8 posts were published in the last hour 10:3 : AsyncAPI Supply Chain Attack Deploys Miasma Backdoor Through Trusted npm Workflows 10:3 : AI nudify apps spark legal scrutiny of Apple and Google’s profits 10:2 : Clover Health Investments Discloses…
AsyncAPI Supply Chain Attack Deploys Miasma Backdoor Through Trusted npm Workflows
AsyncAPI’s npm ecosystem suffered a coordinated supply chain compromise on July 14, 2026, delivering a Miasma‑associated Node.js backdoor through trusted GitHub Actions–driven release workflows and exposing high‑value developer and CI/CD environments to remote access, credential theft, and further lateral movement.…
AI nudify apps spark legal scrutiny of Apple and Google’s profits
Instead of fighting over what app stores host, the San Francisco City Attorney is targeting how they make money from AI nudify apps. This article has been indexed from Malwarebytes Read the original article: AI nudify apps spark legal scrutiny…
Clover Health Investments Discloses Data Breach
Using social engineering, hackers compromised employee accounts with access to personal and health information. The post Clover Health Investments Discloses Data Breach appeared first on SecurityWeek. This article has been indexed from SecurityWeek Read the original article: Clover Health Investments…
US Hospital Finance Software Provider Craneware Reports Data Theft
Craneware, a provider of financial software for US healthcare organizations, has disclosed a cyber incident involving unauthorized access and data theft This article has been indexed from www.infosecurity-magazine.com Read the original article: US Hospital Finance Software Provider Craneware Reports Data…
Estée Lauder discloses data breach tied to Oracle EBS vulnerability
Cosmetics company Estée Lauder disclosed a data breach tied to a vulnerability in Oracle E-Business Suite (EBS) used for the company’s human resources operations. Estée Lauder is one of the largest beauty companies in the world, known for its prestige…
AWS wants GuardDuty to automate the first steps of threat investigations
Amazon GuardDuty investigation agent is now in public preview. The feature provides AI-powered investigations of GuardDuty findings, AWS accounts and AWS organizations, helping security teams reduce investigation time. During the public preview, the investigation agent is available at no additional…
Researchers Uncover North Korean ‘ClickFake’ Campaign Targeting Web3 Pros
In a new campaign, North Korean hacking group Famous Chollima targeted crypto professionals through ClickFix lures to deliver Windows and macOS trojans This article has been indexed from www.infosecurity-magazine.com Read the original article: Researchers Uncover North Korean ‘ClickFake’ Campaign Targeting…
Meta Addictiveness Trial Begins In Tennessee
In latest case, state of Tennessee accuses Meta of knowingly offering harmful product to youths, lying about safety This article has been indexed from Silicon UK Read the original article: Meta Addictiveness Trial Begins In Tennessee
Iran-Linked APT42 Uses AI-Assisted Phishing and TAMECAT Backdoor to Target Defense Officials
Iran-linked APT42 is escalating its espionage operations with AI-assisted phishing and an expanded TAMECAT backdoor, enabling long-lived access to defense and government identities rather than just endpoints. Recent activity shows tightly integrated social engineering, cloud abuse, and fileless PowerShell tradecraft…
Hackers Exploit SonicWall SMA Zero-Days to Gain Root Access and Deploy ORANGETAIL Webshell
An ongoing exploitation of two zero-day vulnerabilities in SonicWall Secure Mobile Access (SMA) devices. These vulnerabilities allowed a threat actor, identified as UTA0533, to gain root-level access, install persistent malware, and deploy the ORANGETAIL Java webshell on vulnerable VPN appliances.…
New Project CAV3RN module abuses Outlook calendar events for C2 and DNS AAAA records for configuration recovery
Kaspersky GReAT experts describe a new Project CAV3RN C2 module. It uses Outlook calendar for communication via Microsoft Graph and has a backup connection via DNS AAAA responses. This article has been indexed from Securelist Read the original article: New…
