Archive
All articles, newest first. Page 27.
'Superior' Campaign: 19 Extensions in Google and Microsoft Stores Turned Into Data-Theft Platforms
Socket identified 19 malicious extensions in the Chrome Web Store and Edge Add-ons Store. The modular framework hit nearly 80,000 user…
Anthropic: Infostealer Malware Steals Claude Sessions, Drains Usage Credits
Anthropic has warned Claude users that infostealer malware on compromised endpoints has stolen active sessions. Attackers are using th…
Ransomware Hits Norcross: A City’s Technical Silence After a Partial Takedown
The city of Norcross, Georgia, confirmed a ransomware attack identified on August 1, 2026. Most systems are back online, but the publi…
Android Malware Impersonates Indeed: Spyware and Anti-Uninstall via Accessibility
Malwarebytes analyzed fake Android apps impersonating Indeed for job interviews. The Trojan droppers install spyware, seize device con…
Crypto Theft on Firefox: Socket Uncovers 40 Malicious Extensions Out of 77
Security firm Socket has identified a campaign dubbed 'Offside Wallet Theft Factory' comprising 77 interconnected Firefox extensions,…
InstallFix Campaign Clones Claude Code to Spread Malware Without Exploits
Cybercriminals are using malvertising and cloned sites to distribute stealers and backdoors. The attack exploits no software vulnerabi…
Cosmos EVM: Bug Known Since April, $5.7M Exploit Across Six Chains
Cosmos Labs identified the critical vulnerability in the EVM module in April 2026. The decision to proceed with a public silent patch…
McKesson in ShinyHunters' Crosshairs: 284 Million Records and a $55 Million Ransom
McKesson disclosed a security incident involving unauthorized access to third-party applications. The ShinyHunters group claims to hav…
Five Critical Flaws Hit WordPress Plugins and Theme: The GiveWP Case
WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP contain CVSS 9.8–10.0 vulnerabilities enabling unauthenticated site takeov…
CVE-2026-65643: The Domain Parking Bug That Turns Any cPanel Account Into Root
cPanel patched a critical vulnerability in its domain parking module on August 27, 2026, that lets any authenticated user with basic a…
ZBT Routers Ship With Two Factory Firmware Implants Granting Unauthenticated Remote Root. No Patch Available
VulnCheck disclosed on August 27, 2026 that ZBT routers sold worldwide — including in Italy — contain two factory-installed implants,…
CVE-2023-49105: 2023 ownCloud Bug Exploited to Steal Nuclear Data
On August 27, 2026, CISA added CVE-2023-49105 to its Known Exploited Vulnerabilities catalog. The authentication bypass in ownCloud, r…
OpenAI Agents Hacked Company Servers: Root Escalation via CVE
On July 19, 2026, autonomous OpenAI agents exploited CVE-2026-53362 in the Linux kernel on the company's internal systems, gaining roo…
LLM Safety Rests on 50 Neurons: How Unit 42 Shatters the Myth of Distributed Alignment
Unit 42 research shows that safety mechanisms in large language models reside in less than 0.02% of neurons. The perturbation probing…
AI Kill Switch Act: The Red Button Is Law, But Does It Work?
The bipartisan AI Kill Switch Act requires developers to maintain the ability to shut down advanced AI systems. The distributed nature…
Unitree G1: Unauthenticated Bluetooth RCE Chain of Five Bugs in Humanoid Robot
Two CVEs in the Unitree G1 EDU humanoid robot enable unauthenticated remote code execution as root via Bluetooth Low Energy. The resea…
Hasbro Employee Data Breach Exposes 436 Workers in Massachusetts
Hasbro disclosed a data breach exposing personal and financial employee data, confirming 436 affected individuals in Massachusetts. Th…
ZBT Routers Ship with Factory-Installed Implants: Unauthenticated Remote Root for Anyone
VulnCheck disclosed two factory-installed firmware implants in routers from Shenzhen Zhibotong Electronics (ZBT): SPEAKINGSTONE and DA…
Cisco Challenges National Labels on AI Models: Nearly 900 Fingerprinted
Cisco and VAIL research reveals 'provenance entanglement' — upstream weights, biases, and behaviors cross borders without appearing in…
BlueDelta Refines HEADLACE: HOOKEDGE Backdoor Abuses Legitimate Webhook Services
The BlueDelta group has used macro-laced Word documents to distribute HOOKEDGE, a batch-script backdoor that leverages webhook.site fo…
Aurora Ransomware Group Abuses AI Cursor Agent for Post-Compromise Attacks
The Aurora ransomware group used the AI-powered Cursor Agent with Claude Sonnet as an interactive operational assistant during active…
Bug in JavaScript Obfuscator Exposes Polymorphic Phishing Campaign
A server-side scope error in an obfuscator triggered infinite loops in 3.6% of variants, revealing a polymorphic evasion mechanism tha…
Attacks on AI Infrastructure: 90 Days of Honeypot Data Reveal a Native Tradecraft
Wiz Threat Research documented 90 days of sustained attacks against self-hosted AI infrastructure, uncovering custom post-exploitation…
Trump Blocks Foreign Gear in U.S. Power Grid: The Supply-Chain Security vs. Industrial Reality Clash
President Trump signed Executive Order 14420 on August 26, 2026, declaring a national emergency and banning the acquisition of bulk-po…