Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection
Ravie LakshmananNov 14, 2026Vulnerability / Network Security The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on…
-
-
Claude Code’s “Don’t Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHub
Passwords and API keys that developers typed into commands they approved in Claude Code are sitting…
-
Chainalysis Confirms Intrusion Into Internal Tools and Exposure of Customer Identity Data
Ravie LakshmananOct 31, 2026Data Security / Cyber Attack American blockchain analysis firm Chainalysis said it was…
-
Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software
A memory-corruption flaw in Google’s Brotli decoder sits in many programs that unpack Brotli-compressed data, among…
-
GoDaddy Revokes 404,607 SSL Certificates After Policy Errors
GoDaddy revoked 404,607 SSL (Secure Sockets Layer) and TLS (Transport Layer Security) certificates on October 21,…
-
MALFEX npm Package ‘imgdecode’ Hides Shellcode Loader in Windows Native Addon
Cybersecurity researchers have discovered a malicious npm package that’s part of a recently disclosed software supply…
-
Attackers Bypass WAFs to Exploit Oracle PeopleSoft Flaw and Deploy Web Shells
Ravie LakshmananSep 26, 2026Vulnerability / Web Security Google is warning of renewed mass exploitation of a known…
-
Can You Prove a New CVE Is Exploitable Before Attackers Do? Learn How in This Webinar
The Hacker NewsSep 19, 2026Security Operations / Artificial Intelligence A new CVE drops. Your scanner finds…
-
Berlin Refuses to Pay Hackers Who Stole Data From the City’s State Network
Berlin’s state government has confirmed that it is the target of an extortion attempt following the…
-
TikTok Agrees to $400 Million Settlement in U.S. Child Privacy Lawsuit
Ravie LakshmananAug 22, 2026Privacy / Regulation The U.S. Department of Justice (DoJ) announced on Friday that…
-
Attackers Exploit SharePoint Authentication Bypass After Public PoC Release
Ravie LakshmananAug 13, 2026Vulnerability / Enterprise Security Threat actors have begun to exploit a newly disclosed…
-
Hackers Poison Adform Script to Swap Crypto Wallet Addresses Across Customer Sites
Swati KhandelwalAug 01, 2026Web Security / Supply Chain Attack Attackers modified a JavaScript file served by…
-
Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patched Available
Swati KhandelwalJul 25, 2026Vulnerability / Application Security Security firms ThreatBook and Imperva say attackers are targeting…
-
New wp2shell WordPress Core Flaw Lets Unauthenticated Attackers Run Code
Updated July 18, 2026: the two flaws now carry CVE IDs, the full mechanism has been…
-
Critical Zimbra Flaw Could Let Crafted Emails Run Malicious Code in User Sessions
Ravie LakshmananJul 11, 2026Vulnerability / Email Security Zimbra is urging customers to apply updates to address…
-
U.S. Government Entity Paid Kairos $1 Million in Data-Theft Extortion Case
A U.S. government entity paid about $1 million to keep stolen files from being leaked, according…
-
OpenAI Previews GPT-5.6 Sol With Restricted Access and Stronger Cyber Safeguards
OpenAI on Friday released three versions of GPT-5.6, called Sol, Terra, and Luna, as a limited…
-
Hackers Exploit Gravity SMTP WordPress Plugin Bug to Expose API Keys
Ravie LakshmananJun 20, 2026Vulnerability / Web Security Threat actors are exploiting a recently patched security flaw…
