A dozen critical security vulnerabilities have been disclosed in the vm2 Node.js library that could be exploited by bad actors to break out of the sandbox and execute arbitrary code on susceptible systems. vm2 is an open-source library used to run untrusted JavaScript code inside…
Explore the best OSINT tools for your digital investigations, threat intelligence, reconnaissance, and tracking online activity in 2026.
A phishing campaign delivered through Google sponsored search results is targeting credentials for ManageWP, GoDaddy's platform for managing fleets of WordPress websites. [...]
Authors of the VoidStealer Trojan uncovered a way to get around Google's App-Bound Encryption (ABE), opening the door to infostealers.
Cybersecurity researchers have exposed a new Mirai-derived botnet that self-identifies as xlabs_v1 and targets internet-exposed devices running Android Debug Bridge (ADB) to enlist them in a network capable of carrying out distributed denial-of-service (DDoS) attacks. Hunt.io, wh…
Google patches a CVSS 10 Gemini CLI vulnerability that allowed hackers to use prompt injection and privilege escalation for a full supply chain compromise.
A Cisco publicou hoje atualizações de segurança para corrigir uma vulnerabilidade de negação de serviço (DoS) que afeta os sistemas Crosswork Network Controller (CNC) e Network Services Orchestrator (NSO). De acordo com o aviso da empresa, a falha permite que atacantes não autent…
Pesquisadores da Trend Micro identificaram o Quasar Linux (QLNX), um trojan de acesso remoto (RAT) anteriormente não documentado, projetado para furtividade e roubo de credenciais em ambientes Linux. De acordo com o relatório publicado dia 4 de maio de 2026 pela equipe TrendAI™, …
A critical vulnerability in the popular Node.js sandboxing library vm2 allows escaping the sandbox and executing arbitrary code on the host system. [...]
Cisco patched a Crosswork Network Controller and Network Services Orchestrator denial-of-service vulnerability that requires manually rebooting targeted systems for recovery. [...]
ShinyHunters breached Instructure and Vimeo, exposing millions of student and user records through direct and supply chain attacks.
Disc Soft Limited, the maker of DAEMON Tools Lite, confirmed that the software had been trojanized in a supply chain attack and released a new, malware-free version. [...]
O avanço do uso de inteligência artificial por grupos criminosos está mudando a forma como ataques são conduzidos, tornando-os mais rápidos, adaptáveis e difíceis de identificar. Técnicas que antes dependiam de esforço manual agora são executadas em escala, permitindo que campanh…
Os hackers norte-coreanos do grupo ScarCruft conseguiram invadir e comprometer uma plataforma de jogos através de um ataque de cadeia de suprimentos, usando a backdoor BirdCall para transformar os games em trojans. Vírus, Worm e Trojan: Diferenciando os termos para não chamar …
Starr Insurance Discloses Ransomware Attack The HIPAA Journal
The health insurance company Starr Insurance has disclosed a ransomware attack and data breach. Data breaches have also been reported […] The post Starr Insurance Discloses Ransomware Attack appeared first on The HIPAA Journal.
Os ataques de negação de serviço (DDoS) contra a infraestrutura de servidores da Canonical, empresa desenvolvedora do Ubuntu, ainda estão em curso e afetam a capacidade de usuários instalarem o sistema operacional ou atualizações. A informação consta de uma postagem no Bluesky pu…
The MuddyWater Iranian hackers disguised their operations as a Chaos ransomware attack, relying on Microsoft Teams social engineering to gain access and establish persistence. [...]
The Iranian state-sponsored hacking group known as MuddyWater (aka Mango Sandstorm, Seedworm, and Static Kitten) has been attributed to a ransomware attack in what has been described as a "false flag" operation. The attack, observed by Rapid7 in early 2026, has been found to leve…
As part of Dark Reading's 20th anniversary celebration, its staff looks back on 20 of the biggest newmaking events from the past two decades that shaped our industry and the risk landscape for today's security teams.
