Nearly 800 malicious npm packages deliver cross-platform malware
The campaign, tracked as Flooding Dropper by Sonatype, employs a novel approach by instructing developers to load packages using "require()", bypassing typic...
general
20 articles
OpenAI's new Astra model may pose critical cybersecurity risks
Why transparent AI agents matter more than you think
The difference between a prompt injection attack you'll catch and one you won't might just be whether your AI agent can explain itself. The post Why transpar...
Polish researchers find thousands of public websites vulnerable to cyberattacks
Two Polish security researchers, Robert Kruczek and Kamil Szczurowski, discovered over 10,000 affected public entities with 250,000 websites exhibiting secur...
Metabase SQL injection vulnerability exploited in zero-day attacks
The vulnerability, affecting Metabase versions 1.58 and above, allows unauthenticated remote attackers to inject arbitrary SQL, potentially gaining administr...
Stealthium Targets Security Blind Spots in AI Accelerators and Neo-Clouds
The startup analyzes subtle telemetry signals to detect attacks that traditional security tools cannot see inside accelerator-powered AI infrastructure. The ...
Scammers use AI deepfakes to impersonate OnlyFans creators
The fraudulent scheme involves creating fake identities using AI to generate deepfakes of real OnlyFans creators.
WordPress 'XSS2Shell' flaw allows admin takeover and remote code execution
The XSS2Shell flaw begins with a specially crafted username that bypasses WordPress's initial HTML tag sanitization.
Framework notifies customers of data breach following upstream cyberattack
The breach affected customer names, email addresses, phone numbers, and physical addresses.
Defense supplier IEH Corporation discloses Microsoft 365 mailbox breach via phishing
The breach occurred when an employee fell victim to a phishing scam, impersonating a business contact and presenting a fake Microsoft sharing link.
CISA cautions against overly restrictive legislation for global vulnerability program
A funding scare last year highlighted the program's reliance on a single U.S.
Cisco Warns of High-Severity ClamAV Vulnerabilities With Public PoC
Remote, unauthenticated attackers could exploit the bugs to cause a denial-of-service (DoS) condition. The post Cisco Warns of High-Severity ClamAV Vulnerabi...
Updoc data breach exposes customer contact information
The incident at Updoc, an Australian telehealth service, was detected on July 31 and involved unauthorized access to an external system used for operational ...
When Credentials Are No Longer Enough: Device Trust in the AI Era
AI is making phishing, credential theft, and social engineering faster and more efficient, while traditional trust signals such as passwords, MFA, IP reputat...
AI inference attacks pose new data privacy risks
Gartner predicts that by 2029, most privacy incidents will arise from AI-generated inferences rather than direct exposure of personal information.
New NatJack attack class exploits NAT vulnerabilities to hijack TCP sessions
NatJack exploits a fundamental assumption in many NAT implementations: that systems behind the same NAT will not interfere with each other's connection states.
British ‘Com’ member who abused more than 100 girls worldwide jailed for two years
Justin Swaddle, of Leeds in northern England, targeted 117 female victims aged 13 to 17, according to the National Crime Agency.
Metabase zero-day exploited to access Framework customer data
Framework, the San Francisco-based company that designs repairable and upgradeable laptops, has suffered a data breach after attackers managed to exploit a z...
Windows Hello for Business keys can be silently abused by malware
Researcher Dirk-jan Mollema demonstrated that malware can exploit Windows Hello for Business keys on TPM-backed systems without extracting private keys, reco...
9.2 Million Israeli Records Sold as a New Breach Are 20 Years Old
A seller claims to offer Israel’s 2026 population registry, but checks show the 9.2 million records are authentic data dating back to 2005.