Cybersecurity
Seiko USA Website Defaced in Data Theft Attack
The Seiko USA website was defaced over the weekend, displaying a message from attackers claiming they stole its Shopify customer database and threatening to lea
#security
184 articles
Cybersecurity
Microsoft Teams Targeted in Enterprise Helpdesk Impersonation Attacks
Microsoft is warning of threat actors increasingly abusing external Microsoft Teams collaboration and relying on legitimate tools for access and lateral movemen
Cybersecurity
Critical Vulnerabilities Expose Popular Software to Active Attacks
This week had real hits. The key software got tampered with. Active bugs showed up in the tools people use every day. Some attacks didn’t ev
Science & Tech
WordPress Plugin Supply Chain Attack Hits Thousands of Sites
Dozens of WordPress plugins were allegedly hijacked to push malware after they were sold to a new corporate owner.
Cybersecurity
British Scattered Spider Leader Pleads Guilty to Crypto Theft
A British man, believed to be the leader of the Scattered Spider cybercrime collective, has pleaded guilty in the United States to charges of wire fraud and agg
Cybersecurity
North Korean Hackers Behind Axios npm Package Supply Chain Attack
The maintainer of the Axios npm package has confirmed that the supply chain compromise was the result of a highly-targeted social engineering campaign orch
Gadgets
OpenAI CEO's Home Targeted in Second Attack
OpenAI CEO Sam Altman's house may have been the target of a second attack after San Francisco Police Department arrested two suspects for a reported shooting in
Cybersecurity
Security Threats Escalate: Pre-Auth Chains and Android Rootkits
The latest ThreatsDay Bulletin is basically a cheat sheet for everything breaking on the internet right now. No corporate fluff or boring lectures her
Cybersecurity
Security Threats Surge: Legacy Flaws Meet Modern Attack Methods
Thursday. Another week, another batch of things that probably should've been caught sooner but weren't. This one's got some range — old vulnerabilitie
Cybersecurity
Vercel Confirms Security Breach, Hackers Claim Data Sale
Cloud development platform Vercel has disclosed a security incident after threat actors claimed to have breached its systems and are attempting to sell stolen d
Cybersecurity
Open Source Security Report Reveals Enterprise Consumption Trends
In December 2025, we shared the first-ever The State of Trusted Open Source report, featuring insights from our product data and customer base on open
Cybersecurity
Apple's Account Alerts Weaponized in iPhone Phishing Campaign
Apple account change notifications are being abused to send fake iPhone purchase phishing scams within legitimate emails sent from Apple's servers, increasing l
Gadgets
Federal Prosecutors Demand Reddit Reveal Identity of ICE Critic
Immigration and Customs Enforcement has a certain Redditor in its crosshairs and it's now strong-arming the social media platform to reveal who they are with a
Cybersecurity
Critical Protobuf.js Flaw Exposes JavaScript Apps to Remote Code Execution
Proof-of-concept exploit code has been published for a critical remote code execution flaw in protobuf.js, a widely used JavaScript implementation of Google's P
Science & Tech
China's Cable-Cutter Demo Raises Internet Infrastructure Concerns
China cable-cutter demo coincides with more sabotage of subsea Internet cables.
Cybersecurity
CISA Contractor Exposed AWS Keys in Major Gov Data Leak
Until this past weekend, a contractor for the Cybersecurity & Infrastructure Security Agency (CISA) maintained a public GitHub repository that exposed cred
Cybersecurity
Cyber Criminals Deploy RATs and Miners via Fake Software
A financially motivated operation codenamed REF1695 has been observed leveraging fake installers to deploy remote access trojans (RATs) and
Cybersecurity
1,000+ ComfyUI Instances Hijacked in Cryptomining Botnet Blitz
An active campaign has been observed targeting internet-exposed instances running ComfyUI, a popular stable diffusion platform, to enlist them into a cryptocurr
Cybersecurity
How Cybercriminals Evaluate Stolen Card Marketplaces
In cybercrime markets, trust isn't assumed, it's verified. Flare reveals how underground guides teach actors to evaluate carding shops based on data quality, re
Cybersecurity
SparkCat Malware Returns: New Variant Targets Crypto Wallets
Cybersecurity researchers have discovered a new version of the SparkCat malware on the Apple App Store and Google Play Store, more than a year after t
Science & Tech
Adobe Patches Critical PDF Vulnerability Exploited Since November
It's not clear how many people were compromised by this hacking campaign, but a security researcher said the hackers were targeting victims since at least Novem
Cybersecurity
North Korean Hackers Distribute 1,700 Malicious Packages Across Developer Ecosystems
The North Korea-linked persistent campaign known as Contagious Interview has spread its tentacles by publishing malicious packages targeting the Go, R
Cybersecurity
Windows Zero-Days Under Active Exploitation
Threat actors are exploiting three recently disclosed Windows security vulnerabilities in attacks aimed at gaining SYSTEM or elevated administrator permissions.
Cybersecurity
Memphis Man Sentenced to 30 Months for DraftKings Account Theft
23-year-old Kamerin Stokes of Memphis, Tennessee, was sentenced to 30 months in prison for selling access to tens of thousands of hacked DraftKings accounts. [.
