News about security failures, exploits and vulnerabilities in systems
A buffer overflow on the 7-Zip XZ handle allows you to run code if a user opens a malicious file, but does not automatically convert that execution into high privileges: the corre…
The recent incident suffered by Hugging Face, where a system of self-employed agents exploited data channelling to scale up position and steal internal credentials, is a wake-up c…
F5 and the nginx team have published corrections for critical vulnerability (CVE-2026-42533) that allows a remote and unauthenticated attacker to cause heap overflow in the worker…
A recent wave of attacks directed at Ukrainian users shows how sophisticated state groups continue to improve social engineering to achieve remote infections: according to reports…
WordPress published emergency patches on July 17, 2026 to close a remote execution vulnerability of code that, according to the discovery, can be activated with an anonymous HTTP …
Security researchers have identified a new wave of malicious packages in the npm ecosystem that target developers using the front Vite construction tool. The campaign, called by s…
A new botnet written in Go, nicknamed NadMesh by the researchers, has changed the traditional target of crypt- mining to something more valuable to the current economy: credential…
The appearance and rapid circulation of ACR Stealer - also referred to in some reports as Amatera or AcridRain in its commercial evolution - again highlights a simple and painful …
The United States Agency for Infrastructure and Cybersecurity ( CISA) has placed critical vulnerability CVE-2026-58644 in its catalogue of known and exploited vulnerabilities (KEV…
