Shai-Hulud malware worms Red Hat npm package versions downloaded 80K times a week
TeamPCP? Or copycat malware dev?
Security & Lifecycle News
Aggregated from vendor advisories, security research, and industry publications.
Hackers hijack thousands of sites for ClickFix and FakeUpdate attacks
A threat actor tracked as DriveSurge has been operating large-scale malware distribution campaigns using ClickFix and FakeUpdates techniques on compromised sites. [...]
Red Hat npm packages compromised to steal developer credentials
More than 30 npm packages under Red Hat's '@redhat-cloud-services' namespace were compromised in a supply-chain attack that distributed a new variant of the Shai-Hulud credential-s…
Spain arrests doxer leaking sensitive data of govt employees
The Spanish National Police has arrested an individual for leaking sensitive information related to members of various key state organizations, including the National Cybersecurity…
Anthropic to Open Mythos AI to EU's ENISA
The European security agency's entry to Project Glasswing is the result of "strong bilateral cooperation" between the European Commission and Anthropic.
Election interlopers register 5K+ domains, hope to catch some voting phish
Hacking voting machines is so 2017. Phishing, impersonation pose the real election risks
Can Chinese memory maker CXMT help relieve the memory shortage?
As the DRAM shortage continues with no end in sight, China-based ChangXing Memory Technologies (CXMT) is taking advantage of an opportunity to grow its base. Until now, CXMT has…
Microsoft's Zero-Day Legal Threats Spark Backlash
After a disgruntled security researcher published several zero-day exploits in recent weeks, Microsoft seemingly indicated criminal charges were in order.
Broadcom, Samsung team for wireless SoC
Broadcom and Samsung Electronics are collaborating on a new, broadband-optimized reference platform for the global fixed wireless access (FWA) market, integrating Broadcom’s Wi-Fi …
WP Maps Pro Vulnerability Exploited to Take Over WordPress Sites
The security defect (CVE-2026-8732) allows unauthenticated attackers to create administrative accounts on the affected installations. The post WP Maps Pro Vulnerability Exploited t…
Dashlane password manager users locked out by brute force attacks
Multiple Dashlane users have been locked out of their accounts following brute-force attacks that attempted logins from distant locations and unknown devices. [...]
Anthropic, now atop the AI bubble, files for its IPO
First it tops OpenAI's valuation, then it beats Altman to the IPO punch
Dutch Police Dismantle Massive 17-Million-Device Botnet
Dutch authorities seized command-and-control servers tied to a botnet of infected computers, smartphones, and tablets that was allegedly used to power a residential proxy network a…
Miasma Supply Chain Attack Compromises Red Hat npm Packages with Credential-Stealing Worm
A new Mini Shai-Hulud supply chain attack campaign, codenamed Miasma, has compromised @redhat-cloud-services packages to steal credentials and secrets from developer machines and d…
NB577: Cisco Brings SONiC to N9000 Switches; Broadcom Debuts Wi-Fi 8 SoCs for Consumer Routers
Take a Network Break! We start with listener followup and a red alert affecting ScadaBR, an open source SCADA controller. On the news front, Forward adds predictive testing to its…
Hackers Used Meta’s AI Support Bot to Seize Instagram Accounts
The Instagram accounts for the Obama White House and the Chief Master Sergeant of the U.S. Space Force were briefly defaced with pro-Iranian images and messages over the weekend, a…
WordPress malware campaign hides payloads in Steam profiles
Nearly 2,000 WordPress websites were infected with malware that relies on Steam Community profile comments to hide command-and-control (C2) data. [...]
Vulnerability Disclosure in the Age of AI
New article: “Responsible Disclosure in the Age of AI: A Call for Urgent Action,” by Melissa Hathaway. Abstract: Artificial intelligence is fundamentally reshaping the balance betw…
US firms still dominate chip subsidies
China's support is greater relative to semiconductor industry revenue
Agentic AI arrives for Delphi and C++ Builder
Kai is an extension for RAD Studio (Delphi and C++ Builder) that integrates with external AI providers
Critical Windows Netlogon Vulnerability in Attackers’ Crosshairs
Organizations are advised to patch CVE-2026-41089 as soon as possible, given its severity, the potential ongoing exploitation. The post Critical Windows Netlogon Vulnerability in A…
Ohio hits pause on datacenter tax breaks draining its coffers
Buckeye State found it had inadvertently joined the billion dollar losers' club
Microsoft investigates Office Apps, Teams file access issues
Microsoft says an ongoing incident is preventing users of its Teams collaboration platform and Office for the web cloud-based productivity suite from opening files. [...]
_Sergey_Tarasov_Alamy.png?width=720&quality=80&disable=upscale)
Patch Now: Another Palo Alto Auth Bypass Bug Under Active Exploit
Exploiting the PAN-OS GlobalProtect VPN vulnerability requires certain conditions, but adversaries have done so in two attack waves that started in mid-May.
GTA cheat service Atlas Menu hacked as attacker alleges screenshot spying
A database containing 64,000 user records was published to GitHub after an attacker claimed to have compromised all Atlas systems
Race Against Time: Why Faster Vulnerability Alerts Matter
Attackers are exploiting vulnerabilities faster than many organizations can identify and patch them. SecAlerts explains why faster vulnerability alerts can help reduce exposure and…
⚡ Weekly Recap: New Linux Flaw, PAN-OS Exploit, AI-Powered Attacks, OAuth Phishing and More
Monday hit like a cron job with anger issues. A busted auth path here, a repo-side faceplant there, some "patched-ish" thing already getting chewed on in the wild, and then the us…
California passes bill declaring death-by-algorithm to 3D-printed ghost guns
Last-hour amendments aim to allay privacy concerns, but broad scepticism about feasibility remains
Dragos Acquires xIoT Security Firm Phosphorus
Dragos said customers will soon gain expanded asset visibility and integrated device intelligence, with automated remediation workflows and a unified platform experience to follow.…
Agent-led devs need serverless OpenSearch, Amazon claims
System relies on a proprietary storage layer as AWS moves to separate storage and compute to fit mega AI demands