actively exploited
- CISA: SafePay ransomware hit over 600 critical infrastructure orgs
- CISA: SonicWall SMA1000 flaws now exploited by ransomware gangs
- CISA: Splunk Enterprise flaw actively exploited, patch by Sunday
- CISA: WatchGuard RCE flaw now exploited in ransomware attacks
- CISA: Windows BlueHammer flaw now exploited by ransomware gangs
- CISA: Windows Task Host flaw now exploited by ransomware gangs
- CISO's Expert Guide to Agentic Pentesting for Websites
- CJIS v6.1 Compliance: 5 Practical Priorities for Agencies
- COLDCARD security audit phishing attack installs remote access tool
- COLDCARD wallet RNG flaw likely linked to $88 million Bitcoin theft
- CPUID Breach Distributes STX RAT via Trojanized CPU-Z and HWMonitor Downloads
- CPUID hacked to deliver malware via CPU-Z, HWMonitor downloads
- CTM360 Research Reveals How Insurance Phishing Has Evolved Into Real-Time Account Hijacking
- CVE-2024-40766: The Patch Fixed the Bug. Nobody Fixed the Configuration., (Tue, Jun 23rd)
- California AG sues 23andMe over 2023 breach exposing health data
- Calling viral AI actress Tilly Norwood? Agree to a face scan first
- Can You Prove a New CVE Is Exploitable Before Attackers Do? Learn How in This Webinar
- Can the Security Platform Finally Deliver for the Mid-Market?
- Can you enforce strong Active Directory password rules without frustrating users?
- Canada arrests three for operating “SMS blaster” device in Toronto
- Canada’s Spy Agency Used First-of-Its-Kind Warrant to Clean Botnet-Infected Devices
- Canadian Man Pleads Guilty in Snowflake Extortions
- Canadian pleads guilty to Snowflake cloud data-theft attacks
- Canadian retail giant Loblaw notifies customers of data breach
- Canvas Breach Disrupts Schools & Colleges Nationwide
- Canvas login portals hacked in mass ShinyHunters extortion campaign
- Capcom confirms data breach affecting 11.7 million accounts
- Captive Portal Detection, (Tue, Jul 21st)
- Carbonato Botnet Compromises Docker Hosts to Deploy Telegram-Controlled Hermes AI Agent
- Carhartt data breach exposes information of 12.9 million accounts
- Carnival Cruise confirms data breach affecting nearly 6 million people
- Casbaneiro Phishing Targets Latin America and Europe Using Dynamic PDF Lures
- Catch threats before they escalate with real-time Identity Telemetry
- Cavern C2 Uses DNS and Google Apps Script to Blend Into Legitimate Traffic
- CenterPoint Energy confirms customer data stolen in cyberattack
- Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller
- Certighost and the Privilege Hiding in Your Certificate Authority
- Chaos Ransomware Uses msaRAT to Route C2 Traffic Through Headless Chrome and Edge
- Charter Communications data breach affects 4.9 million accounts
- Charter confirms data breach after ShinyHunters extortion threat
- ChatGPT AgentForger Flaw Could Deploy Rogue Workspace Agents via a Phishing Link
- ChatGPT Astra is now rolling out to $20 Plus subscription
- ChatGPT Flaw Let a Planted Prompt Send a Victim's Gmail Data to Another Account
- ChatGPT can now connect to your personal apps to mimic writing style
- ChatGPT rolls out new $100 Pro subscription to challenge Claude
- ChatGPT share links abused to host fake outage pages to deliver malware
- ChatGPhish Vulnerability Turns ChatGPT Web Summaries Into a Phishing Surface
- Cheap Android TV Boxes Pose as Phones and Turn Owners’ Broadband Into Proxies
- Check Point Discloses Two 9.8-Rated VPN Certificate Flaws Enabling Unauthenticated RCE
- Check Point Patches Exploited SmartConsole Flaw Allowing Full Admin Access
- Check Point Warns of Management Server Zero-Day Exploited in Targeted Attacks
- Check Point links VPN zero-day attacks to Qilin ransomware gang
- Check Point warns of Management Server zero-day exploited in attacks
- Check Point warns of SmartConsole zero-day exploited in attacks
