1. The jscrambler npm package release 8.14.0 was compromised to drop and execute a malicious Rust infostealer on Windows, macOS, and Linux systems (https://thehackernews.com/2026/07/compromised-jscrambler-8140-npm-release.html).
2. Suspected China and India aligned threat actors conducted sustained cyber espionage campaigns against the Balochistan Police portal between February 2024 and April 2026 (https://thehackernews.com/2026/07/hackers-weaponize-balochistan-police.html).
3. Progress Software urged ShareFile customers to shut down Storage Zone Controllers due to a credible external security threat (https://thehackernews.com/2026/07/urgent-progress-tells-sharefile.html).
4. The Injective Labs SDK GitHub repository was compromised to distribute a malicious npm package designed to steal cryptocurrency wallet keys (https://thehackernews.com/2026/07/injective-labs-github-compromise-pushes.html).
5. A critical stored cross site scripting vulnerability in the Zimbra Classic Web Client allows attackers to execute malicious code via crafted emails (https://thehackernews.com/2026/07/critical-zimbra-flaw-could-let-crafted_0483473395.html).
6. Six new vulnerabilities in the U Boot bootloader could allow attackers to crash devices or execute arbitrary code at boot time (https://thehackernews.com/2026/07/six-new-u-boot-flaws-could-let.html).
7. Researchers identified a Ghostcommit technique where prompt injections hidden in images trick AI agents into exfiltrating repository secrets (https://www.bleepingcomputer.com/news/security/ghostcommit-hides-prompt-injection-in-images-to-fool-ai-agents-steal-secrets/).
8. The Australian Cyber Security Centre issued an alert regarding a global campaign targeting vulnerable content management systems and plugins (https://www.bleepingcomputer.com/news/security/australia-warns-of-global-campaign-targeting-vulnerable-cms-platforms/).
9. Hackers are actively exploiting a critical authentication bypass vulnerability in the official Gitea Docker image (https://www.bleepingcomputer.com/news/security/hackers-exploit-critical-auth-bypass-in-gitea-docker-image/).
10. A member of the Ryuk ransomware group pleaded guilty in a US court and faces up to 15 years in prison (https://www.bleepingcomputer.com/news/security/ryuk-ransomware-member-pleads-guilty-in-the-us-faces-15-years-in-prison/).
11. Dutch police found strong indications that local hackers were involved in the February data breach at telecommunications provider Odido (https://www.bleepingcomputer.com/news/security/police-suspects-dutch-hackers-were-involved-in-odido-breach/).
12. A new Rust based remote access trojan named MODBEACON, attributed to the Silver Fox group, uses gRPC streaming for encrypted command and control traffic (https://thehackernews.com/2026/07/new-modbeacon-rat-uses-grpc-streaming.html).
13. An unpatched vulnerability nicknamed XRING in the XQUIC library allows remote clients to crash HTTP/3 servers using ordinary traffic (https://thehackernews.com/2026/07/unpatched-xring-flaw-in-xquic-lets.html).
14. A phishing campaign is using fake Microsoft Entra passkey enrollment requests to target Microsoft 365 users for data extortion (https://thehackernews.com/2026/07/hackers-use-fake-microsoft-entra.html).
15. An exposed hacker server revealed the operation of WP SHELLSTORM, which has backdoored thousands of WordPress sites (https://thehackernews.com/2026/07/exposed-hacker-server-reveals-wp.html).
Be First to Comment