Malware

An attacker reportedly used a leaked password to abuse a company’s legitimate access to Denmark’s population register (CPR). The weak password is remarkable, but the failure to spot millions of…

Ravie LakshmananOct 12, 2026Cybersecurity News / Hacking Some meetings last longer than it took attackers to jump on a newly disclosed security flaw this week. Within hours, they were already…

You ignored the suspicious email. You didn’t open the attachment, click the link, or reply to the sender. Then you asked your AI assistant to summarize your inbox. Could the…

Ravie LakshmananOct 12, 2026Vulnerability / Network Security Threat actors have been observed exploiting a recently disclosed critical security flaw in SonicWall Secure Mobile Access (SMA) 1000 appliances within days of…

In environments studied for the 2026 State of Agent Security Report, roughly 1,280 third-party products now embed AI. About 282 of them sit behind single sign-on. The other thousand are…

Cybersecurity researchers have disclosed details of a previously unseen variant of the DarkSword iOS exploit kit called P7 DarkSword. “Compared with the variants we usually observe, P7 reduces its on-device…

The customer data stolen from global fashion retailer ASOS includes more than just names and contact details, raising questions about its early reassurances. As we reported earlier this week, ASOS customers…

Ravie LakshmananOct 09, 2026Vulnerability / Cyber Espionage The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added five security flaws to its Known Exploited Vulnerabilities (KEV) catalog, following their…

The U.S. Federal Bureau of Investigation (FBI) and Department of Justice (DoJ) have announced the disruption of malicious tools used by a China-linked advanced persistent threat group known as Flax…

Cybersecurity researchers have disclosed details of an ongoing credential-theft campaign that has compromised two high-profile open-source maintainer accounts to push a malicious workflow into over 340 repositories. “Using the account…

If you thought that having companies trawling your social media, browsing history, and TV habits for behavioral clues was bad, sit tight. Meta is just getting started. Its Muse personal…

According to Google, attackers compromised infrastructure behind three country-code domain namespaces—.gh (Ghana), .sl (Sierra Leone), and .as (American Samoa)—and used it to obtain unauthorized HTTPS certificates for Google domains and…

Hackers tied to a Chinese cybersecurity company stole email from government organizations, law enforcement agencies, healthcare systems, and religious institutions in Southeast Asia, the FBI and agencies in 6 other…

Attackers behind a string of personal data leaks at Japanese organizations have abused APIs for mobile apps and targeted known software flaws, the JPCERT Coordination Center (JPCERT/CC) said. The Tokyo-based…

Amazon’s “About You” page reveals what it thinks it knows about you—and you can’t simply switch it off. Dexerto reports that one shopper discovered her profile included the observation: “has…

Phishing kits are no longer limited to copying a familiar login page and waiting for a victim to enter credentials. Attackers are increasingly building filtering, session management, and traffic controls…

The net is tightening around the Shiny Hunters cybercrime group following the reported arrest of a second member. On Saturday, Reuters said that 16 year-old Saif al-Din Khader had been…

Ravie LakshmananOct 08, 2026Artificial Intelligence / Cloud Security The npm package known as “tensorlake,” a TypeScript software development kit (SDK) for Tensorlake applications, sandboxes, and cloud services, was compromised as…

Google has released updates for the Chrome browser and the ChromeOS operating system. On October 6, Google released a Stable Channel Update for Desktop. This is the most important one for…

Google has published security fixes for Android. The October updates are available for Android operating system versions 14, 15, 16, 16-qpr2, and 17 where “qpr” stands for Quarterly Platform Release….

Attackers compromised three country-code top-level domains (ccTLDs) and obtained unauthorized HTTPS certificates for several Google domains, Google said on October 6. Google’s own systems were not breached, but any domain…

The 2026 findings are not just a year-over-year shift. They mark the latest point in a five-year arc where resilience, AI governance, human risk, and board scrutiny are converging inside…

In August, the Malwarebytes research team reported on a new malicious turnkey kit that makes it possible for almost anyone to launch a sophisticated online scam. The kit was not…

Ravie LakshmananOct 07, 2026Artificial Intelligence / Vulnerability Anthropic on Tuesday said it’s expanding a program that allows vetted cybersecurity professionals to test its advanced artificial intelligence (AI) models with reduced…

Facebook users are reporting receiving a message with a fake Facebook Marketplace listing that has their name as the seller. It works like this. You receive a message (in this…

Cybersecurity researchers have disclosed details of a “human-operated phishing platform” that impersonates advertising products for artificial intelligence (AI) chatbots like Google Gemini, Anthropic Claude, OpenAI ChatGPT, Perplexity, Meta Muse, and…

Thousands of global fashion retailer ASOS customers have received a push notification through the ASOS app this morning alleging that the company has been hacked. The notification, addressed to ASOS’s…

Swati KhandelwalOct 06, 2026Vulnerability / Open Source A malicious spreadsheet can make LibreOffice and Apache OpenOffice run an attacker’s code as soon as the file is opened, security researchers have…

Domino’s Pizza customers tell us they have received emails saying they account has been accessed by a third party. Domino’s says its internal systems weren’t breached, but that individual accounts…