- Check Point warns of hackers exploiting Security Gateway VPN RCE flaw
- Checkmarx Confirms GitHub Repository Data Posted on Dark Web After March 23 Attack
- Checkmarx confirms LAPSUS$ hackers leaked its stolen GitHub data
- Chick-fil-A data breach affects more than 13,000 customers
- Chick-fil-A discloses data breach after credential stuffing attacks
- China's Apple App Store infiltrated by crypto-stealing wallet apps
- China-Aligned Bronze Sandcastle Abuses Sandboxie DLL Sideloading to Deploy Backdoors
- China-Aligned FamousSparrow Deploys SparroWocky Backdoor Across Latin America
- China-Aligned Groups Ramp Up Attacks: Dragon Weave Hits Czech Republic & Taiwan
- China-Aligned TA419 Targets U.S. AI Policy Experts With Microsoft AitM Phishing
- China-Linked Fire Ant Hijacks Cisco Routers to Steal Credentials and Blind Security Logs
- China-Linked GopherWhisper Infects 12 Mongolian Government Systems with Go Backdoors
- China-Linked Hackers Backdoored Linux Login Software to Hide for Nearly a Decade
- China-Linked Hackers Deploy New StormEncryptor Ransomware, Likely via N-central Flaw
- China-Linked Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy GRIMWEDGE
- China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers
- China-Linked Hackers Target Asian Governments, NATO State, Journalists, and Activists
- China-Linked Hackers Use ARTEX AI Agents in ConnectWise Supply Chain Attack
- China-Linked Hackers Use TernDoor, PeerTime, BruteEntry in South American Telecom Attacks
- China-Linked JDY Botnet Expands to 1,500+ Devices for Cyber Reconnaissance
- China-Linked Red Menshen Uses Stealthy BPFDoor Implants to Spy via Telecom Networks
- China-Linked SprySOCKS Backdoor Expands to Windows with Driver-Based Stealth
- China-Linked Storm-1175 Exploits Zero-Days to Rapidly Deploy Medusa Ransomware
- China-Linked TA416 Targets European Governments with PlugX and OAuth-Based Phishing
- China-Linked TA4922 Expands Phishing Attacks to U.K., Germany, Italy, and South Africa
- China-Linked TA4922 Expands Phishing Attacks to UK, Germany, Italy, and South Africa
- China-Linked UAT-7810 Expands ORB Network With New LONGLEASH Malware
- China-Linked UAT-8302 Targets Governments Using Shared APT Malware Across Regions
- China-Linked UNC3569 Exploited Sogou Input Method Flaw to Deploy GRAYRABBIT Backdoor
- China-Made ZBT Routers Ship With Two Implants Giving Unauthenticated Attackers Root Access
- China-Nexus JadeProx Uses New TriBack Loader in Government and Healthcare Attacks
- China-linked JDY botnet expands targeting of U.S. military networks
- Chinese APT deploys new malware to keep access to hacked networks
- Chinese Fire Ant hackers turn Cisco routers into spying platforms
- Chinese Hacker Commands DeepSeek via Telegram to Launch Autonomous Attacks
- Chinese Hackers Abused Google Workspace Rules to Steal Research and Defense Emails
- Chinese Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy CLEANGULP Malware
- Chinese Hackers Target Southeast Asian Militaries with AppleChris and MemFun Malware
- Chinese Silk Typhoon Hacker Extradited to U.S. Over COVID Research Cyberattacks
- Chinese Threat Actor Uses Leaked DarkSword Kit to Deploy GHOSTBLADE on iOS
- Chinese hackers breach REDCap servers, steal medical research
- Chinese hackers develop LONGLEASH malware to expand ORB network
- Chinese hackers exploit WordPress, Zyxel flaws to steal govt data
- Chinese hackers hijack auth flow, spy on isolated network for a decade
- Chinese hackers target telcos with new Linux, Windows malware
- Chinese hackers use SparroWocky malware in govt espionage attacks
- Chinese hackers use new Atlas RAT malware in European cyberattacks
- Chinese man extradited for role in $36 million cryptocurrency scam
- Chinese state hackers target telcos with new malware toolkit
