News about security failures, exploits and vulnerabilities in systems
The OAuth architecture was designed to facilitate interoperability between services: a user gives permission to an application to act on his behalf without sharing his password. T…
Google has reconfigured its vulnerability rewards programs forand, at the same time, adjust to the low payments for vulnerabilities whose detection has become trivial with artific…
A critical vulnerability in Weaver (also known as Fanwei) E-cology, a platform for office automation and business collaboration, is being actively exploited in real environments. …
A critical failure in the Weaver Eco-cology office automation platform (identified as CVE-2026-22679) has been actively exploited since mid-March to execute discovery commands on …
In recent weeks, a particularly worrying phenomenon has been observed: malicious actors are taking advantage of the legitimate service of Amazon Simple Email Service (SES) as infr…
An active phishing campaign detected since at least April 2025 is exploiting confidence in legitimate remote management tools to achieve and maintain persistent access to corporat…
A legitimate and widely used package in the Python ecosystem, PyTorch Lightning, was manipulated in a malicious publication in PyPI and delivered a credentials charger to browsers…
A new current in closed criminal forums and groups reveals that financial fraud is no longer a set of opportunistic scams to become a replicable and optimized process: the attacke…
The U.S. agency CISA has confirmed that malicious actors are already exploiting in real environments the failure known as Copy Fail (CVE-2026-31431), just a day after Theori resea…
