WSO2 and Adobe Commerce Flaws Exploited in Attacks, Added to CISA KEV

September 25, 2026 at 10:16AM The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on Thursday, added two critical s…

ThreatsDay: AI Search Poisoning, AI Coding Tool Leaking Repos, One-Click Code Execution and 13 More Stories

September 24, 2026 at 11:22PM This week, the dangerous stuff keeps arriving dressed as something boring. An update. A login box. …

Attackers Exploit WordPress CVE-2026-87902 Within Hours of Disclosure

September 24, 2026 at 11:06AM Threat actors have begun to actively exploit a critical security flaw in WordPress within hours of …

Attackers Use Malicious Terraform Providers to Deliver Go Malware via HashiCorp Registry

September 23, 2026 at 11:36PM Cybersecurity researchers have disclosed Go-based malware distributed via two Go Modules and two Te…

A Leaked GitLab Issue Email Address Lets Anyone Push Code and Run CI Jobs as You

September 23, 2026 at 10:23PM The private email address GitLab gives you for filing issues by email is a credential. Anyone who g…

ShinyHunters Claims FBI Breach, Says It Stole Data on Agents and Job Applicants

September 23, 2026 at 11:00AM The cyber extortion group known as ShinyHunters on Tuesday claimed it had breached the U.S. Federal…

Malicious npm Package Poses as Twilio Bug-Bounty Probe, Can Exfiltrate Credentials

September 22, 2026 at 11:28PM Cybersecurity researchers have disclosed details of a malicious npm package named "tw-pkgprobe…

Zyxel and Veeam Flaws Under Active Exploitation With Command and SYSTEM Access

September 22, 2026 at 11:01AM The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a now-patched secu…

Google Fined €403 Million Over GDPR Violations Tied to Location Data

September 21, 2026 at 10:27PM Google has been fined €403 million for breaking the EU's data protection law, the GDPR, in the …

TASK#STOMP PowerShell Backdoor Steals Documents, Wi-Fi Passwords, and Clipboard Data

September 21, 2026 at 07:45PM Cybersecurity researchers have disclosed details of a new campaign dubbed TASK#STOMP that delivers …

ClickFix Lures Deploy ChainScript RAT Using Polygon to Rotate C2 Infrastructure

September 21, 2026 at 02:09PM Threat actors are leveraging ClickFix-like lures to deliver a previously undocumented remote access…

Jade Sleet Linked to Indian IT Provider Breach With FLATROOF and ROOFDECK Backdoors

September 21, 2026 at 11:36AM The North Korean threat actor known as Jade Sleet has been attributed to the compromise of an India…