News

A hacker group known as TeamPCP is conducting unprecedented open-source software supply chain attacks, significantly increasing cybersecurity threats. Recently, TeamPCP compromised GitHub, accessing around 4,000 repositories via a poisoned VSCode extension.…

Apple prevented over $2.2 billion in fraudulent transactions on the App Store in the past year, bringing total blocked fraud to over $11.2 billion in six years. The company employed machine learning and human reviews to enhance fraud detection, blocking 1.1…

The article discusses ROADtools, a security framework utilized for both offensive and defensive tactics in cloud environments, particularly targeting Microsoft Entra ID (formerly Azure AD). It highlights the tool's capabilities to enumerate accounts,…

A global law enforcement operation has disrupted 'First VPN', a cybercrime service linked to ransomware attacks. Active since 2014, it had 32 exit nodes across 27 countries and served at least 25 ransomware groups. The FBI reported the dismantling of 33…

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2025-34291 from Langflow, which has a CVSS score of 9.4, and CVE-2026-34926 from Trend Micro Apex One,…

The report highlights ongoing activities of the Cloud Atlas group, linking them to significant phishing campaigns targeting government and commercial sectors in Russia and Belarus. The group employs new methods, utilizing malicious shortcuts to execute…

The article discusses the arrest of the Kimwolf DDoS botnet operator in Canada, who was involved in DDoS-for-hire attacks. This case marks a significant development in cybercrime as it underscores the ongoing efforts by law enforcement to combat such illegal…

TrendAI, the enterprise business of Trend Micro, has patched a zero-day vulnerability in its Apex One product, tracked as CVE-2026-34926. This medium-severity directory traversal issue can be exploited by unauthenticated local attackers with admin…

Grafana confirmed that unauthorized access to its GitHub repositories was a result of the TanStack supply chain attack, which took place on May 11. Key points include:\n- Malicious activity detected led to the rotation of GitHub workflow tokens, but one was…

A recent report by Hunt.io reveals that the Saudi Telecom Company (STC) hosts the majority of command-and-control (C2) servers in the Middle East, accounting for over 72% of the regional activity. The study identified more than 1,350 C2 servers across 98…

A China-backed threat actor known as Webworm is targeting European governmental organizations, utilizing Discord and Microsoft Graphs for command-and-control (C2) operations. Security vendor ESET revealed Webworm's evolution from known malware to novel…

The report, authored by Xavier Mertens, discusses a newly discovered Node.js malware classified as a cross-platform NPM stealer targeting Windows (WSL), macOS, and Linux. The malicious code is obfuscated but includes embedded plain-text payloads. It features…

CISA has added vulnerabilities from Langflow and Trend Micro Apex One to its Known Exploited Vulnerabilities (KEV) list. This update indicates that these vulnerabilities are actively being targeted by cyber attackers. Organizations are urged to apply…

Cisco has released patches for a critical security flaw in its Secure Workload REST API, which had a CVSS score of 10.0, indicating a severe risk due to potential unauthorized data access. The update emphasizes the importance of securing network…

The page provides information about the ISC Stormcast for May 22, 2026, with Jan Kopriva listed as the handler on duty. The threat level is indicated as green. Links are provided to additional resources, including class information by Dr. Johannes Ullrich…

The article discusses the evolving need for AI Bills of Materials (AI BOMs), which document not only the components of AI systems but also their operational behaviors, particularly in agentic AI where decisions are made autonomously. Current standards focus…

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added vulnerabilities in Microsoft and Adobe products to its Known Exploited Vulnerabilities (KEV) catalog as of May 21, 2026. Notable vulnerabilities include: 1. **CVE-2008-4250** -…

A security research report revealed that Google API keys remain active for up to 23 minutes after being deleted, contrary to user expectations of immediate deactivation. Researcher Joe Leon tested the revocation window, finding a median deactivation time of…

The ZionSiphon malware, identified by the executable SCADA_SecurityPatch_v8.4.exe, is a Windows-based implant intended to target industrial control systems (ICS), particularly in Israeli water treatment facilities. While technically capable at the host…

A global law enforcement operation has successfully taken down First VPN, a service utilized by cybercriminals, including ransomware groups, for concealing their activities. Conducted between May 19 and 20, 2026, the operation led to the seizure of numerous…

On May 21, 2026, it was reported that two vulnerabilities within Microsoft Defender are actively being exploited. These were added to the CISA's Known Exploited Vulnerabilities catalog, indicating that they pose significant risks. The vulnerabilities…

In 2025, Apple reported a significant crackdown on app fraud, rejecting over 2 million app submissions and blocking more than 1 billion fake account creations. This effort involved a combination of artificial intelligence and human oversight. Apple processed…

The May 2026 update from Microsoft Security highlights several key advancements aimed at enhancing security across various platforms. Significant features include a new Data Security Posture Management experience in Microsoft Purview, which streamlines data…

The article discusses the evolving budget dynamics within identity security as enterprises increasingly adopt AI agents. Recent research from Omdia reveals that the funding for identity security related to AI agents often comes from separate budgets,…

A coordinated operation led by France and the Netherlands has dismantled a VPN service, known as First VPN, used by cybercriminals including ransomware operators and fraudsters. The crackdown, supported by Europol, succeeded in taking down 33 servers and…

GitHub recently experienced a significant breach linked to a compromised Visual Studio Code extension called 'Nx Console,' which allowed unauthorized access to 3,800 internal repositories. The malicious version of the extension was uploaded on May 18, 2026,…

A recent report reveals that attackers are bypassing Multi-Factor Authentication (MFA) on SonicWall Gen6 VPNs due to an incomplete fix for vulnerability CVE-2024-12802. Despite available firmware updates, proper remediation requires six critical manual steps…

Dev Machine Guard has expanded its capabilities to scan IDE extensions across multiple platforms including VS Code, Cursor, JetBrains IDEs, Android Studio, and more. This update allows organizations to manage a unified inventory and assesses risk via a…

The article discusses the emergence of 'Showboat', a Linux malware targeting Middle Eastern telecom operators through a SOCKS5 proxy backdoor for cyber espionage. This malware represents a growing threat in cybersecurity, emphasizing the need for vigilance…

The article discusses recent findings regarding Chinese state-aligned hackers utilizing a Linux backdoor malware framework named "Showboat" to spy on telecommunications companies in Central Asia. The malware has been observed being used by the Chinese APT…

The article discusses methods for selective HTTP proxying in Linux environments. It highlights the absence of a Linux equivalent to the Proxifier tool available on other operating systems like Windows, macOS, and Android. Key techniques for configuring…

Cisco has addressed a critical vulnerability (CVE-2026-20223) in its Secure Workload platform that could allow attackers to gain Site Admin privileges via crafted API requests. The flaw, with a CVSS score of 10.0, is due to insufficient validation and…

The article discusses a cybersecurity vulnerability known as 'Underminr,' which allows attackers to exploit the Internet infrastructure by modifying Web requests to mask malicious activities using trusted websites. This technique is similar to the earlier…

A recent report reveals that 75% of organizations knowingly deploy vulnerable code, a decrease from 81% last year, but still significant amid rising AI-driven threats. Checkmarx highlights that vulnerabilities can now be exploited within two days, a sharp…