Google Cloud Vertex AI SDK flaw allowed model hijacking and code execution
The attack exploited a weakness in how the SDK selected temporary Cloud Storage buckets for model uploads.
SC Media
20 articles
Mastra npm packages compromised in 'easy-day-js' supply chain attack
The attack involved the compromise of an npm account, which then mass-published over 140 malicious packages under the Mastra scope.
Apple to change Hide My Email domain, potentially impacting anonymous sign-ups
The change, announced to developers, will move anonymously generated email addresses to a new domain, @private.icloud.
Summer vacation scams surge, targeting travel industry
Check Point Research reported that in May 2026, the hospitality, travel, and recreation sector faced an average of 2,291 weekly cyberattacks per organization...
AUR suspends new registrations as 1,500-plus malicious packages flood repository
Malicious build scripts deploy a Rust-based infostealer and eBPF rootkit.
Malicious JetBrains plugins steal AI API keys from developers
A coordinated malware campaign on the JetBrains Marketplace has been uncovered by Aikido Security, with at least 15 plugins published under seven vendor acco...
Turn underground intelligence into actionable security
Here’s how security teams can turn the dark web to their advantage.
The artificial adversary and the erosion of trust
AI-powered attackers are turning trust into a core cyberattack target.
Enterprise Browers in the Age of AI as CISO Role Changes and Leaders Harness Stress - Arunesh Chandra - BSW #452
Anonymized infrastructure complicates IP intelligence for security teams
Cybercriminals increasingly use VPNs and residential proxy networks to mask malicious activity, making traditional IP reputation and blocklist approaches les...
SprySOCKS backdoor expands to Windows with new variants
The Windows variants, WIN_DRV and WIN_PLUS, retain the core architecture of their Linux predecessor, including command-and-control (C2) protocols and encrypt...
Beyond Identity launches Ceros to secure enterprise AI agents
Ceros aims to provide visibility and control over AI agents by logging every session, including the user and device involved.
Malware distributed via Steam Workshop wallpapers
Kaspersky researchers have identified that malicious actors are exploiting the Steam Workshop platform, specifically through the Wallpaper Engine application...
UK government to ban social media for under-16s
To enforce the ban, social media platforms will be required to implement age verification for new users, likely through ID uploads or facial age scans.
North Korean hackers use fake Microsoft alerts to deploy NarwhalRAT malware
The attackers send emails designed to raise alarm about potential account compromise and OTP abuse, tricking recipients into opening an attachment, according...
DragonForce ransomware uses Microsoft Teams for covert command and control
The DragonForce ransomware operation, active since 2023 and linked to the Scattered Spider threat group, has employed custom Go-based malware dubbed "Backdoo...
GhostTree technique uses NTFS junctions to evade security scans
GhostTree leverages NTFS junctions, a file system feature that allows one directory to point to another.
India temporarily blocks Telegram over exam fraud concerns
The National Testing Agency announced the restrictions on Tuesday, aiming to disrupt cheating networks that allegedly use Telegram to sell fake exam papers a...
Security researcher reportedly accesses FIFA World Cup broadcast controls via API flaw
The researcher, known as BobDaHacker, said they exploited a flaw in FIFA's back-end API by registering as a player agent.
SailPoint acquires Entro Security to enhance AI agent security
SailPoint, known for its platform that manages employee access to applications, announced the acquisition of Entro Security without disclosing financial term...