- Chinese-Made Zbtlink Routers Ship With Backdoor That Opens Unauthenticated Root Shells
- Chinese-Speaking APT Deploys New TinyRCT Backdoor in Southeast Asia Campaign
- ChocoPoc malware delivered via trojanized exploits on GitHub
- Chrome Ad Blocker with 10M+ Installs Found with Dormant Script Injection Capability
- Chrome Extension Turns Malicious After Ownership Transfer, Enabling Code Injection and Data Theft
- Chrome V8 Zero-Day CVE-2026-11645 Exploited in the Wild - Patch Now
- Chrome V8 Zero-Day Exploited in the Wild Enables Code Execution Inside Sandbox
- Chrome Web Store extensions caught stealing crypto, browser data
- Cisco ASA and FTD Flaw Exploited in the Wild Can Trigger Remote DoS
- Cisco Catalyst SD-WAN Controller Auth Bypass Actively Exploited to Gain Admin Access
- Cisco Catalyst SD-WAN Manager CVE-2026-20245 Flaw Actively Exploited – No Patch Available
- Cisco Catalyst SD-WAN Zero-Day CVE-2026-20245 Exploited to Gain Root Access
- Cisco Confirms Active Exploitation of Two Catalyst SD-WAN Manager Vulnerabilities
- Cisco FMC Flaws Exploited to Steal Credentials and Deploy Qilin Ransomware
- Cisco FMC Zero-Day Actively Exploited, Static Credentials Could Expose Sensitive Data
- Cisco FMC flaws exploited by ransomware gang, state-sponsored hackers
- Cisco Patches 12 SD-WAN and IOS XE Flaws, Including Three 9.8 CVSS Score Bugs
- Cisco Patches 12 SD-WAN and IOS XE Flaws, Including Three 9.9 CVSS Score Bugs
- Cisco Patches 9.8 CVSS IMC and SSM Flaws Allowing Remote System Compromise
- Cisco Patches CVE-2026-20230 in Unified CM as Exploit Code Goes Public
- Cisco Patches CVSS 10.0 Secure Workload REST API Flaw Enabling Data Access
- Cisco Patches Four Critical Identity Services, Webex Flaws Enabling Code Execution
- Cisco Patches Nine Crosswork and Secure Workload Flaws, Five Scoring CVSS 10.0
- Cisco Releases Security Updates for Actively Exploited SD-WAN Manager Flaw
- Cisco Secure Email Gateway Flaw Exploited in the Wild, Enables Root Command Execution
- Cisco Unified CM Flaw Exploited After PoC Reveals File-Write Path to Root
- Cisco Unified CM flaw CVE-2026-20230 now exploited in attacks
- Cisco Warns of Active Attacks Exploiting New Critical Secure Email Gateway Vulnerability
- Cisco Warns of Attackers Exploiting Critical Authentication Bypass in SD-WAN Manager
- Cisco confirms CVE-2026-20079 Secure FMC flaw exploited in attacks
- Cisco finally confirms attackers exploiting Unified CM flaw
- Cisco fixes SD-WAN vManage flaw exploited in zero-day attacks
- Cisco flags more SD-WAN flaws as actively exploited in attacks
- Cisco patches Secure Email Gateway zero-day exploited in attacks
- Cisco patches new Secure Email Gateway zero-day exploited in attacks
- Cisco says critical Webex Services flaw requires customer action
- Cisco source code stolen in Trivy-linked dev environment breach
- Cisco warns of ASA and FTD VPN flaw exploited to crash devices
- Cisco warns of FMC static credential flaw exploited in zero-day attacks
- Cisco warns of critical Unified CM flaw with PoC exploit code
- Cisco warns of critical flaws allowing Nexus switch takeover
- Cisco warns of high-severity ClamAV flaws with public exploits
- Cisco warns of max severity ISE zero-day exploited in attacks
- Cisco warns of max severity Secure FMC flaws giving root access
- Cisco warns of new SD-WAN zero-day exploited in attacks
- Cisco warns of new critical SD-WAN flaw exploited in zero-day attacks
- Cisco warns of unpatched SD-WAN zero-day exploited in attacks
- Citizen Lab Traces Zero-Click Candiru Spyware Infections at Al Jazeera to Targeted Online Ads
- Citizen Lab: Law Enforcement Used Webloc to Track 500 Million Devices via Ad Data
- Citrix NetScaler CVE-2026-88772 Exploit Details Show Pre-Auth Path to Shellcode Execution
