Hackers are exploiting CVE-2026-88771, a critical Citrix NetScaler vulnerability, to run commands, install web shells, and collect appliance configuration…
Tag: Cyber Security News
GhostAction Supply Chain Campaign Uses Malicious GitHub Actions to Steal CI/CD Credentials
A new wave of the GhostAction supply chain campaign has compromised 772 public GitHub repositories, using fake GitHub Actions workflow files to steal…
GitHub AI Can Spot Passwords Hidden in Code Before Developers Push Them
GitHub, with Microsoft Applied Sciences, introduced an AI-powered ModernBERT classifier that detects hidden passwords before code is pushed, expanding…
PoC Released for Critical LMCache Flaw Enabling Unauthenticated Remote Code Execution
A proof-of-concept (PoC) exploit has been released for a critical vulnerability in LMCache that can allow unauthenticated remote code execution on exposed…
Hackers Use Negative Hotel Reviews to Spread Malware That Hides C2 on Blockchain
Hackers are targeting hotels with fake guest complaints and negative reviews that lead staff to malware disguised as photographic evidence. The campaign…
Hackers Allegedly Selling VirusTotal API Keys on the Dark Web
A seller allegedly offered a VirusTotal Enterprise API key for $350 in an October 7 Dark Web Informer post, but the claim remains unverified, with no…
Hackers Use Web3 and Blockchain C2 to Hide Supply Chain Attacks Targeting Cloud Credentials
Threat actors are increasingly turning public blockchain networks into a command-and-control (C2) layer for software supply chain malware, helping them…
PoC Released for Zammad Session Leak Flaw Enabling Remote Code Execution
A public PoC targets a critical Zammad flaw, CVE-2026-102489, allowing unauthenticated remote users to steal active session cookies and potentially…
wolfSSH 1.6.0 Fixes 5 Security Flaws Including Critical MITM Host Key Verification Bypass
wolfSSL has released wolfSSH 1.6.0 to fix five security flaws, including a critical host key verification bypass that could let an attacker impersonate an…
Gitea Patches 27 Security Flaws, Including Critical SSH Authentication Bypass and SSRF
Gitea has released security updates addressing 27 reported flaws across versions 28.0.0 and 28.1.0, including a critical SSH authentication bypass and…
Solo Hacker Used AI Tools to Breach South Korean Financial Organizations and Steal Data
A suspected lone threat actor used an AI-powered penetration-testing tool called ARTEX to breach several South Korean financial organizations and steal…
Royal Navy Service Member Charged with Spying for a Foreign Country
A serving Royal Navy member has been charged with spying for an unnamed foreign country after an investigation by Counter Terrorism Policing London. Teddy…
Top 10 Best API Security Tools in 2026 [Ranked & Scored]
Your API count is wrong every traffic-based discovery deployment proves it and business-logic abuse rides valid-looking requests straight past WAF…
Top 10 Best Software Supply Chain Security Tools in 2026 [Ranked & Scored]
The supply chain is four attack surfaces wearing one buzzword dependencies, pipelines, artifacts, and base images and no vendor covers all four. We scored…
Hackers Use GitHub-Hosted Poem to Control PoeLLM Malware Targeting AI Infrastructure
Hackers are using a poem hosted on GitHub to guide PoeLLM malware toward its command-and-control servers, turning exposed AI infrastructure into a growing…
Critical Cisco Nexus Flaws Let Unauthenticated Attackers Execute Code With Root Privileges
Cisco has released security updates for three critical vulnerabilities in Nexus 3000 and 9000 Series switches that could let remote attackers run code…
MALFEX npm Malware Hides Executables in PNG Files to Infect Windows Developers
A long-running npm malware campaign called MALFEX is targeting Windows developers with remote access tools, data stealers, and hidden downloaders. The…
Top 10 Best Secrets Detection Tools in 2026 [Ranked & Scored]
Attackers don’t crack what they can copy and leaked API keys sit in git history, Slack threads, and cloud workloads waiting. Evaluating the landscape…
Hackers Registered New Domain with Exact Microsoft Teams Interface to Steal Logins
A newly registered website is copying the Microsoft Teams login page and full user interface, raising concerns about a phishing attempt aimed at stealing…
PoC Released for Critical VMware VMXNET3 Flaw Enabling Guest-to-Host Code Execution
A public proof of concept is now available for CVE-2026-59346, a critical integer overflow flaw in VMware’s VMXNET3 virtual network adapter, released by…