North Korean state-sponsored threat actors successfully compromised the npm ecosystem by targeting the widely-used axios HTTP client library. Before the main attack, threat actors practiced on a lesser-known npm package, refining their techniques. This sophisticated supply chain attack demonstrates
A critical vulnerability (CVE-2026-66066) in Ruby on Rails’ Active Storage component allows unauthenticated attackers to read arbitrary files from vulnerable servers through malicious image upload manipulation. The flaw affects Rails versions 6.0.0 through 7.1.3, with successful exploitation potenti
A newly discovered worm targeting Microsoft Copilot exploits the AI assistant’s integration with Word documents to self-replicate and spread across organizational networks. The attack leverages prompt injection techniques embedded within seemingly benign documents, causing Copilot to execute malicio
JetBrains TeamCity is affected by CVE-2026-63077, a critical unauthenticated remote code execution (RCE) vulnerability with a CVSS score of 9.8. The flaw allows attackers to execute arbitrary code on vulnerable servers without authentication, potentially compromising entire CI/CD pipelines, source c
A maximum severity CVSS 10.0 vulnerability dubbed “RufRoot” has been discovered in Ruflo, allowing unauthenticated attackers to hijack user accounts remotely without requiring any login credentials. The flaw bypasses all authentication mechanisms, granting attackers complete control over targeted ac
Over 30 Minnesota water utility systems have been targeted in a coordinated operational technology (OT) attack, marking one of the most significant cyber assaults on U.S. critical water infrastructure to date. The attack campaign specifically targeted industrial control systems (ICS) managing water
Multiple npm packages belonging to Joyfill, a popular form-building library, were compromised in a supply chain attack that deployed a sophisticated worm-like Remote Access Trojan (RAT). The malicious code specifically targeted developer credentials, environment variables, and sensitive configuratio
A critical vulnerability (CVE-2026-10702) in Firefox’s underlying engine has exposed Tor Browser users to session hijacking attacks through malicious web pages. The flaw allows attackers to bypass Tor’s anonymity protections and execute arbitrary code, potentially unmasking users and compromising th
Russian authorities have charged Telegram founder and CEO Pavel Durov with aiding terrorism and issued an international arrest warrant. The charges stem from allegations that Telegram’s encrypted messaging platform has been used to coordinate terrorist activities, with Russian prosecutors claiming D
Microsoft’s Secure Boot implementation has been compromised by a 13-year-old vulnerability involving improperly revoked bootloaders and shims. Security researchers discovered that previously revoked certificates and binaries remained functional, allowing attackers to bypass Secure Boot protections o