LastPass has confirmed a customer data breach stemming from compromised OAuth tokens at Klue, a third-party competitive intelligence platform. Attackers exploited stolen credentials to access limited customer data, marking another security incident for the password manager following its notorious 20
Security researchers have uncovered four critical vulnerabilities in the Dify AI platform that collectively affect over 1 million AI applications. Dubbed “DifyTap,” these bugs enable attackers to execute arbitrary code, steal sensitive data, hijack administrative accounts, and compromise entire AI w
Siemens has disclosed CVE-2026-24349, a critical vulnerability in WinCC Certificate Manager that exposes private key material through insufficient protection mechanisms. The flaw affects multiple versions of WinCC across various industrial control system deployments, allowing attackers with local ac
Amazon Web Services has issued a critical security advisory highlighting how inadequate monitoring of outbound network traffic creates dangerous blind spots that attackers exploit for data exfiltration. Organizations relying solely on default AWS configurations may miss unauthorized data transfers t
A critical vulnerability dubbed “Cordyceps” has been discovered in GitHub Actions workflows, enabling attackers to hijack CI/CD pipelines across major organizations including Microsoft, Google, and Apache. The flaw exploits misconfigurations in GitHub Actions that allow malicious actors to inject co
A sophisticated malicious AI agent skill successfully evaded all major security scanners and infected approximately 26,000 AI agents before detection. The compromised skill exploited trust mechanisms in AI agent marketplaces, demonstrating a new attack vector targeting autonomous AI systems. This in
The dark web’s cybercrime marketplace has evolved into a sophisticated economy where stolen identities sell for as little as 95 cents, malware-as-a-service operates on subscription models, and scam kits are available for hire. This underground ecosystem generates billions annually, fueling identity
Law enforcement and cybersecurity partners have successfully disrupted the SocGholish malware distribution network, severing a critical access pathway used by the notorious Evil Corp cybercrime syndicate. The takedown targeted the Traffic Distribution System (TDS) infrastructure responsible for deli
A massive exploitation campaign dubbed “FortiBleed” has compromised over 430,000 Fortinet FortiGate firewalls worldwide, turning enterprise security infrastructure into credential-harvesting machines. Attackers are leveraging a critical vulnerability to deploy persistent backdoors that intercept and
Microsoft has identified CryptoBandits, a new USB-propagating malware strain that hijacks cryptocurrency transactions by replacing wallet addresses in the clipboard. The malware uses Tor for command-and-control communications, spreads via infected USB drives, and has already compromised systems acro
