Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software
A memory-corruption flaw in Google’s Brotli decoder sits in many programs that unpack Brotli-compressed data, among…
-
-
GoDaddy Revokes 404,607 SSL Certificates After Policy Errors
GoDaddy revoked 404,607 SSL (Secure Sockets Layer) and TLS (Transport Layer Security) certificates on October 21,…
-
MALFEX npm Package ‘imgdecode’ Hides Shellcode Loader in Windows Native Addon
Cybersecurity researchers have discovered a malicious npm package that’s part of a recently disclosed software supply…
-
Attackers Bypass WAFs to Exploit Oracle PeopleSoft Flaw and Deploy Web Shells
Ravie LakshmananSep 26, 2026Vulnerability / Web Security Google is warning of renewed mass exploitation of a known…
-
Can You Prove a New CVE Is Exploitable Before Attackers Do? Learn How in This Webinar
The Hacker NewsSep 19, 2026Security Operations / Artificial Intelligence A new CVE drops. Your scanner finds…
-
Berlin Refuses to Pay Hackers Who Stole Data From the City’s State Network
Berlin’s state government has confirmed that it is the target of an extortion attempt following the…
-
TikTok Agrees to $400 Million Settlement in U.S. Child Privacy Lawsuit
Ravie LakshmananAug 22, 2026Privacy / Regulation The U.S. Department of Justice (DoJ) announced on Friday that…
-
Attackers Exploit SharePoint Authentication Bypass After Public PoC Release
Ravie LakshmananAug 13, 2026Vulnerability / Enterprise Security Threat actors have begun to exploit a newly disclosed…
-
Hackers Poison Adform Script to Swap Crypto Wallet Addresses Across Customer Sites
Swati KhandelwalAug 01, 2026Web Security / Supply Chain Attack Attackers modified a JavaScript file served by…
-
Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patched Available
Swati KhandelwalJul 25, 2026Vulnerability / Application Security Security firms ThreatBook and Imperva say attackers are targeting…
-
New wp2shell WordPress Core Flaw Lets Unauthenticated Attackers Run Code
Updated July 18, 2026: the two flaws now carry CVE IDs, the full mechanism has been…
-
Critical Zimbra Flaw Could Let Crafted Emails Run Malicious Code in User Sessions
Ravie LakshmananJul 11, 2026Vulnerability / Email Security Zimbra is urging customers to apply updates to address…
-
U.S. Government Entity Paid Kairos $1 Million in Data-Theft Extortion Case
A U.S. government entity paid about $1 million to keep stolen files from being leaked, according…
-
OpenAI Previews GPT-5.6 Sol With Restricted Access and Stronger Cyber Safeguards
OpenAI on Friday released three versions of GPT-5.6, called Sol, Terra, and Luna, as a limited…
-
Hackers Exploit Gravity SMTP WordPress Plugin Bug to Expose API Keys
Ravie LakshmananJun 20, 2026Vulnerability / Web Security Threat actors are exploiting a recently patched security flaw…
-
Critical Splunk Enterprise Flaw Lets Attackers Run Code Without Authentication
Ravie LakshmananJun 13, 2026Vulnerability / Enterprise Software Splunk has released security updates to address a critical…
-
New ChatGPT Lockdown Mode Limits Tools That Could Enable Data Exfiltration
Ravie LakshmananJun 06, 2026Cybersecurity / Artificial Intelligence OpenAI has begun rolling out a new Lockdown Mode…
-
PAN-OS GlobalProtect Authentication Bypass (CVE-2026-0257) Under Active Exploitation
Ravie LakshmananMay 30, 2026Vulnerability / Network Security Palo Alto Networks has warned that a recently disclosed…
