Archive
All articles, newest first. Page 19.
MetInfo CMS: Active RCE Exploitation Targets CVE-2026-29014
Threat actors are actively leveraging an unauthenticated RCE vulnerability (CVE-2026-29014) in MetInfo CMS. Recent activity shows a si…
Multi-Ecosystem Sleeper Packages Target CI Pipelines for Credential Theft and Persistence
At least two distinct campaigns have deployed malicious sleeper packages across RubyGems, npm, and Go modules to harvest developer cre…
Conti-Akira Ransomware Negotiator Sentenced to 102 Months in Prison
Deniss Zolotarjovs, a key 'closer' for the Conti and Akira ransomware syndicates, has been sentenced to 102 months in U.S. federal pri…
Vimeo Data Breach: 119,200 Emails Exposed via Anodot Integration
In May 2026, the ShinyHunters threat group published a 106 GB Vimeo archive stolen via the anomaly detection platform Anodot. The leak…
Google Raises Android Bug Bounty to $15M — Chrome AI Rewards Cut
Google has overhauled its Vulnerability Reward Programs, offering up to $1.5 million for sophisticated Pixel exploits while reducing p…
CVE-2026-23918: Apache HTTP/2 Critical Double-Free Flaw — Patch Apache 2.4.67 Now
Apache HTTP Server 2.4.67 addresses CVE-2026-23918, a CVSS 8.8 double-free flaw in the HTTP/2 handler. The vulnerability enables trivi…
OAuth Redirection Abuse: Weaponizing Trusted Domains for Government-Targeted Phishing
Microsoft has identified active phishing campaigns targeting government and public sector organizations by exploiting OAuth error flow…
Inside the Betrayal: Cybersecurity Professionals Sentenced to 4 Years for ALPHV/BlackCat Ransomware Attacks
Two American cybersecurity experts were sentenced to four years in prison for acting as ALPHV/BlackCat ransomware affiliates. The case…
CVE-2026-22679: Critical Weaver E-cology RCE Under Active Attack Since March
An exposed debug endpoint in Weaver E-cology 10.0 allows unauthenticated remote code execution. Attacks have been detected since March…
Trellix Source Code Breach: The Strategic Threat of Read-Only Access
Trellix has confirmed unauthorized access to an unquantified portion of its source code repository. While the company reports no evide…
PromptMink: North Korean Hackers Weaponize AI to Poison npm Supply Chain
Researchers have uncovered 'PromptMink,' a sophisticated North Korean campaign leveraging code generated by Anthropic's Claude Opus to…
Worldleaks Dumps 8.5 TB of Mediaworks Data; Hungarian Media Giant Threatens Press Over Leaks
Cyber-extortion group Worldleaks has published 8.5 TB of sensitive data allegedly stolen from Mediaworks Kft. While the Hungarian medi…
Linux ‘Copy Fail’ Under Active Attack: CISA Sets May 15 Patch Deadline
CISA has added CVE-2026-31431, known as 'Copy Fail,' to its KEV catalog following reports of active exploitation. The stealthy 732-byt…
LiteLLM Exploited 36 Hours After Disclosure: Pre-Auth SQL Injection Targets AI Credentials
CVE-2026-42208 in BerriAI LiteLLM was actively exploited just 36 hours after its public disclosure. The attack targeted high-value LLM…
GitHub RCE via Git Push: An Analysis of CVE-2026-3854
CVE-2026-3854 leverages unsanitized Git push options to inject malicious metadata into the internal X-Stat header, enabling remote cod…
GitHub Enterprise Server RCE: 88% of Instances Remain Unpatched Following Public Disclosure
CVE-2026-3854 enables remote code execution on GitHub Enterprise Server via manipulated git push commands. Despite patches being avail…
CVE-2026-3854: Critical RCE and Sandbox Bypass Hits Self-Hosted GitHub Instances
A critical RCE vulnerability in GitHub Enterprise Server, discovered through AI-assisted reverse engineering, left 88% of self-hosted…
Vishing and AiTM Bypass MFA: Invisible Extortion in SaaS
Criminal groups like Cordial Spider use vishing and AiTM to bypass MFA and target SaaS environments. Protect your corporate data from…
Russian Aviation Phishing: Drone Simulators Steal Sensitive Data
HeartlessSoul phishing campaign targets Russian aviation: drone simulators and Starlink tools steal geospatial data. Here is what you…
NCSC Warning: AI-Driven Patch Wave Is Exposing Technical Debt Across Networks
The NCSC warns AI is accelerating vulnerability discovery, causing a patch wave. Historic technical debt now risks overwhelming IT tea…
Systemic Risk: Banking Data Breaches and the Supply Chain
2026 banking data breaches highlight the systemic risk linked to the supply chain: here's why the weakest link is the third-party vend…
Ruby and Go Supply Chain Attack: Discover the Sleeper Risk
A new supply chain attack targets Ruby and Go using sleeper packages and fake wrappers. Learn how to protect CI/CD pipelines and corpo…
Italian DPA Fines Poste: Security and GDPR Impact
Analysis of the Italian DPA fine against Poste Italiane for excessive app permissions: the conflict between PSD2 security and GDPR. He…
Insider Risk in BlackCat Ransomware: Analyzing the Betrayal
Discover the impact of insider betrayal in the BlackCat ransomware: negotiators exploited defenses for extortion. What to know about t…