Uma campanha automatizada codinome ‘Megalodon’ injetou 5.718 commits maliciosos em 5.561 repositórios do GitHub em um período de seis horas no dia 18 de maio de 2026, conforme análise da OX Security publicada em 21 de maio. O malware, descoberto inicialmente pela SafeDep, utiliza…
A large-scale campaign is exploiting a critical SQL injection vulnerability (CVE-2026-26980) in Ghost CMS to inject malicious JavaScript code that triggers ClickFix attack flows. [...]
A supply chain attack targeting the Laravel Lang localization packages has exposed developers to a sophisticated credential-stealing malware campaign after attackers abused GitHub version tags to distribute malicious code through Composer packages. [...]
A new "coordinated" supply chain attack campaign has impacted eight packages on Packagist including malicious code designed to run a Linux binary retrieved from a GitHub Releases URL. "Although the affected packages were all Composer packages, the malicious code was not added to…
Italian authorities have dismantled a piracy ecosystem centered around the CINEMAGOAL app that provided access to various streaming platforms, including Netflix, Disney+, and Spotify. [...]
A Europol anunciou, em 21 de maio de 2026, o desmantelamento da ‘First VPN’, um serviço VPN utilizado por criminosos para ocultar ataques de ransomware, roubo de dados e outros crimes graves. A operação, liderada pela França e Holanda entre 19 e 20 de maio, contou com o apoio da …
Anthropic on Friday disclosed that Project Glasswing has helped uncover more than 10,000 high- or critical-severity vulnerabilities across some of the most "systemically" important software across the world since the cybersecurity initiative went live last month. Project Glasswi…
Cybersecurity firm VulnCheck reveals hackers are using a critical 2018 vulnerability to bypass authentication and hack over a million ASUS routers.
Cybersecurity researchers have flagged a fresh software supply chain attack campaign that has targeted multiple PHP packages belonging to Laravel-Lang to deliver a comprehensive credential-stealing framework. The affected packages include - laravel-lang/lang laravel-lang/…
A maximum-severity security vulnerability impacting LiteSpeed User-End cPanel Plugin has come under active exploitation in the wild. The flaw, tracked as CVE-2026-48172 (CVSS score: 10.0), relates to an instance of incorrect privilege assignment that an attacker could abuse to r…
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a recently patched critical security flaw impacting Drupal Core to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation. The vulnerability in question is CVE-2026-90…
Pesquisadores da Barracuda identificaram um sofisticado “scareware” para navegador, que utiliza técnicas avançadas de evasão, controles agressivos de navegação e até manipulação psicológica para induzir vítimas a ligarem para números falsos de suporte técnico. O scareware se cham…
A TrendMicro publicou atualizações para os sistemas Apex One e Vision One – Standard Endpoint Protection (SEP) nesta quinta-feira, 21 de maio, após observar pelo menos uma tentativa de exploração ativa de vulnerabilidades em ambiente real. O comunicado da empresa detalha oito fal…
A Drupal alertou usuários sobre tentativas de exploração de uma vulnerabilidade crítica corrigida no início da semana. A falha CVE-2026-9082 atinge uma API do sistema, permitindo que atacantes não autenticados enviem solicitações especialmente criadas para injetar comandos SQL ar…
FBI warns of Kali365, a PaaS scam kit that lets cybercriminals bypass MFA and hijack Microsoft 365 accounts without passwords.
Law enforcement intercepted VPN traffic, seized domains, and arrested its operator.
Authorities in Europe and North America have announced the dismantling of a criminal virtual private network (VPN) service used by criminal actors to obscure the origins of ransomware attacks, data theft, scanning, and denial-of-service attacks. The disruption of First VPN Servi…
Financial crime investigators in the Netherlands (FIOD) arrested two men and seized 800 servers linked to a web hosting company that enabled cyberattacks, interference operations, and disinformation campaigns. [...]
The Belarus-aligned threat actor known as Ghostwriter (aka UAC-0057 and UNC1151Ukraine's National Security and Defense Council) has been observed using lures related to Prometheus, a Ukrainian online learning platform, to target government organizations in the country. The activ…
SafeDep uncovered the Megalodon attack targeting 5,561 GitHub repositories with malicious CI workflows and cloud credential theft.