- Citrix NetScaler Post-Exploitation Payload Creates Superuser, Maps Web Shell to CSS-Like URLs
- Citrix NetScaler Under Active Recon for CVE-2026-3055 (CVSS 9.3) Memory Overread Bug
- Citrix Patches Critical NetScaler Flaw That Could Enable RCE in SAML Deployments
- Citrix Patches Six NetScaler Flaws Allowing File Read and Denial-of-Service
- Citrix Urges Patching Critical NetScaler Flaw Allowing Unauthenticated Data Leaks
- Citrix admins warned to shut down NetScalers over 2 exploited zero-days
- Citrix confirms two NetScaler RCE zero-days exploited in attacks
- Citrix patches NetScaler SAML zero-day exploited in attacks
- Citrix urges admins to patch NetScaler flaws as soon as possible
- Citrix urges admins to patch new NetScaler flaws as soon as possible
- Citrix warns admins to patch new NetScaler RCE flaw immediately
- Cl0p Affiliates Target Internet-Exposed PTC Windchill and FlexPLM with Unauthenticated RCE
- Claimed Bug Bounty Hunter Likely Used LLM to Build PhantomRaven npm Stealer
- Claude AI Just Cracked a Post-Quantum Test Scheme and Found a Faster 7-Round AES Attack
- Claude AI finds Vim, Emacs RCE bugs that trigger on file open
- Claude Chrome extension flaw lets malicious extensions trigger AI actions
- Claude Code GitHub Action Flaw Let One Malicious Issue Hijack Repositories
- Claude Code Security and Magecart: Getting the Threat Model Right
- Claude Code Source Leaked via npm Packaging Error, Anthropic Confirms
- Claude Code and Gemini CLI Flaws Let a GitHub Issue Reach CI Workflow Secrets
- Claude Code leak used to push infostealer malware on GitHub
- Claude Code source code accidentally leaked in NPM package
- Claude Cowork Flaw Could Let AI Agent Escape Its VM and Access Mac Files
- Claude Extension Flaw Enabled Zero-Click XSS Prompt Injection via Any Website
- Claude Fable 5 isn’t permanently leaving subscriptions, Anthropic says
- Claude Fable 5 stays free for paid users until July 19 as Anthropic buys more time
- Claude Fable relaunch disappoints users with nerfed performance
- Claude Mythos 5 Tried to Backdoor a Real Open-Source Project in Testing, Then Vouched for Itself
- Claude Mythos AI Finds 10,000 High-Severity Flaws in Widely Used Software
- Claude Opus 4.6 Bypasses Gym Booking Limit, Cancels Other Users' Reservations in Tests
- Claude Opus 5 Helped Researchers Take Over OpenAI Staff Accounts via Chained Flaws
- Claude Opus 5.5 uses 95% fewer em dashes, but its answers are getting longer
- Claude Used to Automate Exploitation and Data Theft Across Multiple Victims
- Clean GitHub repo tricks AI coding agents into running malware
- Cleartext Passwords in MS Edge? In 2026?, (Mon, May 4th)
- ClickFix Attackers Exploit Siemens Software Center Flaw to Deploy Remote Access Trojan
- ClickFix Attacks Deliver macOS Stealer That Can Drain Crypto Wallets
- ClickFix Campaigns Expand Malware Delivery With New Loaders and Fake Update Lures
- ClickFix Campaigns Spread MacSync macOS Infostealer via Fake AI Tool Installers
- ClickFix Lures Deploy ChainScript RAT Using Polygon to Rotate C2 Infrastructure
- ClickFix Smuggles Payloads Through Browser Cache to Bypass Windows Run Limits
- ClickFix attack pushes macOS infostealer for crypto theft attacks
- ClickFix has never been bigger, and AI tools are its most convincing lure yet
- Clop created custom web shell for Windchill data theft attacks
- Clop ransomware targets Windchill, FlexPLM in data theft attacks
- Clop-Linked Windchill Web Shell Decrypts Credentials and Maps Engineering Data
- Closing the Identity Gaps in Critical Infrastructure Security
- CloudZ malware abuses Microsoft Phone Link to steal SMS and OTPs
- Cloudflare Fixes Flaw That Let One Container Read Another Customer's Leftover Disk Data
- Cloudflare Workers Spectre Attack Leaks JWT From Co-Located Worker at 12 Bits/Second
