GlassWorm Campaign Deploys Zig Dropper Targeting Developer IDEs
Cybersecurity researchers have flagged yet another evolution of the ongoing GlassWorm campaign, which employs a new Zig dropper that's designed to stealthi
Cybersecurity
531 articles
Cisco Patches Critical Webex Flaw, Urges Customer Action
Cisco has released security updates to patch four critical vulnerabilities, including a fixed improper certificate validation flaw in the company's cloud-based
Fortinet Issues Emergency Patch for Critical FortiClient EMS Flaw
Fortinet has released out-of-band patches for a critical security flaw impacting FortiClient EMS that it said has been exploited in the wild. The vuln
Two Americans Sentenced for North Korean IT Worker Scheme
Two U.S. nationals have been sent to prison for helping North Korean remote information technology (IT) workers to pose as U.S. residents and get hired by over
Critical Flowise Flaw Exploited; 12K+ AI Instances at Risk
Threat actors are exploiting a maximum-severity security flaw in Flowise, an open-source artificial intelligence (AI) platform, according to new findings from V
McGraw Hill Breach Exposes 13.5M Student and Educator Accounts
The ShinyHunters extortion group has leaked data from 13.5 million McGraw Hill user accounts, stolen after breaching the company's Salesforce environment earlie
Android SDK Flaw Compromised 50M Users, Crypto Wallets at Risk
Details have emerged about a now-patched security vulnerability in a widely used third-party Android software development kit (SDK) called EngageLab&n
Windows Server 2025 April Update Faces Installation Issues
Microsoft is investigating an issue causing this month's KB5082063 security update to fail to install on some Windows Server 2025 systems. [...]
Drift Exchange Hit With $285M Theft Via Novel Nonce Attack
Solana-based decentralized exchange Drift has confirmed that attackers drained about $285 million from the platform during a security incident that took place o
Critical Nginx UI Flaw Exploited for Server Takeover
A critical vulnerability in Nginx UI with Model Context Protocol (MCP) support is now being exploited in the wild for full server takeover without authenticatio
North Korean Hackers Weaponize GitHub for Covert Attack Operations
Threat actors likely associated with the Democratic People's Republic of Korea (DPRK) have been observed using GitHub as command-and-control (C2) infrastru
WordPress Plugin Suite Compromised in Mass Malware Campaign
More than 30 WordPress plugins in the EssentialPlugin package have been compromised with malicious code that allows unauthorized access to websites running them
Docker Engine Flaw Exposes Critical Authorization Bypass Risk
A high-severity security vulnerability has been disclosed in Docker Engine that could permit an attacker to bypass authorization plugins (AuthZ) under spec
Signed Malware Disables Antivirus Across Critical Sectors
A digitally signed adware tool has deployed payloads running with SYSTEM privileges that disabled antivirus protections on thousands of endpoints, some in the e
Major Tech Firms Rush to Patch Record Security Bugs
Artificial intelligence platforms may be just as susceptible to social engineering as human beings, but they are proving remarkably good at finding security vul
Law Enforcement Agencies Tracked 500M Devices Using Ad Data Tool
Hungarian domestic intelligence, the national police in El Salvador, and several U.S. law enforcement and police departments have been attributed to the us
Microsoft Rewards Security Researchers With $2.3M
Microsoft has awarded $2.3 million to security researchers after receiving nearly 700 submissions during this year's Zero Day Quest hacking contest. [...]
Canvas Platform Faces Major Breach Affecting Millions of Students
An ongoing data extortion attack targeting the widely-used education technology platform Canvas disrupted classes and coursework at school districts and univers
Cisco Patches Critical IMC Flaw With 9.8 CVSS Score
Cisco has released updates to address a critical security flaw in the Integrated Management Controller (IMC) that, if successfully exploited, could allow a
Connected Trucks Face Growing Cybersecurity Threats
Modern trucks are rolling networks packed with sensors, connectivity, and attack surfaces, creating new cyber risks. NMFTA's Cybersecurity Conference brings ind
Brazilian DDoS Protection Firm Accused of Enabling Network Attacks
A Brazilian tech firm that specializes in protecting networks from distributed denial-of-service (DDoS) attacks has been enabling a botnet responsible for an ex
China-Linked Hackers Target European Governments
A China-aligned threat actor has set its sights on European government and diplomatic organizations since mid-2025, following a two-year period of min
Critical Windows Task Host Flaw Under Active Attack
CISA warned U.S. government agencies to secure their systems against a Windows Task Host privilege escalation vulnerability that could allow attackers to gain S
Scattered Spider Cybercriminal Pleads Guilty to Major Tech Hacks
A 24-year-old British national and senior member of the cybercrime group "Scattered Spider" has pleaded guilty to wire fraud conspiracy and aggravated identity
China-Linked Hackers Exploit Zero-Days to Deploy Medusa Ransomware
A China-based threat actor known for deploying Medusa ransomware has been linked to the weaponization of a combination of zero-day and N-day vulnerabilitie
Windows Server 2026 Update Triggers BitLocker Recovery Prompts
Microsoft confirmed on Tuesday that some Windows Server 2025 devices will boot into BitLocker recovery after installing the April 2026 KB5082063 Windows securit
Microsoft Patches 167 Vulnerabilities in April Security Update
Microsoft today pushed software updates to fix a staggering 167 security vulnerabilities in its Windows operating systems and related software, including a Shar
AI Browser Extensions Emerge as Major Security Blindspot
While much of the discussion on AI security centers around protecting ‘shadow’ AI and GenAI consumption, there's a wide-open window nobody's guar
Microsoft Patches Windows Server 2025 Unwanted Upgrade Bug
Microsoft has finally fixed a known issue that was causing systems running Windows Server 2019 and 2022 to "unexpectedly" upgrade to Windows Server 2025. [...]