Cybersecurity
Linux Servers Under Attack: PHP Web Shells Hide Commands in Cookies
Threat actors are increasingly using HTTP cookies as a control channel for PHP-based web shells on Linux servers and to achieve remote code execution, acco
Cybersecurity
Iran-Linked Hackers Target 300+ Israeli Microsoft 365 Accounts
An Iran-nexus threat actor is suspected to be behind a password-spraying campaign targeting Microsoft 365 environments in Israel and the U.A.E. amid o
Cybersecurity
Iran-Linked Hackers Target U.S. Critical Infrastructure
Iran-affiliated cyber actors are targeting internet-facing operational technology (OT) devices across critical infrastructures in the U.S., including programmab
Cybersecurity
AI-Powered Voice Phishing Platform ATHR Automates Credential Theft
A new cybercrime platform called ATHR can harvest credentials via fully automated voice phishing attacks that use both human operators and AI agents for the soc
Cybersecurity
Developer Machines Exposed: The LiteLLM Supply Chain Risk
The most active piece of enterprise infrastructure in the company is the developer workstation. That laptop is where credentials are created, tested,
Cybersecurity
AI Security Tools Fall Short: Why Alert Triage Isn't Enough
AI-powered SOC tools promise automation, but most only speed up triage instead of reducing real workload. Tines shows how real gains come from end-to-end workfl
Science & Tech
Hacked Crosswalk Announcements Expose Critical Infrastructure Gap
Last April, a hacker hijacked crosswalk announcements to mimic Mark Zuckerberg and Elon Musk. Records obtained by WIRED reveal how unprepared local authorities
Cybersecurity
Hackers Exploit Next.js Flaw to Breach 766 Sites, Steal Credentials
A large-scale credential harvesting operation has been observed exploiting the React2Shell vulnerability as an initial infection vector to steal
Cybersecurity
Critical Marimo Flaw Exploited to Deploy NKAbuse Malware
Hackers are exploiting a critical vulnerability in Marimo reactive Python notebook to deploy a new variant of NKAbuse malware hosted on Hugging Face Spaces. [..
Cybersecurity
Google Launches DBSC Security Feature in Chrome 146
Google has made Device Bound Session Credentials (DBSC) generally available to all Windows users of its Chrome web browser, months after it began
Cybersecurity
Google Deploys Gemini AI to Combat Malicious Ads
Google says it is increasingly using its Gemini AI models to detect and block harmful ads on its advertising platforms, as scammers and threat actors continue t
Cybersecurity
GlassWorm Campaign Deploys Zig Dropper Targeting Developer IDEs
Cybersecurity researchers have flagged yet another evolution of the ongoing GlassWorm campaign, which employs a new Zig dropper that's designed to stealthi
Cybersecurity
Fortinet Issues Emergency Patch for Critical FortiClient EMS Flaw
Fortinet has released out-of-band patches for a critical security flaw impacting FortiClient EMS that it said has been exploited in the wild. The vuln
Cybersecurity
Two Americans Sentenced for North Korean IT Worker Scheme
Two U.S. nationals have been sent to prison for helping North Korean remote information technology (IT) workers to pose as U.S. residents and get hired by over
Science & Tech
Anodot Breach Impacts Major Companies in Data Theft
The data breach at Anodot, which affects customers like Rockstar Games, is the latest hack aimed at stealing data from a large number of corporate giants.
Cybersecurity
Critical Flowise Flaw Exploited; 12K+ AI Instances at Risk
Threat actors are exploiting a maximum-severity security flaw in Flowise, an open-source artificial intelligence (AI) platform, according to new findings from V
Cybersecurity
McGraw Hill Breach Exposes 13.5M Student and Educator Accounts
The ShinyHunters extortion group has leaked data from 13.5 million McGraw Hill user accounts, stolen after breaching the company's Salesforce environment earlie
Cybersecurity
Drift Exchange Hit With $285M Theft Via Novel Nonce Attack
Solana-based decentralized exchange Drift has confirmed that attackers drained about $285 million from the platform during a security incident that took place o
Cybersecurity
Critical Nginx UI Flaw Exploited for Server Takeover
A critical vulnerability in Nginx UI with Model Context Protocol (MCP) support is now being exploited in the wild for full server takeover without authenticatio
Cybersecurity
North Korean Hackers Weaponize GitHub for Covert Attack Operations
Threat actors likely associated with the Democratic People's Republic of Korea (DPRK) have been observed using GitHub as command-and-control (C2) infrastru
Cybersecurity
WordPress Plugin Suite Compromised in Mass Malware Campaign
More than 30 WordPress plugins in the EssentialPlugin package have been compromised with malicious code that allows unauthorized access to websites running them
Cybersecurity
Docker Engine Flaw Exposes Critical Authorization Bypass Risk
A high-severity security vulnerability has been disclosed in Docker Engine that could permit an attacker to bypass authorization plugins (AuthZ) under spec
Cybersecurity
Signed Malware Disables Antivirus Across Critical Sectors
A digitally signed adware tool has deployed payloads running with SYSTEM privileges that disabled antivirus protections on thousands of endpoints, some in the e
Cybersecurity
Major Tech Firms Rush to Patch Record Security Bugs
Artificial intelligence platforms may be just as susceptible to social engineering as human beings, but they are proving remarkably good at finding security vul
Cybersecurity
Law Enforcement Agencies Tracked 500M Devices Using Ad Data Tool
Hungarian domestic intelligence, the national police in El Salvador, and several U.S. law enforcement and police departments have been attributed to the us
Cybersecurity
Microsoft Rewards Security Researchers With $2.3M
Microsoft has awarded $2.3 million to security researchers after receiving nearly 700 submissions during this year's Zero Day Quest hacking contest. [...]