- Cloudflare fixes Containers cross-tenant flaw exposing customer data
- Coca-Cola confirms data theft in Fairlife ransomware attack
- Coca-Cola says Fairlife ransomware attack halts US dairy production
- Coder's registry infrastructure compromised to push malicious modules
- Cognizant TriZetto breach exposes health data of 3.4 million patients
- Cohere AI Terrarium Sandbox Flaw Enables Root Code Execution, Container Escape
- Coldcard Hardware Wallet Flaw Linked to $70 Million Bitcoin Theft in 41 Minutes
- Comcast turns your Xfinity WiFi into a home motion detector
- Compromised AsyncAPI npm Packages Deliver Multi-Stage Botnet Malware
- Compromised GitHub Actions Came Back Online and Resumed Executing Mini Shai-Hulud Malware
- Compromised MemTensor Packages Deliver sckit Credential Stealer via npm and PyPI
- Compromised Nx Console 18.95.0 Targeted VS Code Developers with Credential Stealer
- Compromised Site Management Panels are a Hot Item in Cybercrime Markets
- Compromised jscrambler 8.14.0 npm Release Drops Rust Infostealer During Install
- ConnectWise Resets Credentials as Cloud Backup Remains Offline After Security Incident
- ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants
- ConnectWise patches new flaw allowing ScreenConnect hijacking
- ConnectWise warns of new ScreenConnect flaw without patch
- ConsentFix and ClickFix: How Microsoft 365 Accounts are Hijacked in 3 Seconds
- ConsentFix v3 attacks target Azure with automated OAuth abuse
- Contagious Interview Campaign Compromises 30,000 Devices, Steals $10.71M in Crypto
- Conti ransomware gang member sentenced to 4 years in prison
- Continuing Scans for swagger.json, (Wed, Jun 3rd)
- Coordinated Cyberattack Targets 30+ Minnesota Water Systems as One Plant Goes Offline
- Cordyceps CI/CD Flaws Expose 300+ GitHub Repositories to Supply-Chain Attacks
- Corp MDM Spyware Targets Logistics Firms, Steals New SMS and Redirects Calls
- Coruna iOS Exploit Kit Uses 23 Exploits Across Five Chains Targeting iOS 13–17.2.1
- Coruna iOS Kit Reuses 2023 Triangulation Exploit Code in New Mass Attacks
- Coruna iOS exploit framework linked to Triangulation attacks
- Cosmetics giant Rituals discloses data breach affecting customers
- Cosmos EVM Flaw Exploited After Cosmos Labs Knew Every Blockchain Running It Was Vulnerable
- Council of Europe investigates ShinyHunters data breach claims
- Coupang hit with record $409 million data breach fine in Korea
- Court Filing Reveals Windows Device ID Helped FBI Trace Alleged Scattered Spider Hacker
- CrashStealer macOS Malware Uses Notarized Dropper to Pass Gatekeeper Checks
- Credential-Stealing GitHub Actions Workflows Planted in Tens of Thousands of Repositories
- Credit card theft campaign abuses Stripe to host stolen payment info
- Criminal IP Introduces AITEM as the Next Evolution of Attack Surface Management
- Criminal IP and Securonix ThreatQ Collaborate to Enhance Threat Intelligence Operations
- Critical 'HTTP2Shell' Brotli vulnerability triggers emergency patches
- Critical 16-Year-Old UEFI Flaw Can Run Code Before Secure Boot on Network-Booting Servers
- Critical Apache HTTP/2 Flaw (CVE-2026-23918) Enables DoS and Potential RCE
- Critical Atlassian Flaw Lets Unauthenticated Attackers Read Known Files Across 8 Products
- Critical Avada WordPress theme flaw enables zero-click RCE
- Critical Bifrost AI Gateway Flaw Lets Attackers Run Commands Without Credentials
- Critical BlockStrap flaw lets hackers run code on Magento servers
- Critical Check Point Management Flaw Lets Unauthenticated Attackers Run Code as Root
- Critical Check Point VPN Flaw Exploited to Bypass Passwords in IKEv1 Setups
- Critical Cisco IMC auth bypass gives attackers Admin access
- Critical Cisco Nexus 9000 Flaw Lets Unauthenticated Remote Attackers Run Code as Root
- Critical Citrix NetScaler auth bypass now leveraged in attacks
