North Korean state-sponsored threat actors have deployed a sophisticated steganographic technique to deliver OTTERCOOKIE malware by concealing malicious payloads within SVG (Scalable Vector Graphics) image files. This campaign specifically targets software developers, leveraging seemingly benign ima
A sophisticated supply chain attack has compromised 36 npm packages with IronWorm malware, targeting developers’ systems to exfiltrate sensitive data and establish persistent backdoors. The malicious packages received thousands of downloads before detection, affecting developers worldwide who integr
Security researchers have disclosed a critical zero-click exploit chain targeting Google Pixel 10 devices that leverages a vulnerability in the Visual Processing Unit (VPU) driver to achieve full root access without user interaction. The attack chain, discovered during internal security testing, com
A coordinated international law enforcement operation involving US, French, and Italian authorities successfully dismantled a major deepfake pornography website that victimized thousands of individuals. The site used AI-powered tools to create non-consensual synthetic sexual content, generating sign
Microsoft has announced the extension of hotpatching support for Windows Server 2022 on Azure through 2027, providing organizations with continuous security updates that don’t require system reboots. This extension ensures businesses can maintain operational continuity while staying protected agains
A Spanish hacker known as “Alcasec,” who styled himself as the “Robin Hood of Spanish Hackers,” has been sentenced to 31 months in prison for stealing and exposing sensitive banking data. Despite claims of acting in the public interest by exposing security vulnerabilities, the court found him guilty
A critical use-after-free vulnerability (CVE-2026-50263) has been discovered in the X.Org Server’s CreateSaverWindow function, allowing authenticated local attackers to read sensitive information from freed memory regions. The flaw affects multiple Linux distributions and Unix-like systems still run
VMware has disclosed multiple stored cross-site scripting (XSS) vulnerabilities affecting several of its enterprise products. These flaws allow authenticated attackers to inject malicious JavaScript code that executes in victims’ browsers when viewing compromised pages. The vulnerabilities impact VM
Nissan Motor Corporation disclosed a significant data breach affecting employee information after threat actors exploited a zero-day vulnerability in Oracle PeopleSoft. The automotive giant confirmed that unauthorized access occurred through their HR management system, compromising sensitive employe
The United Kingdom has established an advisory board to oversee and challenge its developing digital identity infrastructure. This board comprises cybersecurity experts, privacy advocates, and technology leaders tasked with ensuring the digital ID program balances innovation with robust security and