The Miasma supply chain campaign has sparked a fresh attack wave called Hades, this time involving 37 malicious wheel artifacts across 19 packages in the Python Package Index (PyPI) registry, as the Mini Shai-Hulud-style attacks continue to be refined and splintered to target spe…
CISA has ordered U.S. government agencies to secure their Check Point Remote Access VPN and Mobile Access deployments against a critical vulnerability exploited in zero-day attacks by Qilin ransomware affiliates. [...]
Google has released emergency updates to patch another Chrome zero-day vulnerability that has been exploited in the wild, the fifth such flaw patched since the start of the year. [...]
A IBM e a AT&T teriam ocultado do governo americano invasões de hackers estrangeiros em seus sistemas e redes, segundo processo aberto por William Barlow, ex-vice-presidente de inteligência de ameaças da IBM, apresentado em 2020 e divulgado agora, após o Departamento de Justiça d…
WhatsApp says it blocked Israeli firm NSO’s Pegasus spyware activity and is asking a US court to treat the targeting as an injunction breach.
A Meta informou que aproximadamente 20 mil contas do Instagram podem ter sido comprometidas após hackers explorarem uma vulnerabilidade na ferramenta de recuperação de contas assistida por IA, de acordo com comunicado enviado ao procurador-geral do Maine e reportado pela Security…
New variants of the NFCShare Android malware are being distributed as fake updates for legitimate banking apps hosted on GitHub. [...]
The financially motivated group is combining vishing, IT impersonation, and in-person office intrusions to steal data and extort victims.
Hackers compromised 19 packages on the PyPI, collectively downloaded hundreds of thousands of times, in a new Shai-Hulud supply-chain attack that delivered malware designed to steal developer secrets. [...]
A newly discovered, critical zero-day vulnerability is under attack; a Qilin ransomware affiliate has been blamed for at least one incident.
Security researchers have published a detailed, working exploit for a Linux kernel use-after-free that lets an unprivileged local user escalate to root and break out of a container. The flaw, CVE-2026-23111, sits in the kernel's nf_tables packet-filtering code and was patched up…
Uma vulnerabilidade de gravidade crítica no plugin Everest Forms Pro, presente em mais de 100 mil sites WordPress, está sendo explorada ativamente desde 13 de abril para tomar controle de páginas, de acordo com alerta da empresa de segurança Defiant. A falha, registrada como CVE-…
O GitHub desativou 73 repositórios da Microsoft em um intervalo de 105 segundos depois que seus alarmes foram acionados na última sexta-feira (5 de junho), ao detectar sinais de infecção pelo worm Miasma, de acordo com análise da StepSecurity divulgada pelo The Register. Hackers …
A Meta informou hoje que está pedindo à justiça federal que declare a NSO Group em desacato por violar uma liminar permanente que a proibia de atingir o WhatsApp e seus usuários, de acordo com comunicado oficial da empresa. O WhatsApp conseguiu detectar e interromper tentativas d…
Operation FlutterBridge uses fake Google ads and shell companies to deploy FlutterShell, a new macOS backdoor targeting unsuspecting users.
WhatsApp has detected and stopped spear-phishing campaigns allegedly conducted by the NSO Group after investigating user reports of social engineering attacks. [...]
Meta on Monday said it detected and blocked spear-phishing attempts linked to Israeli spyware vendor NSO Group. In addition, the tech giant said it's filing a federal court contempt order against the company for violating a permanent injunction that barred it from targeting What…
Hackers are cloning Ghidra, dnSpy, ILSpy and other free tool sites to spread Malware like RemusStealer, crypto clippers and loaders through fake downloads.
Gogs has patched a critical security zero-day flaw that can allow attackers to compromise Internet-facing instances and access any repositories (including private ones). [...]
The latest attacks, which hit 37 PyPI wheels and 19 code packages, show a continued evolution of the persistent software supply chain threat.
