The internet has seen a sharp rise in botnet-driven threats over the past year, with much of the activity tracing back to one of the most influential malware families in modern history — Mirai. First discovered in 2016, Mirai was…
Category: Cyber Security News
Open Directory Malware Campaign Uses Obfuscated VBS, PNG Loaders and RAT Payloads
A sophisticated multi-stage malware campaign has surfaced, deploying obfuscated Visual Basic Script (VBS) files, PNG-embedded loaders, and remote access trojans (RATs) to target systems without leaving a trace on disk. What began as a routine endpoint detection in early 2026…
China-Linked Hackers Breach Southeast Asian Military Systems in Long-Running Spy Campaign
A sophisticated and long-running cyber espionage campaign, tracked as CL-STA-1087, has been quietly targeting military organizations across Southeast Asia since at least 2020. The operation, assessed with moderate confidence to be linked to a China-aligned threat actor, focuses on collecting strategic…
Linux Ransomware Pay2Key Attacking Organizations Ervers, Virtualization Hosts, and Cloud Workloads
Linux has long been considered a more secure operating system than Windows, but that reputation is being tested. A ransomware group known as Pay2Key, attributed to Iranian threat actors, has developed a Linux variant that is actively targeting organizational servers,…
SmartApeSG ClickFix Campaign Delivers Remcos, NetSupport RAT, StealC and Sectop RAT
A threat campaign known as SmartApeSG — also tracked under the names ZPHP and HANEYMANEY — has been observed pushing multiple strains of malware through a social engineering technique called ClickFix. The campaign, active as recently as March 24, 2026,…
macOS Threats Are the Biggest Security Gap in 2026: How SOC Teams Close It
macOS has become a standard part of modern business environments, especially across engineering, product, and leadership teams. That makes it a growing security concern: when a Mac used by a high-access employee is compromised, it can lead to stolen credentials,…
Node.js Patches Multiple Vulnerabilities That Enable DoS Attacks and Process Crashes
The Node.js project released a critical security update on March 24, 2026, for the Long-Term Support (LTS) branch, designating version 20.20.2 ‘Iron’ as a security release. The update resolves seven tracked vulnerabilities spanning TLS error handling, HTTP/2 flow control, cryptographic…
Firefox 149.0 Released With Free Built-in VPN With 50 GB Monthly Data Limit
Mozilla has officially rolled out Firefox 149.0 to the Release channel on March 24, 2026, delivering a massive update focused heavily on user privacy and security hardening. The standout addition in this release is a free built-in VPN offering 50 GB of protected…
OpenAI to Shut Down Sora Video Platform, Pivots to Enterprise and Developer Tools
OpenAI is pulling the plug on its Sora video generation platform, a high-profile product launched to widespread attention last year that has since quietly faded from the spotlight. The shutdown is part of a broader strategic realignment as the company…
Firefox 149 Released With Patch for 37 Vulnerabilities that Enables Remote Attacks
Mozilla released Firefox 149 on March 24, 2026, delivering one of the largest security advisories in the browser’s recent history, addressing 37 vulnerabilities spanning memory corruption, sandbox escapes, use-after-free flaws, and remote code execution risks across multiple browser components. Published…
F5 NGINX Plus and Open Source Vulnerability Allow Attackers to Execute Code Using MP4 file
A high-severity vulnerability has been disclosed affecting both NGINX Open Source and NGINX Plus. Tracked formally as CVE-2026-32647, this security flaw carries a CVSS v4.0 base score of 8.5 and a CVSS v3.1 score of 7.8. It allows local, authenticated…
Five Malicious npm Packages Target Crypto Developers, Exfiltrate Wallet Keys via Telegram
The cryptocurrency development community is facing a serious supply chain threat after five malicious npm packages were discovered stealing private wallet keys and forwarding them directly to a Telegram bot. Published under the npm account “galedonovan,” these packages were crafted…
Russian Initial Access Broker Sentenced to Prison for Enabling Ransomware Attacks on U.S. Firms
Aleksei Volkov, a 26-year-old Russian national, has been sentenced to 81 months in federal prison for operating as an Initial Access Broker (IAB). His illicit activities directly enabled major cybercrime syndicates, including the notorious Yanluowang ransomware group, to compromise numerous…
Multiple TP-Link Vulnerabilities Allow Attackers to Execute Arbitrary Commands on System
TP-Link has recently issued a critical security advisory addressing multiple high-severity vulnerabilities impacting its Archer NX series routers. These flaws, which affect the Archer NX200, NX210, NX500, and NX600 models, expose devices to severe risks. If exploited, threat actors could…
Hackers Exploiting Magento to Execute Remote Code and Gain Complete Account Access
A critical unrestricted file upload vulnerability, dubbed “PolyShell,” is actively being exploited in Magento and Adobe Commerce stores. Discovered by the Sansec Forensics Team, this flaw allows unauthenticated attackers to execute remote code (RCE) and completely take over accounts. With…
LiteLLM PyPI Package With 95 Million Downloads Compromised by TeamPCP Hackers
A widely used open-source Python library was compromised on the Python Package Index (PyPI). Versions 1.82.7 and 1.82.8 of the package, which route requests across various LLM providers and have over 95 million monthly downloads, were found to contain a…
FCC Banned Foreign-made Consumer Routers Over Security Risks
The Federal Communications Commission (FCC) announced a major update to its Covered List, officially prohibiting the approval of new consumer-grade network routers produced in foreign countries. This regulatory action prevents these new devices from entering the United States market by…
Google Authenticator’s Hidden Passkey Architecture Could Open New Passwordless Attack Paths
Passwordless authentication was supposed to mark the end of account takeovers. Designed to replace traditional passwords with cryptographic keys tied to physical devices, it promised a future where stolen credentials could no longer unlock user accounts. But a close examination…
ClawHub Vulnerability Let Attackers Manipulate Rankings to Become the #1 Skill
Security research team has uncovered a critical vulnerability in ClawHub, the public skills registry for the OpenClaw agentic ecosystem. This flaw allowed attackers to artificially inflate the download counts of malicious skills, thereby bypassing security checks and manipulating search rankings.…
LiteLLM Python Package With 95 Million Downloads Compromised by TeamPCP Hackers
A widely used open-source Python library was compromised on the Python Package Index (PyPI). Versions 1.82.7 and 1.82.8 of the package, which route requests across various LLM providers and have over 95 million monthly downloads, were found to contain a…