Federal buyers, the FDA, and the EU’s CRA era all want your software’s ingredients list and next year’s CVE will interrogate the SBOMs you generate today.…
Category: Cyber Security News
npm Trusted Publishing Flaw With 10 Million Downloads Exposes 1,500+ Packages to Malicious Takeover
A security flaw in npm’s Trusted Publishing feature exposed more than 1,500 packages to possible takeover through reclaimed GitHub repository names. The…
Critical SonicWall Vulnerability Exploited in Attacks Following Disclosure
A critical SonicWall SMA1000 flaw, CVE-2026-102255 (CVSS 10.0), is being actively exploited days after disclosure, allowing unauthenticated attackers to…
Critical Progress MarkLogic Flaws Enable Remote Code Execution and Admin Takeover
Progress released urgent security updates for MarkLogic Server to fix a broad set of critical and high-severity flaws that could let attackers gain…
GhostProfile macOS Malware Clones Browser Profiles to Hijack Live Sessions
A newly reported macOS malware called GhostProfile clones browser profiles and lets attackers control hidden copies of Chrome or Firefox using the…
Kimsuky Operation GitPower Uses GitHub to Deliver Malware and Steal Data
Kimsuky is using GitHub and other trusted code platforms to deliver malware, run commands, and steal data from Ukrainian experts in diplomacy, security,…
Amazon Fire TV Cube 3 Exploit Enables Root Access and Bootloader Unlock
A public exploit package now lets owners of Amazon’s third-generation Fire TV Cube gain persistent root access and unlock the bootloader on firmware…
Critical MariaDB Flaws Can Let Attackers Execute Code and Steal Database Data
MariaDB has disclosed security flaws that, under specific conditions, could let attackers run code, access restricted database tables, and steal login…
Massive DDoS Attack Disrupts Ubuntu’s Canonical Websites and Security APIs
Canonical, the company behind Ubuntu Linux, suffered a sustained distributed denial-of-service attack on October 8, 2026, disrupting its main websites and…
LG webOS Flaws Let Remote Attackers Execute Commands as Root Without Authentication
Security researchers have disclosed four serious vulnerabilities in LG webOS smart TVs that could allow an attacker to bypass authentication, create a…
WordPress Plugin Vulnerability Exploited in Attacks to Upload and eEecute Arbitrary PHP code
Attackers are targeting a critical security flaw in the Bricksforge WordPress plugin that lets them upload and run arbitrary PHP code without logging in.…
Yandex Data Center Outage Disrupts Access to Cloud Files Following Drone Attack
Yandex has confirmed a major service outage after drone attacks damaged three data centers in Russia, leaving some users unable to access cloud files. Two…
Ledger Confirms Unauthorized Hardware Implant in Crypto Wallet Sold by CryptoBilis
Ledger has confirmed that a cryptocurrency hardware wallet linked to reported fund losses contained an unauthorized hardware implant, bringing physical…
Attackers Reportedly Hack Supermarket Fridges and Raise Temperatures to 50°C
French supermarket chains are dealing with a major cybersecurity incident after attackers reportedly changed refrigeration settings remotely, causing some…
Critical GitLab Vulnerability Enables Arbitrary Code Execution Attacks on Servers
GitLab has released urgent security updates to fix a critical vulnerability that could allow attackers to execute arbitrary code on affected servers…
Google DevSite Flaw Let Attackers Execute Remote Code Through Forged Flask Sessions
A critical vulnerability in Google’s shared DevSite platform could have allowed an unauthenticated attacker to forge Flask session cookies and trigger…
Google AitM Phishing Kit Uses WebSockets to Bypass MFA in Real Time
A Google account phishing kit uses live WebSocket connections to guide victims through fake sign-in screens, relay authentication requests, and steal…
Ahold Delhaize Takes Systems Offline Following Cybersecurity Incident
Ahold Delhaize has taken some systems offline after identifying a security issue within its network, the food retail group said on October 12, 2026. The…
WhatsApp Attachment Deploys Malware That Gains SYSTEM Access on Windows
A malicious WhatsApp attachment is being used to deploy a Windows remote access trojan that can reach SYSTEM-level access, giving its operators deep…
New Unicode Characters Let Attackers Create Convincing Lookalike Domains for Phishing
Security researchers have found new ways to build fake domains that resemble trusted brands while still appearing as readable Unicode in Chromium-based…