- Critical Citrix NetScaler memory flaw actively exploited in attacks
- Critical Cursor Flaws Could Let Prompt Injection Escape Sandbox and Run Commands
- Critical Docker Sandboxes Flaw Lets Malicious Guest Code Read and Modify macOS Host Files
- Critical Elementor Pro bug exposes WordPress sites to RCE attacks
- Critical Elementor Pro flaw exploited to take over WordPress sites
- Critical Everest Forms Pro flaw exploited to take over WordPress sites
- Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image
- Critical FortiMail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File Writes
- Critical FortiSIEM Flaw Gets Public Exploit PoC for Unauthenticated Remote Code Execution
- Critical Fortinet FortiSandbox flaws now exploited in attacks
- Critical Fortinet Forticlient EMS flaw now exploited in attacks
- Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases
- Critical GitLab GraphQL Flaw Could Let Unauthenticated Attackers Delete Public Projects
- Critical Gitea Flaw Let Unauthenticated Attackers Read Server Files via Org-Mode Markup
- Critical Gitea RCE Actively Exploited as Reported Attack Drops Miner-Like Payload
- Critical Gogs RCE Vulnerability Lets Any Authenticated User Execute Arbitrary Code
- Critical Keycloak Password Reset Flaw Could Let Unauthenticated Attackers Take Over Any Account
- Critical Kirki flaw exploited to hijack WordPress admin accounts
- Critical Langflow Flaw CVE-2026-33017 Triggers Attacks within 20 Hours of Disclosure
- Critical Langflow flaw exploited to steal OpenAI and AWS keys
- Critical Marimo pre-auth RCE flaw now under active exploitation
- Critical Microsoft SharePoint flaw now exploited in attacks
- Critical Microsoft Vulnerabilities Doubled: From Exposure to Escalation
- Critical MikroTik Vulnerability - Patch Now, (Sun, Sep 6th)
- Critical NGINX Vulnerability Can Crash Workers and May Allow Remote Code Execution
- Critical NetScaler Flaw Can Bypass Authentication on Certain Gateway and AAA Servers
- Critical Next.js ImageResponse Flaw Can Lead to Server Code Execution via Crafted SVG Input
- Critical Nginx UI auth bypass flaw now actively exploited in the wild
- Critical OpenWrt DHCPv6 Flaw Could Let Unauthenticated Attackers Run Code as Root
- Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619) [infocon yellow], (Wed, Oct 21st)
- Critical Palo Alto VPN bug now exploited by Qilin ransomware gang
- Critical Pre-Auth RCE in Orkes Conductor Workflow Platform Exploited in the Wild
- Critical Progress LoadMaster flaw now actively exploited in attacks
- Critical PwnEscape Linux Kernel Vulnerability Lets Guest VMs Read Host Memory
- Critical RCE flaw in Windows IKE Extension now actively exploited
- Critical Rails Flaw Could Let Unauthenticated Attackers Read Server Files via Image Uploads
- Critical ScreenConnect flaw now actively exploited in attacks
- Critical ServiceNow AI Platform Flaw Exploited for Unauthenticated Code Execution
- Critical ServiceNow code execution flaw now exploited in attacks
- Critical SharePoint RCE CVE-2026-50522 Under Active Exploitation After Public PoC
- Critical SharePoint RCE flaw exploited to steal machine keys
- Critical SimpleHelp flaw exploited to deploy new stealer malware
- Critical SonicWall SMA 1000 Flaw Targeted in 135 Exploitation Attempts After Patch
- Critical Splunk Enterprise Flaw Lets Attackers Run Code Without Authentication
- Critical TeamCity Flaw Could Let Attackers Run OS Commands Without Logging In
- Critical Unbound DNSSEC Validator Flaw Could Allow RCE via a Malicious DNS Zone
- Critical UniFi OS bug lets hackers gain root without authentication
- Critical Unpatched Flaw Leaves Hugging Face LeRobot Open to Unauthenticated RCE
- Critical Unpatched Telnetd Flaw (CVE-2026-32746) Enables Unauthenticated Root RCE
