Month: August 2026

A cluster of nearly 800 malicious packages has been published to the npm registry as part of a new campaign…

WordPress has fixed a pre-authentication reflected cross-site scripting (XSS) flaw in its login screen that affects every version of the…

Zapscape, a new Linux kernel vulnerability, could allow an attacker with kernel privileges inside an L1 guest virtual machine (VM)…

An unprivileged Linux program can time a hardware interrupt to land in the gap between a processor sanitizing its branch…

A macOS ClickFix operation spanning more than 250 front-end domains now fingerprints visitors before deciding whether to show them a…

Cybersecurity researchers have discovered more than half-a-dozen services advertisements for illegal access to artificial intelligence (AI) models on underground cybercrime…

The commercial phishing-as-a-service (PhaaS) toolkit known as Greatness has become the latest crimeware solution to add support for device code…

A credential-stealing npm worm that first appeared in keyv@6.0.0 spread beyond the Keyv and Cacheable namespaces into hundreds of packages…

Cybersecurity researchers have discovered a new set of malicious npm packages that target users of Alibaba developer tools with a…

Malware running as an ordinary user on a Windows machine can sign into a victim’s passkey-protected accounts without a fingerprint,…