Chinese-speaking APT group exploits ZyXEL GS1900 switch and WordPress vulnerabilities to steal 18,500+ government records from 996 devices. Multi-vector campaign targets network infrastructure and web applications simultaneously for intelligence collection.
F5 BIG-IP Access Policy Manager contains a critical zero-day vulnerability (CVE-2026-94127) enabling unauthenticated remote code execution on systems with OAuth Authorization Server configurations. Active exploitation confirmed requiring immediate mitigation action.
A TLS certificate misconfiguration exposed North Korea’s Hangro VPN infrastructure across servers in North Korea and Russia. The certificate revealed internal IP addresses and domains used by officials, providing rare intelligence into the isolated nation’s network infrastructure.
ShinyHunters successfully compromised a rival extortion gang’s dark web infrastructure in an unprecedented hostile takeover. This inter-gang attack demonstrates escalating conflicts within cybercrime ecosystems and raises questions about operational security among threat actors.
A critical remote code execution vulnerability in HEIF image-decoding libraries allows attackers to compromise systems through malicious image uploads. The flaw affects web applications, content management systems, and cloud platforms using HEIF processing.
North Korean threat actor Jade Sleet breached an Indian IT services provider deploying FLATROOF and ROOFDECK backdoors. The supply chain compromise threatens multiple downstream client organizations with unauthorized access through trusted vendor relationships.
Google’s Threat Analysis Group embedded an undercover analyst within TeamPCP, a supply-chain focused hacking collective, gaining unprecedented visibility into their attack methodologies, infrastructure, and targeting processes over several months of infiltration.
Agentic AI systems are rapidly proliferating across enterprises, but security frameworks haven’t kept pace. Security investors identify this billion-dollar gap as autonomous agents introduce novel attack vectors—prompt injection, privilege escalation, and data exfiltration—that traditional tools…
Attackers exploited the May 2024 TanStack npm supply chain attack to steal 170 private CrowdSec GitHub repositories through a compromised former employee account. The breach remained undetected for four months until stolen source code appeared on cybercrime forums in September.
Orkes Conductor workflow platform versions before 3.30.2 contain a critical pre-authentication RCE vulnerability (CVE-2026-58138, CVSS 9.8) actively exploited in the wild. No authentication required for complete system compromise. Immediate patching mandatory.