TrendAITM Research breaks down Quasar Linux (QLNX), a previously undocumented sophisticated Linux RAT with low detection rates. In this blog, we exam…
Hackers have been exploiting a critical vulnerability (CVE-2026-22679) in the Weaver E-cology office automation since mid-March to run discovery comm…
46% say age checks are easy to bypass, and nearly a third admit getting around them It’s been months since the UK government began requiring stronger…
The Amazon Simple Email Service (SES) is being increasingly abused to send convincing phishing emails that can bypass standard security filters and r…
pnpm 11 has been released with new supply chain protections in place, making safer install behavior the default while still allowing teams to overrid…
An active phishing campaign has been observed targeting multiple vectors since at least April 2025, with legitimate Remote Monitoring and Management …
The cybersecurity firm’s investigation has not found any impact on its source code release or distribution process. The post Trellix Source Code Repo…
By Saturday, Infrastructure’s chief information security officer Steve Proud confirmed that the hackers gained access to information about users at s…
A malicious version of the PyTorch Lightning package published on the Python Package Index (PyPI) delivers a credential-stealing payload targeting br…
The preliminary settlement agreement, released on Thursday, said that Forbes has agreed to give users “greater notice” of its use of trackers and wil…
Progress Software has released updates to address two security flaws in MOVEit Automation, including a critical bug that could result in an authentic…
Cybersecurity firm Trellix disclosed a data breach after attackers gained access to "a portion" of its source code repository. [...]
Mediaworks confirmed the incident on Friday, warning that “a significant amount of illegally obtained data may have come into the possession of unaut…
In this article Multi-step social engineering campaign leading to credential theftMitigation and protection guidanceMicrosoft Defender detectionsHunt…
Progress Software has fixed a critical authentication bypass (CVE-2026-4670) and a privilege escalation (CVE-2026-5174) vulnerability in MOVEit Autom…
Using a 1930s trade law, Homeland Security targeted the man—who hasn’t entered the US in more than a decade—following posts on X condemning the killi…
A targeted social engineering attack against DigiCert’s support channel led to the compromise of internal systems and the unauthorized issuance of EV…
The situation around the critical cPanel authentication bypass vulnerability (CVE-2026-41940) has deteriorated significantly since our initial covera…
This is a writeup of my DEF CON Singapore talk that walks through vulnerabilities and exploits in M365 Copilot and Consumer Copilot. I disclosed thes…
Hackers delivered malware via a customer chat channel, infected an analyst’s system, and accessed the internal support portal. The post DigiCert Revo…
Progress Software warned customers to patch a critical authentication bypass vulnerability in its MOVEit Automation enterprise-grade managed file tra…
Team Cymru’s Stephen Campbell warned that small US defense contractors are not well prepared to face cyber intrusions through edge devices
The China-based cybercrime group known as Silver Fox has been linked to a new campaign targeting organizations in Russia and India with a new malware…
Researchers have uncovered a long-running phishing operation that abuses trusted Google services to hijack tens of thousands of Facebook accounts. Th…
CISA has warned that threat actors have started exploiting the "Copy Fail" Linux security vulnerability in the wild, one day after Theori researchers…
Two American cybersecurity professionals were sentenced to four years in prison for facilitating BlackCat ransomware attacks in 2023. They pleaded gu…
CISA has added the bug to its KEV list, and Microsoft has observed limited exploitation, mainly associated with PoC testing. The post Exploitation of…
Introduction The primary goal for attackers in a phishing campaign is to bypass email security and trick the potential victim into revealing their da…
A previously unknown threat actor has been observed targeting government and military entities in Southeast Asia, alongside a smaller cluster of mana…
Even limited voter rolls can be linked to identify people, research shows Your voter data could be used against you. A foreign intelligence service t…
French authorities have detained a 15-year-old suspected of involvement in a data breach at France Titres, the government agency responsible for issu…
The attacks likely target CVE-2026-41940, a recently patched zero-day leading to administrative access. The post Over 40,000 Servers Compromised in O…
OpenAI announced its intention to expand the Trusted Access for Cyber program for cyber defenders at the federal, state and local government levels
Hackers disrupted services and stole names, email addresses, student ID numbers, and user messages. The post Edtech Firm Instructure Discloses Data B…
A coordinated international operation involving U.S. and Chinese authorities has arrested at least 276 suspects and shut down nine scam centers used …
Security operations centers are running into the same wall everywhere. Detection tools generate more alerts than analysts can work through, and the e…
Office work in 2026 runs through a stack of mobile apps that sit on the same phones people use for banking, messaging family, and tracking their loca…
Prioritize resilience over productivity, say CISA, NCSC and their friends from Oz, NZ, Canada Information security agencies from the nations of the F…