Cybersecurity researchers have discovered a malicious npm package that’s part of a recently disclosed software supply chain attack campaign dubbed MALFEX. The package, named “imgdecode,” was uploaded to the package… Read More »MALFEX npm Package ‘imgdecode’ Hides Shellcode Loader in Windows Native Addon
Cybersecurity researchers are sounding the alarm related to an active campaign in which unknown threat actors are abusing a compromised Microsoft 365 (M365) credential belonging to ConnectWise Cloud Backup (formerly… Read More »Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants
A local privilege escalation exploit published today gains root on OpenBSD 7.9 by chaining a roughly 37-year-old integer overflow with a separate kernel flaw, bypassing OpenBSD’s KARL kernel-address randomization and… Read More »Researchers Demonstrate OpenBSD Root Exploit Chaining 37-Year-Old Shared-Memory Bug
Attackers repeatedly changed the files that AOMEI Backupper fetches from the vendor’s own update servers, in windows of five to ten minutes at a time between May and July 2026,… Read More »Attackers Tampered with AOMEI Backupper’s Update Servers for Minutes to Deliver a Backdoor
Cybersecurity researchers have disclosed details of an advanced persistent threat (APT) spear-phishing campaign that has targeted individuals affiliated with Taiwan research organizations to direct victims to an adversary-in-the-middle (AitM) phishing… Read More »UAT-11985 Uses Fake Event Invites to Target Taiwan Research Affiliates With Google AitM Phishing
OpenAI has disclosed seven new incidents in which its artificial intelligence (AI) models exhibited misaligned behavior, including one case where its research model, after not having funds on an Ethereum… Read More »OpenAI Research Model Spent 3rd-Party Test ETH Without Permission to Deploy Smart Contract
In the space of a month, a new category of AI model went from nonexistent to everywhere. TypeSafe AI released Jev on September 15 and called it a System One… Read More »AI Decision Models and Their Impact on AI SOC Platforms
AI agents being tested online reached the live systems of Indian organizations and read business records, including personal data and confidential material, CERT-In said in an advisory on October 15. The agents… Read More »CERT-In Warns AI Agents Accessed Sensitive Data at Indian Organizations During Testing
The China-nexus cyber espionage group tracked as Armory Castle (previously UNC5221 or Warp Panda) exploited a newly disclosed security flaw in BeyondTrust Remote Support (formerly Bomgar) as a zero-day in… Read More »China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers
A suspected advanced threat actor has been observed exploiting a security flaw in Fortinet FortiOS to deliver a previously unreported memory-resident ARM64 malware known as PEERSTITCH. The attack involves the… Read More »PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions