Cybersecurity researchers have flagged a new version of PamStealer that ensures that the main payload can only be recovered using a server-side decryption chain. The latest artifacts, per Jamf Threat… Read More »PamStealer macOS Malware Adds Live C2 Payload Decryption and Multi-Layer Persistence
Two actions-cool GitHub Actions have been disabled for a second time after the repositories became accessible last week, months after they were compromised during the May 2026 Mini Shai-Hulud campaign.… Read More »Compromised GitHub Actions Came Back Online and Resumed Executing Mini Shai-Hulud Malware
Security leaders keep debating whether AI will produce an entirely new class of cyberattack. The nearer change is quieter and already visible: AI has made a failed attack cheap to… Read More »The SOC Doesn’t Need to Start Over with Every Alert
The Canadian Centre for Cyber Security has warned that a now-patched Roundcube Webmail vulnerability is being actively exploited in the wild. The vulnerability in question is CVE-2026-48842 (CVSS score: 8.1),… Read More »Roundcube Pre-Auth SQL Injection Flaw Actively Exploited in the Wild
Cryptocurrency exchange Bitget said suspected North Korean threat actors have stolen $351.6 million from its hot and warm wallets. “At 18:31 UTC on September 24, 2026, Bitget’s security systems identified… Read More »Bitget Says Suspected North Korean Hackers Stole $351.6M After Backend Compromise
The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on Thursday, added two critical security flaws impacting WSO2 and Adobe Commerce and Magento to its Known Exploited Vulnerabilities (KEV) catalog, based… Read More »WSO2 and Adobe Commerce Flaws Exploited in Attacks, Added to CISA KEV
A flaw in Cloudflare Containers let a paying customer read data that other customers’ containers had left behind on the same server, Cloudflare and the researchers who found it said… Read More »Cloudflare Fixes Flaw That Let One Container Read Another Customer’s Leftover Disk Data
This week, the dangerous stuff keeps arriving dressed as something boring. An update. A login box. A search answer. A coding tool. A link you have clicked a hundred times… Read More »ThreatsDay: AI Search Poisoning, AI Coding Tool Leaking Repos, One-Click Code Execution and 13 More Stories
A OnePlus 15 running the latest OxygenOS can be rooted by a malicious app the owner installs, one that asks for no special permissions. A researcher, Rasmus Moorats, chained two flaws… Read More »Unpatched OnePlus Flaws Let Installed Android Apps Gain Root Without Permissions
The “third-party[.]com” domain, commonly used as a documentation placeholder, has been observed serving a ClickFix lure to Windows browsers while displaying a harmless decoy to other users. “third-party[.]com has been… Read More »Placeholder third-party[.]com Referenced Across 1,700+ Repositories Now Serves Malicious Content