A new coordinated cross-ecosystem software supply chain attack campaign has targeted npm, PyPI, and Crates.io to distribute credential-stealing malware. The campaign, codenamed TrapDoor, spans...
As attackers ramp up their AI exploit development, the search for software vulnerabilities is changing rapidly.
Ransomware attacks have evolved into one of the most disruptive cyber threats facing businesses today. From healthcare institutions and manufacturing units to government agencies and small...
AI flaw-finder still under lock and key for now while company figures out guardrails, but made available to more users including governments
The FBI is warning about the Kali365 phishing-as-a-service platform (PhaaS) that is used to hijack Microsoft 365 accounts by abusing OAuth device code authentication to steal session tokens and...
A data breach involving PartsWarehouse.com was reported in May 2026. See incident details, impact on customers, and recommended security measures.
A data breach involving Cardinal Services was reported in May 2026. See incident details, impact on customers, and recommended security measures.
A data breach involving Pease Mountain Law was reported in May 2026. See incident details, impact on customers, and recommended security measures.
A data leak involving Trump Mobile was reported in May 2026. See incident details, impact on customers, and recommended security measures.
A data breach involving playdragonica.eu was reported in May 2026. See incident details, impact on customers, and recommended security measures.
A data breach involving United Medical Systems was reported in May 2026. See incident details, impact on customers, and recommended security measures.
A data breach involving Parker Lipman was reported in May 2026. See incident details, impact on customers, and recommended security measures.
A data breach involving MAS Law was reported in May 2026. See incident details, impact on customers, and recommended security measures.
A data breach involving SCU was reported in May 2026. See incident details, impact on customers, and recommended security measures.
A data breach involving Morningstar Properties was reported in May 2026. See incident details, impact on customers, and recommended security measures.
A large-scale campaign is exploiting a critical SQL injection vulnerability (CVE-2026-26980) in Ghost CMS to inject malicious JavaScript code that triggers ClickFix attack flows. [...]
With increasing levels of connectivity within industrial environments, traditional notion of trusted users, devices, and networks being fundamentally... The post Zero trust in OT moves beyond...
The University of Mississippi Medical Center may have violated federal privacy law following a ransomware attack that crippled its systems in February, according to a 3 On Your Side investigation....
In April 2026, 7-Eleven was the victim of a "pay or leak" extortion campaign by ShinyHunters, with the data later published that month. The incident exposed 185k unique email addresses, along with...
Researchers identified multiple coordinated software supply chain attacks targeting Composer/Packagist packages and upstream GitHub repositories. The activity involved malicious postinstall hooks,...
GitHub has rolled out new controls for npm to improve the security of the software supply chain, giving maintainers the ability to explicitly approve a release prior to the packages becoming...
A new "coordinated" supply chain attack campaign has impacted eight packages on Packagist including malicious code designed to run a Linux binary retrieved from a GitHub Releases URL. "Although...
Anthropic on Friday disclosed that Project Glasswing has helped uncover more than 10,000 high- or critical-severity vulnerabilities across some of the most "systemically" important software across...
A supply chain attack targeting the Laravel Lang localization packages has exposed developers to a sophisticated credential-stealing malware campaign after attackers abused GitHub version tags to...
Cybersecurity researchers have flagged a fresh software supply chain attack campaign that has targeted multiple PHP packages belonging to Laravel-Lang to deliver a comprehensive...
What Happened:On 11 May 2026, the UK Information Commissioner’s Office (ICO) fined South Staffordshire Water £963,900 after the Cl0p ransomware group lurked completely undetected in its network...
A maximum-severity security vulnerability impacting LiteSpeed User-End cPanel Plugin has come under active exploitation in the wild. The flaw, tracked as CVE-2026-48172 (CVSS score: 10.0), relates...
Or is it just life today, with AI constantly digging through code repositories in search of security holes?
Dirty Frag, Copy Fail, and Fragesia show the new reality
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a recently patched critical security flaw impacting Drupal Core to its Known Exploited Vulnerabilities (KEV) catalog,...