Microsoft March Patch Tuesday: 77 Vulnerabilities Fixed
Microsoft Corp. today pushed security updates to fix at least 77 vulnerabilities in its Windows operating systems and other software. There are no pressing "zer
German Police Identify REvil Ransomware Leaders Behind 130 Attacks
Germany's Federal Criminal Police Office (aka BKA or the Bundeskriminalamt) has unmasked the real identities of two of the key figures associated with the now-d
Kraken Exchange Faces Extortion After Insider Security Breach
The Kraken cryptocurrency exchange announced that a cybercrime group is trying to extort the company by threatening to release videos showing internal systems t
Iran-Linked Hackers Wipe Data at Medical Device Giant Stryker
A hacktivist group with links to Iran's intelligence agencies is claiming responsibility for a data-wiping attack against Stryker, a global medical technology c
Hack-for-Hire Campaign Targets Journalists Across Middle East
An apparent hack-for-hire campaign likely orchestrated by a threat actor with suspected ties to the Indian government targeted journalists, activists, and
Microsoft Strengthens Windows Against Malicious Remote Desktop Attacks
Microsoft has introduced new Windows protections to defend against phishing attacks that abuse Remote Desktop connection (.rdp) files, adding warnings and disab
AI Agents Reshape Enterprise Security Landscape
AI-based assistants or "agents" -- autonomous programs that have access to the user's computer, files, online services and can automate virtually any task -- ar
WordPress Plugin Backdoor: Smart Slider 3 Pro Compromised
Unknown threat actors have hijacked the update system for the Smart Slider 3 Pro plugin for WordPress and Joomla to push a poisoned version containing a backdoo
100+ Malicious Chrome Extensions Discovered Stealing User Data
More than 100 malicious extensions in the official Chrome Web Store are attempting to steal Google OAuth2 Bearer tokens, deploy backdoors, and carry out ad frau
US, Canada, Germany Dismantle Four Massive IoT Botnets
The U.S. Justice Department joined authorities in Canada and Germany in dismantling the online infrastructure behind four highly disruptive botnets that comprom
Apple Rolls Out iOS 18.7.7 Update to Block DarkSword Exploit
Apple on Wednesday expanded the availability of iOS 18.7.7 and iPadOS 18.7.7 to a broader range of devices to protect users from the risk po
McGraw-Hill Confirms Data Breach Via Salesforce Misconfiguration
Education company McGraw-Hill has confirmed in a statement to BleepingComputer that hackers exploited a Salesforce misconfiguration and accessed its internal da
Counterfeit Ledger Live App Steals $9.5M in Crypto
A malicious Ledger Live app for macOS available from Apple's App Store has drained approximately $9.5 million in cryptocurrency from 50 victims in just a few da
Microsoft Rolls Out Windows 11 Updates KB5083769 and KB5082052
Microsoft has released Windows 11 KB5083769 and KB5082052 cumulative updates for versions 25H2/24H2 and 23H2 to fix security vulnerabilities, bugs, and add new
Microsoft Patches Windows 10 With Critical April 2026 Security Update
Microsoft has released the Windows 10 KB5082200 extended security update to fix the April 2026 Patch Tuesday vulnerabilities, including 2 zero-days. [...]
Microsoft Patches 167 Vulnerabilities in April 2026 Update
Today is Microsoft's April 2026 Patch Tuesday with security updates for 167 flaws, including 2 zero-day vulnerabilities. [...]
Zero Trust Security: 5 Ways to Strengthen Identity Protection
Stolen credentials remain a top breach vector, often leading to unchecked privilege escalation. Specops explains how identity-first Zero Trust limits access, en
Microsoft Fast-Tracks Windows Hardware Dev Account Reinstatement
Microsoft has rolled out a fast-track process to help developers regain access to accounts recently suspended from its Windows Hardware Program, following wides
Basic-Fit Data Breach Exposes Personal Information of 1M Members
Dutch fitness giant Basic-Fit announced that hackers breached its systems and gained access to information belonging to a million of its customers. [...]
Rockstar Games Data Breach: Analytics Stolen in Anodot Attack
Rockstar Games has suffered a data breach linked to a recent security incident at Anodot, with the ShinyHunters extortion gang now leaking the stolen data on it
OpenAI Rotates macOS Certificates After Supply Chain Attack
OpenAI is rotating potentially exposed macOS code-signing certificates after a GitHub Actions workflow executed a malicious Axios package during a recent supply