Compromised Rust Crate With 18,000+ Downloads Steals Source Code During Builds
A malicious update to the Rust crate called onering has been discovered, which exfiltrates source code changes from developers’ machines during the build pro...
general
20 articles
Microsoft Entra ID Flaw (CVSS 10.0) Exploited in Wild, Allows Remote Code Execution
Microsoft on Thursday warned of a maximum-severity security flaw in Entra ID that it said has been exploited in the wild, but noted that no customer action i...
Windows Defender Driver Abuse Enables Kernel-Level EDR and Antivirus Bypass
Security researcher Jiří Vinopal has published a detailed analysis of BTR.sys, the Microsoft Defender Boot-Time Removal driver.
Microsoft Entra ID RCE Flaw Lets Unauthorized Attackers Execute Code Remotely
Microsoft has disclosed a critical remote code execution vulnerability in Microsoft Entra ID, identified as CVE-2026-69836. This flaw could enable unauthoriz...
SilkParasite Uses Google Drive as C2 to Hide RAT Traffic Inside Trusted Cloud Services
SilkParasite, a long-running cyberespionage operation targeting government bodies across Central Asia through a compact but highly mature arsenal of remote a...
A $25 template helped scammers build hundreds of phantom bank domains
A phrase on a suspicious website turned into an investigation of phantom banks built to support scams, according to new research from Allure Security. Molly ...
Nearly half of enterprises have no one leading PQC migration
Enterprises believe they are prepared for the security challenges posed by quantum computing, but gaps in ownership, testing and visibility could complicate ...
New infosec products of the week: August 21, 2026
Here’s a look at the most interesting products from the past week, featuring releases from F5 Networks, Intezer, Netscout, and Tufin. NETSCOUT expands Adapti...
Over 50,000 Stripe API keys exposed, highlighting fraud risks
Over 50,000 Stripe API keys have been exposed across public code repositories, GitHub Actions logs, and misconfigured web servers, demonstrating the immediat...
AI skills in cybersecurity jobs double, but junior hiring lags
The AI Workforce Consortium's report highlights that AI skills are now present in 28.5% of G7 cybersecurity job postings, a substantial increase from 14.
Critical vulnerability in Elementor Pro allows unauthenticated file upload and RCE
The vulnerability arises from a discrepancy between two loops within the File Upload module: one for validation and one for processing.
Report calls for AI sector to be designated critical infrastructure
The report defines the AI sector broadly, encompassing organizations, technologies, and industries involved in the development, training, deployment, and ope...
New attack bypasses AI guardrails by encrypting malicious prompts
The attack, developed by Rony Utevsky, a researcher at Adversa, is dubbed "cryptographic context injection" and exploits a fundamental weakness in how AI mod...
Network of 77 Firefox extensions linked to crypto theft uncovered
Socket researchers identified 40 malicious extensions and 37 others disguised as unrelated utilities, all linked through shared code, infrastructure, and pub...
New Android banking Trojan ToxicPanda 2.0 expands victim targeting
Discovered by Zimperium's zLabs team, ToxicPanda 2.0 leverages the Android Accessibility Service to enable wireless debugging, effectively gaining shell acce...
IT leaders increasingly value gaming skills in hiring and decision-making
Logitech's research reveals that 98.8% of IT decision-makers believe gaming directly impacts their job performance.
Vercel offers $1 million in bounties for sandbox hacks
The two-week program challenges participants to breach an isolated sandbox environment hosted by Vercel.
Security researcher enrolls Linux device in Apple's Find My network
The researcher, known as Zerotistic, devised a method to trick Apple's systems into sending location data, typically reserved for Apple devices, to a Linux m...
Alation confirms cyberattack after reporting system incident
Alation confirmed it identified an isolated incident involving unauthorized activity in one of its systems.
Hackers compromise Rust crate arrayref to inject malware
The attack involved injecting a dependency on a malicious package, proc-macro1, which impersonated the popular proc-macro2 crate.