News about security failures, exploits and vulnerabilities in systems
The FBI has issued an alert on Kali365, a phishing-as-a-service (PhaaS) platform that facilitates attackers - even with little experience - to kidnap Microsoft 365 accounts by abu…
A critical failure in Ghost CMS - registered as CVE-2026-26980 and valued with a CVSS 9.4- is being exploited in mass campaigns that insert malicious JavaScript code into legitima…
The research published by Fox-IT on RemotePE, a remote access trojan (RAT) used by the Lazarus group, confirms a critical trend in cyber-threat to finance and cryptomonedas: incre…
A new coordinated operation that researchers have baptized as TrapDoor has exploited the three large package repositories - npm, PyPI and Crates.io - to distribute malware whose m…
A massive campaign is exploiting a critical vulnerability of SQL injection in Ghost CMS (CVE-2026-26980) to steal administrative keys and plant malicious JavaScript in articles, i…
GitHub has activated a new npm tool called started publishing which requires manual approval of a maintainer (by double factor challenge) before a published version is visible and…
A recent coordinated attack on the supply chain has committed eight packages published in Packagist, introducing malicious code designed to download and run a Linux binary hosted …
Anthropic's disclosure of Project Glasgow marks a turning point in the relationship between artificial intelligence and software security: in just a few weeks, a small group of pa…
Security researchers have identified a commitment campaign in the software supply chain that took advantage of malicious versions of several PHP packages of the Laravel-Lang proje…
