malicious
-
Typosquatting Alert: Malicious “tanstack” NPM Package Targets Developer Credentials via Stealthy Exfiltration
The open-source ecosystem faces a renewed threat as a sophisticated typosquatting campaign has been identified targeting the TanStack community. A…
Read More » -
The Rise of Bluekit: A Centralized, All-in-One Phishing Framework for Modern Cybercrime
The landscape of social engineering is undergoing a significant structural shift. A newly identified phishing framework, dubbed “Bluekit,” is moving…
Read More » -
SAP Developer Ecosystem Compromise: The Mini Shai-Hulud npm Supply Chain Attack
A sophisticated supply chain attack struck the SAP developer ecosystem on April 29, 2026, affecting four widely used npm packages…
Read More » -
Critical Authentication Bypass in cPanel/WHM: CVE-2026-41940 and the cPanelSniper Exploit
The web hosting ecosystem is currently facing a significant security crisis. A critical zero-day vulnerability, tracked as CVE-2026-41940, is being…
Read More » -
The EtherRAT Campaign: Exploiting SEO Poisoning and Blockchain Resilience to Target High-Privilege Identities
A sophisticated new cyber threat, dubbed “EtherRAT,” is currently traversing enterprise environments, signaling a shift toward highly targeted, infrastructure-resilient malware…
Read More » -
The Rise of Spyware-as-a-Service: How “KidsProtect” is Commercializing Digital Stalking
A sophisticated new threat is emerging in the Android ecosystem, signaling a dangerous shift in how surveillance malware is distributed.…
Read More » -
The Evolution of Evasion: How Phishing is Moving Beyond Malware to High-Fidelity Hosted Flows
The threat landscape is undergoing a fundamental architectural shift. As traditional Phishing-as-a-Service (PhaaS) platforms face increasing pressure from law enforcement,…
Read More » -
Exim Mail Server Releases Version 4.99.2 to Patch Memory Corruption and DoS Vulnerabilities
The development team behind the Exim Mail Transfer Agent (MTA) has officially deployed version 4.99.2. This release is a high-priority…
Read More » -
The CI/CD Pipeline as a Weapon: New Jenkins-Based Botnet Targets Valve Source Engine Infrastructure
In a striking demonstration of how lateral movement can occur from administrative tools to global disruption, a new DDoS botnet…
Read More » -
Wireshark 4.6.5 Patches Critical Code Execution and DoS Vulnerabilities
For network engineers and security researchers, Wireshark is the industry-standard “microscope” used to examine the granular details of network traffic.…
Read More » -
Shadow-Earth-053 Espionage Campaign Exploiting Legacy Microsoft Infrastructure
Security researchers have identified a sophisticated, multi-stage espionage campaign orchestrated by a China-aligned threat actor designated as SHADOW-EARTH-053. Since at…
Read More » -
The CAPTCHA Trap: How Fraudsters Leverage SMS Pumping and Social Engineering
A sophisticated new cyber fraud campaign has emerged, shifting the battlefield from traditional device infection to the exploitation of telecom…
Read More » -
From Ruby to Go: Analyzing a Multi-Vector Software Supply Chain Compromise
A highly coordinated software supply chain attack has been identified, tracing its origins back to the BufferZoneCorp GitHub account. This…
Read More » -
Critical OS Command Injection Vulnerability (CVE-2026-6644) in ASUSTOR ADM
A high-severity security flaw has been identified within the ASUSTOR Data Master (ADM) operating system, posing a significant risk to…
Read More » -
Jenkins Addresses High-Severity Path Traversal and XSS Vulnerabilities in Key Plugins
The Jenkins Project has issued an urgent security advisory detailing seven distinct vulnerabilities spanning several widely adopted plugins. These flaws…
Read More » -
Critical Authentication Bypass and RCE Vulnerabilities Detected in Qinglong Task Scheduler
Security researchers and threat intelligence feeds have identified active exploitation of two severe authentication bypass vulnerabilities within Qinglong, a widely…
Read More »