News about security failures, exploits and vulnerabilities in systems
In the hours following the publication of the official patch, attackers began to actively exploit a critical WordPress vulnerability listed as CVE-2026-87902 (CVSS 9.2). The failu…
A package supply campaign has recently compromised legitimate components used by developers and continuous integration pipelines to distribute a malicious multiplatform tool. The …
On July 23, targeted attacks were detected that took advantage of a vulnerability until then unknown in the web service of the Security Management Server of Check Point, according…
In recent weeks, two specific security lessons have emerged: IA agents are not mere determinist applications and traditional visibility on permits is no longer sufficient to estim…
On September 17 WordPress published a patch that fixes a vulnerability in the core - registered as CVE-2026-93485 and baptized by the community as "Commentary 2Shell" - which allo…
LastPass and Delphos Labs researchers have documented a suplanting campaign that offered a false installer of the "LastPass Authenticator" in GitHub. If a victim downloaded and ex…
Security investigators have detailed a new campaign, identified as TASK # STOMP, which uses VBScript and PowerShell to install a backdoor that collects and exfilters business docu…
An intrusion campaign attributed to the North Korean group known as Jade Sleet again exposed how state actors prioritize developers and development environments to gain access to …
A new documented vulnerability has appeared in a CVE and your scanner has detected it with a high-gravity score. This is an objective fact: there is a public entry of the CVE, you…
