A massive software supply chain attack has targeted the official Checkmarx KICS (Keeping Infrastructure as Code Secure) Docker Hub repository. Discovered on April 22, 2026, by Docker and Socket, the compromise involves trojanized Docker images and malicious VS Code extensions…
Fake TradingView AI Site Spreads Needle Stealer Through Phony TradingClaw App
A fake TradingView AI agent website is delivering Needle Stealer malware through a bogus “TradingClaw” assistant that can hijack victims’ browsers, drain financial accounts, and enable follow‑on attacks. The campaign targets traders seeking automated strategies on TradingView, capitalizing on the…
Apple Fixes Notification Privacy Flaw That Allowed FBI to Access Deleted Signal Messages
Apple released iOS 26.4.2 and iPadOS 26.4.2 on April 22, 2026, to patch a critical notification privacy vulnerability that allowed law enforcement to extract Signal message content from iPhones — even after the app had been deleted. The flaw, tracked…
15 Identity Providers Your B2B SaaS Must Support to Close Enterprise Deals
Struggling to close enterprise deals? Discover the 15 essential Identity Providers (IdPs) your B2B SaaS must support to meet strict security requirements. The post 15 Identity Providers Your B2B SaaS Must Support to Close Enterprise Deals appeared first on Security…
IT Security News Hourly Summary 2026-04-23 09h : 5 posts
5 posts were published in the last hour 6:32 : Strategic autonomy: Where you get to choose 6:31 : Tropic Trooper Uses Custom Beacon and VS Code Tunnels for Stealthy Remote Access 6:31 : Apple Patches Privacy Issue Exposing Signal…
Strategic autonomy: Where you get to choose
Cybersecurity has a control problem. Most providers force you into a corner, where you must either accept their ‘black box’ ecosystems… or go without elite protection. It’s a choice between being safe and staying in control. And it’s a choice…
Tropic Trooper Uses Custom Beacon and VS Code Tunnels for Stealthy Remote Access
A new Tropic Trooper campaign that combines a trojanized PDF reader, a custom AdaptixC2 Beacon listener, and Visual Studio (VS) Code tunnels to gain and maintain remote access to targeted systems. The operation appears to focus on Chinese-speaking individuals in…
Apple Patches Privacy Issue Exposing Signal Message Data Through Notifications
Apple recently rolled out iOS 26.4.2 and iPadOS 26.4.2 to patch a critical privacy vulnerability affecting millions of users. Released on April 22, 2026, this vital security update addresses a flaw that could accidentally expose sensitive message data from secure…
Claude Mythos Exposes 271 Zero-Day Security Flaws in Firefox
Mozilla has released Firefox 150, addressing a staggering 271 zero-day vulnerabilities. The security team identified these latent flaws using Anthropic’s early-stage Claude Mythos Preview AI model. This massive cleanup represents a major shift in how tech companies detect and defend…
DARWIS Taka: A Web Vulnerability Scanner with AI-Powered Validation
DARWIS Taka, a new web vulnerability scanner, is now available for free and runs via Docker. It pairs a rules-based scanning engine with an optional AI layer that reviews each finding before it reaches the report, aimed squarely at the…
Scenario: Open-source framework for automated AI app red-teaming
Enterprises running customer service bots, data analytics agents, and other AI-driven applications in production handle sensitive records and connect to core business systems every day. LangWatch has released Scenario, an open-source framework that runs automated red-team exercises against AI agents…
A year in, Zoom’s CISO reflects on balancing security and business
In this Help Net Security interview, Sandra McLeod, CISO at Zoom, reflects on her first year in the role. She talks about moving from reactive firefighting to business strategy, and what she heard from engineers, the board, and customers during…
Ransomware, fraud, and lawsuits drive cyber insurance claims to new peaks
The 2026 InsurSec Report from At-Bay, covering more than 100,000 policy years of claims data, documents a 7% year-over-year rise in overall claim frequency and an all-time high average severity of $221,000. Ransomware severity reached $508,000, up 16% from the…
GDPR works, but only where someone enforces it
A new measurement study of web tracking across ten countries offers a reality check for anyone working on privacy compliance. Researchers crawled the same set of globally popular websites from virtual machines located in Australia, Brazil, Canada, Germany, India, Singapore,…
Google Expands Gemini in Gmail, Forcing Billions to Reconsider Privacy, Control, and AI Dependence
Google has introduced one of the most extensive updates to Gmail in its history, warning that the scale of change driven by artificial intelligence may feel overwhelming for users. While some discussions have focused on surface-level changes such as…
ISC Stormcast For Thursday, April 23rd, 2026 https://isc.sans.edu/podcastdetail/9904, (Thu, Apr 23rd)
This post doesn’t have text content, please click on the link below to view the original article. This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article: ISC Stormcast For Thursday, April 23rd, 2026…
Checkmarx KICS Official Docker Repo Compromised to Inject Malicious Code
A significant supply chain attack targeting the official checkmarx/kics Docker Hub repository, where threat actors pushed trojanized images capable of harvesting and exfiltrating sensitive developer credentials and infrastructure secrets. Docker’s internal monitoring flagged suspicious activity around KICS image tags on…
Automated ML-driven threat hunting in post-quantum encrypted MCP streams
Learn how automated ML-driven threat hunting secures post-quantum encrypted MCP streams against tool poisoning and prompt injection in AI infrastructure. The post Automated ML-driven threat hunting in post-quantum encrypted MCP streams appeared first on Security Boulevard. This article has been…
IT Security News Hourly Summary 2026-04-23 03h : 1 posts
1 posts were published in the last hour 0:31 : Thales named a 2026 Google Partner of the Year – Infrastructure Modernization: Sovereign Cloud Category
Thales named a 2026 Google Partner of the Year – Infrastructure Modernization: Sovereign Cloud Category
Thales named a 2026 Google Partner of the Year – Infrastructure Modernization: Sovereign Cloud Category josh.pearson@t… Wed, 04/22/2026 – 23:56 Thales was recognized with a 2026 Google Cloud Partner of the Year award in the Infrastructure Modernization: Sovereign Cloud category.…
Another npm supply chain worm is tearing through dev environments
Plus, the payload references ‘TeamPCP/LiteLLM method’ Yet another npm supply-chain attack is worming its way through compromised packages, stealing secrets and sensitive data as it moves through developers’ environments, and it shares significant overlap with the open source infections attributed…
109 Fake GitHub Repositories Used to Deliver SmartLoader and StealC Malware
A large-scale malware distribution campaign has been uncovered involving 109 fake GitHub repositories that were used to trick users into downloading two dangerous malware tools named SmartLoader and StealC. The campaign was carefully built around cloned versions of legitimate open-source…
EN, SentinelLabs - We are hunters, reversers, exploit developers, and tinkerers shedding light on the world of malware, exploits, APTs, and cybercrime across all platforms.
LABScon25 Replay | Are Your Chinese Cameras Spying For You Or On You?
Marc Rogers and Silas Cutler expose how cheap smart home devices conceal a shadow supply chain of shell companies, firmware flaws, and foreign data routing. This article has been indexed from SentinelLabs – We are hunters, reversers, exploit developers, and…
Anthropic’s super-scary bug hunting model Mythos is shaping up to be a nothingburger
And that unauthorized access? ‘A nothing burger,’ hacking startup CEO tells El Reg Anthropic’s Mythos model is purportedly so good at finding vulnerabilities that the Claude-maker is afraid to make it available to the general public for fear that criminals…