- Critical Unpatched Telnetd Flaw (CVE-2026-32746) Enables Unauthenticated Root RCE via Port 23
- Critical VMware Workstation and Fusion Flaw Lets VM Admins Execute Host Code
- Critical VMware vCenter RCE flaw exploited for reverse SSH access
- Critical WP Maps Pro Flaw Actively Exploited to Create Admin Accounts
- Critical Windows Netlogon RCE flaw now exploited in attacks
- Critical Zimbra Flaw Could Let Crafted Emails Run Malicious Code in User Sessions
- Critical Zimbra RCE flaw now actively exploited in attacks
- Critical cPanel Authentication Vulnerability Identified — Update Your Server Immediately
- Critical cPanel Flaw Could Let One Hosting Customer Take Root Control of a Whole Server
- Critical cPanel Vulnerability Weaponized to Target Government and MSP Networks
- Critical cPanel and WHM bug exploited as a zero-day, PoC now available
- Critical flaw in Protobuf library enables JavaScript code execution
- Critical flaw in wolfSSL library enables forged certificate use
- Critical macOS, SharePoint, vCenter, and Microsoft IKE Flaws Under Active Exploitation
- Critical n8n Flaws Allow Remote Code Execution and Exposure of Stored Credentials
- Critical vm2 sandbox bug lets attackers execute code on hosts
- Critical wp2shell WordPress flaws exploited to install webshells
- Critical x402 SDK Flaw Could Let Malicious APIs Drain AI Agents’ Token Balances
- Critrical cPanel flaw mass-exploited in "Sorry" ransomware attacks
- Cronos blockchain restarts after $74 million Tectonic exploit
- Cross-Platform NPM Stealer, (Fri, May 22nd)
- CrowdSec Says TanStack npm Attack Led to Copy of 170 Private GitHub Repositories
- Cruciferra Crypter Uses BYOVD and Process Ghosting to Hide Windows Malware
- Crunchyroll probes breach after hacker claims to steal 6.8M users' data
- Crypto Clipper Campaign Abuses Fake Reviews, AI Narrators, and VirusTotal Comments
- Crypto gang member gets 6.5 years for role in $230 million heist
- Crypto-exchange Kraken extorted by hackers after insider breach
- CryptoJS Weak RNG Behind $5.7 Million in Drains Affects Five Crypto Wallet Apps
- CubePilot drone software dev hit by DNS hijacking to intercept traffic
- Cursor Flaw Lets Malicious Cloned Repositories Trigger Windows Code Execution
- Cursor, Codex, Gemini CLI, Antigravity hit by sandbox escapes
- Custom ChatGPTs push ClickFix attacks to deploy RAT malware
- Cyber exec arrested in case allegedly tied to ShinyHunters hackers
- Cyber-Enabled Cargo Crime: How Cybercrime Tradecraft is Used to Steal Freight
- CyberStrikeAI Uses 44 AI Agents to Automate Hacking Operations Against Japan Targets
- CyberStrikeAI tool adopted by hackers for AI-powered attacks
- CyberXero Uses Claude Code in Campaign That Stole Over 628,000 Ukrainian Records
- Cyberattack shuts down refrigerators at French supermarkets
- Cybercrime Groups Using Vishing and SSO Abuse in Rapid SaaS Extortion Attacks
- Cybercrime service disrupted for abusing Microsoft platform to sign malware
- Cybersecurity Stars Awards 2026: Winners Announced Across 95 Categories
- Cybersecurity firms targeted by fraudulent OpenAI organization invites
- D-Link warns of max severity zero-day bug in DIR-822A routers
- DAEMON Tools Supply Chain Attack Compromises Official Installers with Malware
- DAEMON Tools devs confirm breach, release malware-free version
- DAEMON Tools trojanized in supply-chain attack to deploy backdoor
- DDoS attacks over 1 Tbps surged fivefold in the second quarter
- DEBULL Tooling Abuses Microsoft Device-Code Flow to Target M365 Accounts
- DHS bans DeepSeek products across US federal civilian agencies
- DHS confirms hackers breached HSIN info-sharing platform
- DIVD says Zammad zero-days enabled AI-driven network breach
- DOJ seizes CFAKE, SOCFAKE deepfake nude sites under TAKE IT DOWN Act
- DORA Year Two: Can Your SOC Actually See the Attack?
