A new cloud security report reveals that organizations are drowning in tool sprawl, with the average enterprise using 30+ security solutions that fail to communicate effectively. This fragmentation creates dangerous visibility gaps, slows incident response by up to 60%, and increases misconfiguratio
GitHub has disabled automatic execution of npm lifecycle scripts following a sophisticated worm attack that exploited the package manager’s pre-install and post-install hooks. The attack leveraged npm’s automatic script execution to propagate malicious code across developer environments, prompting i
GitHub has disabled automatic execution of npm lifecycle scripts following discoveries of malicious exploitation. The platform will no longer automatically run `preinstall`, `install`, and `postinstall` scripts during package installation on GitHub-hosted services. This critical security decision co
Microsoft has confirmed that certain Windows 11 systems are experiencing failures when attempting to install the latest monthly security updates. This issue prevents affected machines from receiving critical patches that address actively exploited vulnerabilities, leaving them exposed to known attac
NSO Group has allegedly violated a court order by continuing to develop and deploy exploits targeting WhatsApp users, despite ongoing litigation and explicit judicial restrictions. The Israeli spyware vendor’s Pegasus software was reportedly used to compromise WhatsApp accounts through zero-click ex
Ivanti has disclosed two critical vulnerabilities in Ivanti Sentry—CVE-2026-10520 and CVE-2026-10523—that enable unauthenticated attackers to achieve remote code execution (RCE). CVE-2026-10520 is an authentication bypass vulnerability with a CVSS score of 9.8, while CVE-2026-10523 is a command inje
Threat actors are leveraging a sophisticated multi-stage ClickFix social engineering technique to deploy MLTBackdoor malware on Windows systems. The attack chain begins with fake CAPTCHA prompts that trick users into executing malicious PowerShell commands, ultimately installing persistent backdoor
Tchap, the French government’s proprietary encrypted messaging application, suffered a significant security breach that exposed sensitive government communications. The platform, designed specifically for state officials and public servants, was compromised through authentication vulnerabilities tha
A critical vulnerability in ServiceNow’s platform has been actively exploited by threat actors to gain unauthorized access to customer instances. The flaw, affecting multiple ServiceNow versions, allows attackers to bypass authentication mechanisms and access sensitive corporate data. Organizations
A critical zero-day vulnerability in Microsoft Windows BitLocker has been discovered that allows attackers with physical or local access to bypass full-disk encryption protections. The flaw exploits weaknesses in the boot process and TPM (Trusted Platform Module) communication, enabling unauthorized