MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon

October 17, 2026 at 04:41PM Cybersecurity researchers have discovered a malicious npm package that's part of a recently discl…

Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants

October 17, 2026 at 11:46AM Cybersecurity researchers are sounding the alarm related to an active campaign in which unknown threa…

Researchers Demonstrate OpenBSD Root Exploit Chaining 37-Year-Old Shared-Memory Bug

October 16, 2026 at 11:18PM A local privilege escalation exploit published today gains root on OpenBSD 7.9 by chaining a roughly …

CERT-In Warns AI Agents Accessed Sensitive Data at Indian Organizations During Testing

October 16, 2026 at 12:23PM AI agents being tested online reached the live systems of Indian organizations and read business reco…

PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions

October 16, 2026 at 10:29AM A suspected advanced threat actor has been observed exploiting a security flaw in Fortinet FortiOS to…

Critical PwnEscape Linux Kernel Vulnerability Lets Guest VMs Read Host Memory

October 16, 2026 at 01:54AM A newly disclosed critical flaw in the Linux kernel allows code inside a virtual machine to read memo…

ThreatsDay: Adobe RCE, DNS Wallet Theft, NVIDIA Container Escape, Self-Healing Backdoor + 23 More

October 16, 2026 at 12:19AM Someone built a tool to steal data, then decided it should scare the victim for fun. Yes, that’s an a…

Palo Alto Networks Patches PAN-OS Authenticated RCE Flaw Amid Active Exploitation

October 15, 2026 at 11:47AM Palo Alto Networks on Wednesday issued security updates for a high-severity flaw in PAN-OS software t…

Microsoft Disrupts 3 Phishing Kits Linked to Over 1 Billion Scam Messages

October 14, 2026 at 10:39PM Microsoft and Health-ISAC, along with the Japan Cybercrime Control Center (JC3) and a coalition of pr…

SAP Discloses Critical CVSS 10 Flaw in Cloud SDK for Python Allowing OAuth2 Credential Theft

October 13, 2026 at 10:58PM A flaw in SAP's Cloud SDK for Python can send an application's OAuth2 client credentials to a…

GitLab Patches CVSS 10.0 Flaw That Could Let Unauthenticated Users Run Server Code

October 13, 2026 at 02:13PM GitLab has released patches for a maximum-severity security flaw impacting its Community Edition (CE)…

Low-Cost Android Phones Ship With Preinstalled Malware That Turns Them Into Residential Proxies

October 13, 2026 at 11:30AM Low-cost Android smartphones have been shipped with malicious software baked into the device firmware…