- DORA and operational resilience: Credential management as a financial risk control
- DOUBLECUP Uses ClickFix and Cached PNGs to Deliver CountLoader and DeviceManager RAT
- DOUBLECUP's PNG Payload, (Mon, Aug 24th)
- DPRK-Linked Hackers Use GitHub as C2 in Multi-Stage Attacks Targeting South Korea
- DPRK-Linked macOS Malvertising Uses Fake Updates to Deliver Crypto-Stealing Malware
- DRILLAPP Backdoor Targets Ukraine, Abuses Microsoft Edge Debugging for Stealth Espionage
- DShield (Cowrie) Honeypot Stats and When Sessions Disconnect, (Mon, Mar 30th)
- DShield Honeypot Update, (Mon, May 4th)
- Danger of Libredtail [Guest Diary], (Wed, Apr 29th)
- Danish university DTU breach exposes data of up to 200,000 people
- Dark web Nemesis Market vendor gets 26 years for selling drugs
- DarkSword iOS Exploit Kit Uses 6 Flaws, 3 Zero-Days for Full Device Takeover
- Dashlane Discloses Brute-Force Attack, Encrypted Vaults of Fewer Than 20 Users Downloaded
- Dashlane password manager users locked out by brute force attacks
- Data Broker Radaris Loses Domains in Privacy Fight
- Data analyst sent to prison for stealing data, extorting employer
- Data breach at edtech giant McGraw Hill affects 13.5 million accounts
- Data breach at medical billing firm MCBS affects 1.26 million people
- Data breach exposes up to 14.2 million email logins at six ISPs
- Dawn of the Apex Agentic Adversary
- Daxin Resurfaces in Taiwan Alongside Stupig Pre-Login SYSTEM Backdoor
- Day Zero Readiness: The Operational Gaps That Break Incident Response
- DeadLock Ransomware Uses Polygon Smart Contracts to Make Extortion Infra Harder to Disrupt
- DeadLock ransomware uses blockchain to resist infrastructure takedown
- DeepLoad Malware Uses ClickFix and WMI Persistence to Steal Browser Credentials
- DeepSeek Harness Flaw Let AI Agents Disable Their Own File Sandbox Without Approval
- Deepfake Voice Attacks are Outpacing Defenses: What Security Leaders Should Know
- Dell CSM Flaws Enable Unauthenticated Admin Access and Root on Kubernetes Nodes
- Dell asks admins to patch max severity CSM flaws as soon as possible
- Dell confirms its SupportAssist software causes Windows BSOD crashes
- Delta probes Wi-Fi deauth attack on flight carrying DEF CON attendees
- Denmark Says Attackers Accessed CPR Data for 8.8 Million People via Company Account
- Denmark population registry data breach affects 8.8 million people
- DentaQuest data breach exposed info of 2.6 million accounts
- Detecting IP KVMs, (Tue, Mar 24th)
- Deterministic + Agentic AI: The Architecture Exposure Validation Requires
- DevMan RaaS Portal Centralizes Payload Builds, Victim Management, and Affiliate Payouts
- Developer Workstations Are Now Part of the Software Supply Chain
- Device Code Phishing Hits 340+ Microsoft 365 Orgs Across Five Countries via OAuth Abuse
- Device code phishing attacks surge 37x as new kits spread online
- Die Linke German political party confirms data stolen by Qilin ransomware
- Differentiating Between a Targeted Intrusion and an Automated Opportunistic Scanning [Guest Diary], (Wed, Mar 4th)
- DirtyDecrypt PoC Released for Linux Kernel CVE-2026-31635 LPE Vulnerability
- Discord rolls out end-to-end encryption on voice, video calls
- Disgruntled researcher leaks “BlueHammer” Windows zero-day exploit
- DoJ Corrects China Hacking Claim, Says U.S. Agencies Were Targets, Not Victims
- DoJ Disrupts 3 Million-Device IoT Botnets Behind Record 31.4 Tbps Global DDoS Attacks
- DoJ Disrupts Southeast Asia Crypto Fraud Networks, Freezes $3.8 Million in Assets
- DoJ Seizes Huione Cloud Account Tied to Cyber Scam Money Laundering
- Docker CVE-2026-34040 Lets Attackers Bypass Authorization and Gain Host Access
- Docker Fixes Critical Two-Year-Old Hub Flaw That Let One User Push Images as Another
- Docker Hub flaw let attackers impersonate users, tamper with images
- Don't Revoke That Token Yet: Inside the keyv/cacheable npm Worm, (Wed, Aug 5th)
- DoppelCart fraud network uses 119,000 fake shops to steal credit cards
- Dormant GitHub Accounts Help Attackers Blend In While Mapping Corporate Orgs
- Dozens of Vendors Patch Security Flaws Across Enterprise Software and Network Devices
- DraftKings hacker 'Snoopy' sentenced to 18 months in prison
- DragonForce Hackers Abuse Microsoft Teams Relays to Hide Backdoor.Turn C2 Traffic
- DreamHost forces password resets in ongoing "incident"
- Drift $280M crypto theft linked to 6-month in-person operation
- Drift Loses $285 Million in Durable Nonce Social Engineering Attack Linked to DPRK
- Drift loses $280 million North Korean hackers seize Security Council powers
- Drift loses $280 million as hackers seize Security Council powers
- Dropbox accounts breached through Lenovo email verification flaw
- Drupal Core SQL Injection Bug Actively Exploited, Added to CISA KEV
- Drupal Patches Critical Core RCE Flaw with No-Login Path via Contributed Modules
- Drupal Patches Critical Field UI Flaw With Unauthenticated RCE Path via Contributed Modules