The Mini Shai-Hulud campaign is a reminder that a poisoned package does not need months of persistence to create an enterprise incident. A few hours in the wrong dependency chain can be enough to...
The European Commission has issued preliminary findings accusing Meta Platforms Inc. of failing to adequately protect minors on its platforms, particularly Instagram and Facebook. The allegations...
A sophisticated cyberattack campaign has emerged targeting developers and DevOps environments by exploiting critical vulnerabilities in the Qinglong open-source task scheduler. Attackers leveraged...
On April 22, 2026, a sophisticated supply chain attack targeted Checkmarx's popular open source Infrastructure as Code (IaC) scanning tool KICS. Attackers gained access to official distribution...
Vimeo was not breached through a flashy exploit or a direct hit on its core video platform. The more important story is quieter: a trusted analytics integration became the path into downstream...
In the ever-evolving landscape of cyber threats, a new ransomware variant has emerged that challenges traditional assumptions about extortion-based attacks. VECT 2.0, a ransomware-as-a-service...
In a development that has sent ripples through the United Kingdom's cultural landscape, the hacker group known as M3RX has publicly claimed responsibility for a significant breach targeting Anvil...
April 2026 marks a significant escalation in the ongoing GlassWorm campaign, as security researchers from Socket have identified 73 malicious sleeper extensions on the Open VSX marketplace. These...
A critical zero-day vulnerability in the Litecoin network has recently been exploited to launch a large-scale denial-of-service (DoS) attack, temporarily disrupting operations across several major...
p>In a concerning development for the artificial intelligence and machine learning community, three consecutive versions of the popular Xinference Python package on PyPI were compromised with...
A low-privilege technician account should not become the master key to a remote support server. In vulnerable SimpleHelp deployments, CVE-2024-57726 breaks that boundary. The flaw allows...
A claimed breach at Udemy is not just another “user records” headline. If ShinyHunters’ claim proves accurate, the exposed data could give attackers a useful map of learners, instructors, corporate...
On April 24, 2026, ADT Inc. confirmed that unauthorized actors accessed a limited set of customer and prospective customer data. The confirmation followed public threats from the extortion group...
Two major US banks are now dealing with the same uncomfortable question: how much customer risk can sit outside the bank, inside a vendor’s environment, before it becomes the bank’s incident...
Bluesky, the decentralized social media platform, faced a prolonged and sophisticated distributed denial-of-service attack that began late on April 15, 2026. The incident started around 11:40 PM...
The most capable offensive-security AI model Anthropic has ever built was compromised not by a novel exploit chain, but by a contractor login and an educated guess about a URL pattern. That single...
For most cities, a cyber intrusion is a data problem. For Venice, it can become a water problem. That is what makes the reported breach of the Piazza San Marco flood-control environment so...
Loyalty programs are breach goldmines. They aggregate exactly what attackers want — verified identities, physical addresses, purchase histories, and contact details - all in one database, all tied to...
All Windows endpoints running Microsoft Defender face active exploitation of three privilege escalation and defense-degradation zero-days; only one has a patch, and two remain open with no...
On April 22, 2026, the emerging ransomware group BravoX publicly listed 1st Solution CTC as a new victim on its data leak site. The claim quickly gained attention in cybersecurity monitoring...