1. CrowdSec suffered a data breach involving 170 private repositories after attackers used an OAuth token stolen from a former employee via a supply chain attack (darkreading.com).
2. Japan Digital Agency confirmed a data breach affecting 246000 records after attackers exploited a vulnerability in a VPN appliance (research.checkpoint.com).
3. CISA added the Zyxel GS1900 series switch vulnerability CVE-2026-7273 to its Known Exploited Vulnerabilities catalog due to active exploitation (thehackernews.com).
4. North Korean threat actors in the Contagious Interview campaign compromised 30000 devices and stole 10.71 million dollars in cryptocurrency (thehackernews.com).
5. A critical WordPress vulnerability dubbed Comment2Shell tracked as CVE-2026-93485 allows anonymous users to achieve remote code execution via admin sessions (thehackernews.com).
6. The SideCopy threat actor is targeting academic institutions in India using spear-phishing lures and ReverseRAT malware (thehackernews.com).
7. BigCommerce merchants were impacted by a data breach where attackers compromised third-party Ribon application credentials to inject malicious scripts (bleepingcomputer.com).
8. CISA issued a warning regarding the active exploitation of three Linux kernel vulnerabilities, including one rated as critical (bleepingcomputer.com).
9. A fake LastPass Authenticator installer on GitHub uses a Microsoft-signed kernel driver to disable security software before deploying a password stealer (thehackernews.com).
10. ShinyHunters defaced the Clop ransomware group website and claimed to have stolen victim data, raising concerns about renewed extortion (darkreading.com).
11. A security researcher demonstrated a proof-of-concept where malware on a Mac can hijack the Meta Muse AI assistant by modifying a hidden setting (thehackernews.com).
12. A PowerShell backdoor campaign named TASK STOMP is actively harvesting sensitive documents, Wi-Fi passwords, and clipboard data from compromised hosts (thehackernews.com).
Be First to Comment