Latest headlines from security outlets
Collected every two hours from specialised publications — each link leads to the original article.
MavenGate Attack Could Let Hackers Hijack Java and Android via Abandoned Libraries
Several public and popular libraries abandoned but still used in Java and Android applications have been found susceptible to a new software supply chain attac…
Bad.Build Flaw in Google Cloud Build Raises Concerns of Privilege Escalation
Cybersecurity researchers have uncovered a privilege escalation vulnerability in Google Cloud that could enable malicious actors tamper with application images…
Alert: Million of GitHub Repositories Likely Vulnerable to RepoJacking Attack
Millions of software repositories on GitHub are likely vulnerable to an attack called RepoJacking, a new study has revealed.This includes repositories from org…
Trojanized Windows 10 Installer Used in Cyberattacks Against Ukrainian Government Entities
Government entities in Ukraine have been breached as part of a new campaign that leveraged trojanized versions of Windows 10 installer files to conduct post-ex…
Hackers Exploit Cloud Video Platform To Target Real Estate Websites
Researchers have discovered a severe supply-chain attack that plants web skimmers on real-estate websites via…Hackers Exploit Cloud Video Platform To Target Re…
Latest Firefox 95 Includes RLBox Sandboxing to Protect Browser from Malicious Code
Mozilla is beginning to roll out Firefox 95 with a new sandboxing technology called RLBox that prevents untrusted code and other security vulnerabilities from …
New 'Trojan Source' Technique Lets Hackers Hide Vulnerabilities in Source Code
A novel class of vulnerabilities could be leveraged by threat actors to inject visually deceptive malware in a way that's semantically permissible but alters t…
A New Critical SolarWinds Zero-Day Vulnerability Under Active Attack
SolarWinds, the Texas-based company that became the epicenter of aÂmassive supply chain attackÂlate last year, has issued patches to contain a remote code exec…
Kaseya Releases Patches for Flaws Exploited in Widespread Ransomware Attack
Florida-based software vendor Kaseya on SundayÂrolled out urgent updates to address critical security vulnerabilities in its Virtual System Administrator (VSA)…
Cybersecurity Webinar ' SolarWinds Sunburst: The Big Picture
The SolarWinds Sunburst attack has been in the headlines since it was first discovered in December 2020.ÂAs the so-called layers of the onion are peeled back, …
Why CII best practices gold badges are importa
''A CII Best Practices badge, especially a gold badge, shows that an OSS project has implemented a large number of good practices to keep the project sustainab…
Mageia 2020-0018: jss security upda
Updated jss packages fix security vulnerability: A flaw was found in the "Leaf and Chain" OCSP policy implementation in JSS CryptoManager, where it implicitly…
Volt Typhoon Used Covert Silent Train Network in Four Zero-Day Exploitation Campaigns
The China-nexus cyber espionage group known as Volt Typhoon has been attributed to a now-disrupted covert access network dubbed Silent Train that has been put …
Volt Typhoon hides zero-day attacks using 'Silent Train' framework
Chinese state-sponsored hacking group Volt Typhoon has been using a framework that relies on rotating chains of connected devices compromised on demand, includ…
Silent Lynx Exploits WinRAR Flaw to Deploy Reverse Shell in CIS Government Attacks
The threat actor known as Silent Lynx has been attributed to a fresh set of attacks targeting government organizations across the Commonwealth of Independent S…
AhsayCBS Flaws Exploited to Deploy Web Shells Get New Fixes After Incomplete Patches
Singapore-based Ahsay Backup has released security updates to address two security flaws in AhsayCBS that have been exploited by bad actors to drop web shells …
P7 DarkSword iOS Exploit Kit Adds Crypto Wallet Data Theft and Remote Commands
Cybersecurity researchers have disclosed details of a previously unseen variant of the DarkSword iOS exploit kit called P7 DarkSword. "Compared with the varian…
Fedora 44 perl-Dancer2 Major Deserialization Vulnerability 2026-3b893ccf2d
Dancer2::Serializer::YAML::deserialize handed request bodies straight to YAML::Load. A body tagged !!perl/hash:Some::Class therefore instantiated an arbitrary …
Fedora 45 perl-Dancer2 Critical Deserialization Exploit 2026-5e3eab9a07
Dancer2::Serializer::YAML::deserialize handed request bodies straight to YAML::Load. A body tagged !!perl/hash:Some::Class therefore instantiated an arbitrary …
17,000 URLs Reveal How ClickFix Turns Trusted Websites Into Malware Traps: Report by CTM360
ClickFix has become the most common way attackers get into enterprise networks, and it does it without an exploit, an attachment, or a file on disk. Our new gl…
Fedora 43 Stunnel Severity Important Bypass Security Issue 2026-de8630b736
Fedora 43 has updated stunnel to version 5.80, addressing security vulnerabilities and bugs while introducing new features such as full-chain CRL verification …
OpenAI Launches GPT-5.6-Cyber with Reduced Safeguards for Exploit Development
OpenAI on Monday unveiled a new cybersecurity-focused model called GPT‑5.6‑Cyber that it said is focused on vulnerability research, penetration testing, and in…
A Skipped Cookie Check Let Flatpak Apps Escape PipeWire’s Sandbox Entirely
CVE-2026-5674 chains a broken PulseAudio auth check, default module loading, and an unrestricted dlopen() into a full PipeWire sandbox escape from inside Flatp…
wp2shell: WordPress Patches a Pre-Auth RCE That Needed No Plugins
WordPress 6.9.5 and 7.0.2 fix wp2shell, a core REST API bug chaining route confusion and SQL injection into unauthenticated remote code execution.wp2shell: Wor…