Latest headlines from security outlets
Collected every two hours from specialised publications — each link leads to the original article.
Unpatched Flaw in Linux Pling Store Apps Could Lead to Supply-Chain Attac
Cybersecurity researchers have disclosed a critical unpatched vulnerability affecting Pling-based free and open-source software (FOSS) marketplaces for Linux p…
Hackers Exploited Fujitsu SaaS Targeting Japanese Govt Agencies In New Supply-Chain Attack
A serious cyber attack has recently been brought to the attention of numerous Japanese government…Hackers Exploited Fujitsu SaaS Targeting Japanese Govt Agenci…
Vulnerability In PHP Composer Package Could Allow Supply-Chain Attacks
A serious security vulnerability existed in the PHP Composer package. Exploiting this bug could allow…Vulnerability In PHP Composer Package Could Allow Supply-…
Critical LangChain Core Vulnerability Exposes Secrets via Serialization Injection
A critical security flaw has been disclosed in LangChain Core that could be exploited by an attacker to steal sensitive secrets and even influence large langua…
⚡ Weekly Recap: Chrome 0-Day, Router Hijacks, Coder Supply Chain Attack and More
Turning off email images should at least stop the pictures. This week, attackers had a workaround: a scannable QR code built out of text. It still appears, eve…
Ransomware Groups Turn to Citrix Bleed 2, BYOVD, and Supply Chain Credentials
Threat actors associated with the Anubis ransomware operation have been observed exploiting the Citrix Bleed 2 (CVE-2025-5777) vulnerability to obtain initial …
Linux Foundation Launches Akrites to Strengthen Software Supply Chain Security
The Linux Foundation has officially launched Akrites, a coordinated industry initiative designed to improve how critical open source vulnerabilities are valida…
ThreatsDay Bulletin: DNS Poisoning Flaw, Supply-Chain Heist, Rust Malware Trick and New RATs Rising
The comfort zone in cybersecurity is gone. Attackers are scaling down, focusing tighter, and squeezing more value from fewer, high-impact targets. At the same …
Malicious PyPI and npm Packages Discovered Exploiting Dependencies in Supply Chain Attacks
Cybersecurity researchers have discovered a malicious package in the Python Package Index (PyPI) repository that introduces malicious behavior through a depend…
Bybit Hack Traced to Safe{Wallet} Supply Chain Attack Exploited by North Korean Hackers
The U.S. Federal Bureau of Investigation (FBI) formally linked the record-breaking $1.5 billion Bybit hack to North Korean threat actors, as the company's CEO …
The Future of Container Security: Trends and Open Source Tools to Watch
Containers are among the many recent inventions of modern computing. They have emerged as the cornerstone of software development and deployment. They isolate …
New R Programming Vulnerability Exposes Projects to Supply Chain Attacks
A security vulnerability has been discovered in the R programming language that could be exploited by a threat actor to create a malicious RDS (R Data Serializ…
New BMC Supply Chain Vulnerabilities Affect Servers from Dozens of Manufacturers
Three different security flaws have been disclosed in American Megatrends (AMI) MegaRACBaseboard Management Controller (BMC) software that could lead to remote…
Chinese Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy CLEANGULP Malware
A Chinese threat actor codenamed UTA0565 has been observed exploiting the recently disclosed Google Chrome-Microsoft Windows exploit chain as zero-days through…
LiteLLM Vulnerability Chain: What Security Teams Running AI Gateways Need to Do Now
A three-CVE chain lets any default LiteLLM user escalate to admin and get a shell on the gateway server. A separate RCE is already in CISA's KEV. Here's what t…
Barracuda Flaws Could Be Chained to Bypass Authorization and Gain Root Access
Barracuda has disclosed details of two vulnerabilities affecting its products that, if chained together, could allow an attacker to bypass authorization contro…
Ivanti patches two more Connect Secure zero-days chained in attacks
Ivanti released security updates to patch two more Connect Secure (ICS) remote access gateway flaws that have been chained in zero-day attacks since at least O…
CISA warns of Fragnesia Linux flaw chained in PHP2Shell attacks
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned federal agencies to patch a high-severity Linux kernel privilege escalation bug that at…
Anthropic's Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits
An unreleased Anthropic AI model found security flaws in Chrome, Safari, Android, Windows, and Linux and chained them into working proof-of-concept exploits, t…
ShinyHunters-Exploited Oracle PeopleSoft Zero-Day Turns Out to Be Three Chained Flaws
The critical Oracle PeopleSoft bug that ShinyHunters has exploited since May is not one flaw but three chained together, the researchers who reported it said t…
Researchers Demonstrate OpenBSD Root Exploit Chaining 37-Year-Old Shared-Memory Bug
A local privilege escalation exploit published today gains root on OpenBSD 7.9 by chaining a roughly 37-year-old integer overflow with a separate kernel flaw, …
Researchers Used a Public OpenAI Model to Build a $250,000 Chrome Full-Chain Exploit in Six Days
A team at security firm XBOW chained three then-unknown Google Chrome bugs into a single attack that runs code on a Windows computer when the user only loads a…
Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access, Only Two Patched So Far
An attacker chained three zero-day flaws in Ivanti Connect Secure, a VPN appliance, to run commands as root without logging in, security firm Volexity said on …
Attackers Chain Artifactory Vulnerabilities to Take Over Repositories
On September 10, 2026, Wiz Research reported that multiple attackers had chained two Artifactory vulnerabilities against self-hosted repositories. One flaw gav…