News

On June 1, 2026, eight npm packages in the @redhat-cloud-services scope were discovered to contain malicious payloads that execute via a preinstall hook during npm installations. This sophisticated multi-stage credential harvester targets sensitive data such…

The article discusses the shift of Managed Service Providers (MSPs) towards the Security Growth Platform, moving beyond traditional virtual Chief Information Security Officer (vCISO) tools. It highlights the necessity for MSPs to adapt to evolving security…

A long-standing vulnerability in the Linux kernel, identified as CIFSwitch, has been discovered that impacts the CIFS subsystem, allowing low-privileged users to gain root-level privileges on many Linux distributions for over 19 years. The flaw is related to…

A new report reveals that the Russian state-linked Gamaredon group has developed a sophisticated worm, referred to as GammaWorm, that hides its components within Windows NTFS Alternate Data Streams, enabling it to infect Ukrainian networks almost undetected.…

The SOCRadar Dark Web Team identified multiple new listings selling large datasets on underground forums. Key highlights include: 1. **Italian Hospitality Dataset**: A seller claims to offer 230,000 customer records at a low price, framed as data-only to…

The article discusses the top 10 identity attack techniques used by hackers, emphasizing that most cyberattacks begin with compromised identities. The techniques include: 1. **Phishing and Spear-Phishing** - Fraudulent communication that mimics legitimate…

The article discusses the increasing threat of container attacks in modern infrastructure, highlighting various attack vectors that are being exploited by malicious actors. It begins with an introduction to containerization, emphasizing its reliance on…

The article discusses a critical Linux vulnerability called CIFSwitch, discovered by Asim Manizada, a SpaceX security engineer. This 19-year-old logic bug allows unauthorized users to forge CIFS authentication keys, potentially granting root access on…

The article discusses a significant security breach involving the theft of OpenAI Codex authentication tokens through a supply chain attack affecting the codexui-android npm package. The incident highlights vulnerabilities in API security and emphasizes the…

A recent report by Push Security has revealed that cybercriminals are utilizing legitimate ChatGPT domains to deliver malware via phishing attacks. The attackers exploit ChatGPT's code-rendering capabilities to create fake download pages masquerading as…

A cyber espionage campaign targeting enterprise operations in Southeast Asia has been identified, involving a China-linked group deploying a custom Linux router implant on border routing devices. This implant circumvents traditional security measures,…

The article discusses a critical vulnerability in the WP Maps Pro plugin that is currently being exploited to create unauthorized admin accounts. The exploitation of this flaw poses significant security risks to websites using this plugin, urging users to…

The article discusses the need for mobile device cleanup and introduces the new Junk Cleaner feature in the Malwarebytes app for Android. This tool helps users remove unnecessary files, improve device performance, and protect privacy. Instructions for using…

A critical alert highlights the detection of a significant Android banking trojan threat, named OverlayPhantom, which is rapidly expanding across Western markets. The malware is disseminated through deceptive download links disguised as popular applications,…

At Infosecurity Europe 2026, OWASP will announce the formation of the Agentic Research Council aimed at bridging the gap between rapidly evolving AI technologies and traditional cybersecurity standards. The council, part of the GenAI Security Project, seeks…

The Pentagon has acknowledged that adversaries are using commercially available location data to track U.S. military personnel, marking a significant concern for operational security. A letter from U.S. Central Command (CENTCOM), obtained by Senator Ron…

Microsoft Defender Experts have identified a significant GPU cryptojacking campaign leveraging search engine manipulation and AI platforms to target high-performance computing systems. The threat actors employ AI-assisted delivery methods that modify search…

The week of May 25 to May 31, 2026, saw several notable cybersecurity incidents and threats, including: Payment apps allegedly listening to conversations. Scammers posing as Microsoft executives for fraudulent activities. A significant ClickFix malware…

Akamai Security Intelligence Response Team has identified a sophisticated P2P cryptominer malware threat targeting AI environments. This malware exploits vulnerabilities in large language model ports, using automated API requests to hijack processing power…

A critical vulnerability (CVE-2026-44962) has been discovered in Plesk, a popular web hosting control panel, that allows low-privileged users to escalate privileges and execute arbitrary commands on affected Linux servers. This security flaw is tied to the…

Microsoft has ended standard security support for Windows 10, but individuals can access a free one-year Extended Security Update (ESU) program until October 2026. Enterprises, meanwhile, can purchase up to three years of ESU but at escalating costs,…

The article discusses the release of the AV2 codec v1.0.0 by the Alliance for Open Media (AOMedia), which marks a significant advancement in video compression technology. It highlights the codec's ability to optimize data compression for high-fidelity video…

The article discusses the early development phase of Ubuntu 26.10, named 'Stonking Stingray,' with its initial ISO image available for download. Built on the foundation of Ubuntu 26.04 LTS, it features the Linux Kernel 7.0 and GNOME 50, with expectations for…

A critical vulnerability (CVE-2026-45618) was discovered in the Liquidjs template engine, which is widely used by JavaScript developers. This flaw allows attackers to achieve remote code execution, posing a significant risk to over 7.3 million projects. The…

The article highlights an active security exploit targeting corporate networks through a critical Netlogon Remote Code Execution (RCE) vulnerability, designated as CVE-2026-41089, with a CVSS score of 9.8. Attackers can control domain controllers by sending…

The content provides information about the current handler on duty, Brad Duncan, and notes the threat level is green. It references the ISC Stormcast for June 1st, 2026, and includes links to various resources including SANS classes, discussion forums,…

The Lock and Code podcast episode titled "Payment apps are watching what you say" discusses how financial institutions can censor individuals based on the perception of risk associated with their speech or activities. Examples include a Persian poetry…

IBM has issued a security bulletin addressing multiple vulnerabilities in its Aspera software, crucial for high-speed file transfer systems. Key vulnerabilities include CVE-2026-7876, allowing authentication bypass with a CVSS score of 9.1, and…

This week's threat intelligence briefing highlights a significant increase in software supply chain attacks. Key findings include a spike in vulnerability reports with 2,213 new vulnerabilities detected. The CISA catalog added five critical flaws,…

The article reports critical vulnerabilities affecting the Notepad++ text editor, highlighting three major flaws that can lead to arbitrary code execution and local denial of service. The vulnerabilities CVE-2026-48800 and CVE-2026-48778 allow attackers to…

A critical security vulnerability (CVE-2026-7251) has been identified in Eppendorf's BioFlo 320 bioreactor, with a CVSS severity rating of 9.8. This flaw arises from a hard-coded password in its remote management tool using VNC architecture, allowing…

This diary, authored by Brad Duncan, discusses an unidentified Remote Access Trojan (RAT) that was detected on May 27, 2026. The RAT is associated with the SmartApeSG ClickFix campaign and has been identified as generating encoded traffic to a command and…

The article discusses CVE-2026-0257, a vulnerability in Palo Alto Networks' GlobalProtect VPN that allows attackers to forge authentication cookies and bypass login, confirmed to be exploited since May 17, 2026. Rapid7 reported that the flaw affects multiple…

The recent release of YARA-X version 1.17.0 by Didier Stevens includes five performance improvements and one bug fix. This update aims to enhance the tool's efficiency and usability for users. The threat level currently is categorized as green, indicating a…