News

DocketWise, an immigration and legal case management platform, has reported a data breach affecting over 143,000 individuals. The breach was caused by a third-party partner whose repositories were accessed by a threat actor using valid credentials. The…

The article discusses the cybersecurity threats posed by the Lazarus Group, particularly focusing on their deployment of a RemotePE memory-only Remote Access Trojan (RAT) targeting financial and cryptocurrency firms. It highlights how this group has evolved…

The FBI has issued a warning about a new phishing-as-a-service platform called Kali365, discovered in April 2026, which primarily operates on Telegram. This tool allows cybercriminals to use AI-generated phishing methods to capture Microsoft 365 OAuth…

The content discusses a serious vulnerability (CVE-2026-9082) affecting the Drupal Core due to a malicious Go module backdoor discovered by Socket's Threat Research Team. The attack was crafted through a clever supply chain tactic, where a typosquatted…

Cybercriminals are increasingly targeting Formula 1 (F1) fans with scams surrounding counterfeit merchandise, fake streaming services, and social media scams, as detailed in a report from Bitdefender. The report, which analyzes the cybercriminal landscape…

Dutch authorities have dismantled a hosting network used for cyberattacks and disinformation, arresting two suspects and seizing 800 servers tied to Stark Industries. This company was reportedly a front for activities supporting Russian and Belarusian…

The Satori Threat Intelligence and Research Team at HUMAN has disrupted a sophisticated mobile ad fraud scheme named "Trapdoor," which involved 455 malicious Android apps and 183 command-and-control (C2) domains. This operation generated 659 million…

The article discusses a significant supply chain attack named 'Megalodon', which infected over 5,500 GitHub repositories through automated commits. Introduced on May 18, 2026, the attack involved 5,700 malicious commits that added or altered GitHub Actions…

Microsoft's Digital Crimes Unit disrupted a significant cybercrime operation known as "Fox Tempest," which provided malware-signing-as-a-service (MSaaS) to other cybercriminals. This service enabled actors to generate short-lived fraudulent digital…

The article from Malwarebytes discusses significant events in cybersecurity from May 18 to May 24, 2026. Key topics include critical vulnerabilities in Google Chrome that could allow attackers to execute code, exploitation of Microsoft Defender…

FBI Director Kash Patel's merchandise website was taken offline after it was hacked, resulting in malware being spread through a ClickFix attack, where users were tricked into executing malicious commands that downloaded malware on their devices. The attack…

The article discusses the Banana RAT (Remote Access Trojan), attributed to a cybercriminal group known as SHADOW-WATER-063, targeting Brazilian financial institutions. The trojan employs advanced strategies for financial theft, utilizing a fileless execution…

The article discusses the rise of Chinese-language Phishing-as-a-Service (PhaaS) offerings, emphasizing their evolution and unique characteristics compared to Russian counterparts. Key highlights include a shift from static password harvesting to real-time…

The article discusses a recent supply chain attack known as the TrapDoor attack, which distributes credential-stealing malware through package repositories such as npm, PyPI, and CratesIO. This attack targets developers and compromises software supply…

NLnet Labs has issued a significant security update for its Unbound DNS resolver software to address multiple vulnerabilities, including a critical DNSSEC validation flaw (CVE-2026-33278) allowing remote code execution. This issue, stemming from a memory…

The content discusses a critical security vulnerability in Kopia, an open-source backup tool, tracked as CVE-2026-45695. This vulnerability allows remote code execution through command injection due to flawed handling of external requests when the server…

The TYPO3 project has issued a critical security advisory regarding a remote code execution (RCE) vulnerability (CVE-2026-46725) affecting the "Content Element Selector" plugin. This vulnerability arises from an insecure deserialization issue, allowing…

The FreeBSD Project has issued critical security advisories addressing seven vulnerabilities in its core operating system. Notable vulnerabilities include: 1. **Wi-Fi Scanner RCE (CVE-2026-45255)**: A severe input expansion vulnerability in `bsdinstall`…

The page reports a critical NGINX heap buffer overflow vulnerability (CVE-2024-24989) impacting both NGINX Plus and NGINX Open Source causing potential crashes and system takeovers. The flaw is due to errors in the web server’s regex rewrite handling,…

The content announces the release of Wireshark version 4.6.6, which addresses one vulnerability and fixes eleven bugs. Additionally, it mentions that Npcap has been updated to version 1.88 for Windows users. Didier Stevens, the author, provides links to his…

The Security Affairs Malware Newsletter Round 98 provides a roundup of significant articles and research pertaining to malware in the global context. Key highlights include reports on compromised npm packages like the node-ipc package, new cyber actors…

Anthropic's Project Glasswing has discovered over 10,000 high- or critical-severity vulnerabilities since its launch, highlighting a significant gap in patching capabilities in cybersecurity. This initiative, involving collaboration with major tech firms,…

The content discusses a critical security vulnerability (CVE-2026-9089) in ConnectWise Automate software, which allows attackers to bypass security checks during updates. The flaw arises from a lack of integrity checks in the code loading process, posing a…

The article discusses a critical alert regarding a persistent P2Pinfect botnet threat identified by FortiGuard Labs within Google Kubernetes Engine environments. This stealthy cloud threat exploits misconfigured Redis instances to gain an initial foothold,…

The article discusses a security vulnerability in Angular related to hostname hijacking through server-side rendering. This flaw, with a CVSS score of 8.8, allows attackers to manipulate internal URLs to redirect requests, potentially exposing sensitive data…

The page discusses a new malware campaign known as ValleyRAT, which primarily targets corporate users through social engineering tactics. Attackers distribute trojanized software disguised as legitimate tools like Microsoft Teams. The malware utilizes a DLL…

International law enforcement dismantled the First VPN, a crucial tool used by cybercriminals for ransomware attacks and data theft, during Operation Saffron. This operation led by French and Dutch authorities resulted in the destruction of 33 servers,…

Anthropic's Project Glasswing is a cybersecurity initiative that uses its proprietary 'Claude Mythos Preview' AI model to enhance vulnerability detection in software systems. Within a month of its launch, the model helped identify over 10,000…

The article discusses npm's new security features aimed at improving software supply chain protection. Key updates include: 1. **Two-Factor Authentication (2FA) for Publishing**: Developers must enable 2FA to publish packages, reducing the risk of…

Drupal has issued a critical security patch for a SQL injection vulnerability (CVE-2026-9082) that allows unauthorized attackers to compromise PostgreSQL-based sites. Exploit attempts were observed within 48 hours post-release, targeting nearly 6,000 sites…

The article titled "Packagist Supply Chain Attack Infects 8 Packages Using GitHub-Hosted Linux Malware" discusses a recent cybersecurity incident involving a supply chain attack that has compromised eight packages on Packagist, a popular PHP package…

In 2026, ransomware gangs are shifting from traditional encryption strategies to pure extortion by stealing sensitive data and threatening to leak it instead of encrypting systems. This change is driven by the risks and inefficiencies associated with…