Exploitation of ServiceNow Vulnerability Seen Days After Disclosure
The ServiceNow AI platform vulnerability tracked as CVE-2026-6875 can be exploited for remote code execution. The post Exploitation of ServiceNow Vulnerability Seen Days After Disclosure appeared first on SecurityWeek. This article has been indexed from SecurityWeek Read the original article:…
Open-source maintainers still work underfunded as sponsorship crosses $100 million
A maintainer patches a library late at night that ships inside thousands of products, and no invoice follows. Sebastián Ramírez and Caleb Porzio spent years in that position. Ramírez, known as tiangolo, builds tools that other Python projects depend on.…
WordPress wp2shell Exploitation Grows as Public Exploit Fuels Mass Scanning
Attackers have begun to exploit two critical vulnerabilities in WordPress that, when combined together, enable unauthenticated remote code execution (RCE) and complete compromise of vulnerable websites. The two security flaws, tracked as CVE-2026-63030 and CVE-2026-60137, have been codenamed wp2shell. “By…
Apple Sends Letters To Dozens Of OpenAI Staff Amid Legal Claims
Apple reportedly sends letters directly to dozens of former employees now working at OpenAI, as it seeks preservation of data This article has been indexed from Silicon UK Read the original article: Apple Sends Letters To Dozens Of OpenAI Staff…
Abbott Confirms Cyberattack After Unauthorized Access to Cancer Diagnostics Systems
Abbott has disclosed a cybersecurity incident involving unauthorized access to a limited number of internal systems used by its Cancer Diagnostics business. Upon discovering the activity, the company acted swiftly by launching an investigation, engaging external cybersecurity experts, and coordinating…
Zimbra Update Patches Critical Vulnerabilities
The latest Zimbra refresh resolves command injection, XSS, restriction bypass, and SSRF security defects. The post Zimbra Update Patches Critical Vulnerabilities appeared first on SecurityWeek. This article has been indexed from SecurityWeek Read the original article: Zimbra Update Patches Critical…
Ukraine Strikes Target Russian E-Commerce Giant
Overnight drone strikes hit two warehouses operated by largest Russian e-commerce operation Wildberries, as conflict continues This article has been indexed from Silicon UK Read the original article: Ukraine Strikes Target Russian E-Commerce Giant
Alibaba, Moonshot Release Powerful Open-Weight AI Models
Moonshot AI says open-weight Kimi K3 approaches performance of US closed-source frontier models, while Alibaba previews Qwen3.8 This article has been indexed from Silicon UK Read the original article: Alibaba, Moonshot Release Powerful Open-Weight AI Models
Snap Reaches Tentative Settlement In Second Addiction Case
Snapchat parent says it has agreed tentative settlement deal in second case out of thousands alleging social media design harmed young people This article has been indexed from Silicon UK Read the original article: Snap Reaches Tentative Settlement In Second…
Critical Gitea Flaw Lets Public-Only Tokens Write to Private Repositories and Trigger Actions Workflows
Gitea administrators are strongly encouraged to upgrade their systems following the discovery of a critical authorization vulnerability. This flaw allows public-only API tokens to modify private pull request branches and potentially trigger Gitea Actions workflows. The vulnerability, tracked as CVE-2026-58443…
AgentBaiting Uses Fake AI Skills and MCP Servers to Deliver SmartLoader and StealC Malware
AgentBaiting is the clearest sign yet that AI agents and their capability ecosystems have become a first‑class malware delivery surface, with FakeGit’s 7,600‑repo operation pushing SmartLoader and StealC directly into AI Skills and MCP workflows. By turning agent‑readable READMEs, public…
Linux Kernel Team Publishes 440 CVE Security Advisories Within 24 Hours
The Linux kernel security team published approximately 440,440 CVE advisories over 24 hours, reflecting a significant release of vulnerability records linked to fixes already incorporated into the upstream kernel tree. These notices were distributed through the linux-cve-announce mailing list between…