A newly identified China-linked threat cluster designated OP-512 has been observed deploying a sophisticated web shell framework specifically targeting Internet Information Services (IIS) servers. The malware employs cryptographic uniqueness per deployment, advanced obfuscation techniques, and modul
GitHub has disabled automatic execution of npm lifecycle scripts following a sophisticated worm attack that exploited the package manager’s pre-install and post-install hooks. The attack leveraged npm’s automatic script execution to propagate malicious code across developer environments, prompting i
The Handala hacking group has claimed responsibility for breaching California Water Service (Cal Water), one of the largest investor-owned water utilities in the United States. The group alleges exfiltration of sensitive data and threatens to release it publicly. This incident adds to growing concer
Competitive intelligence platform Klue suffered an OAuth token breach that exposed Salesforce customer data in connection with the widespread ‘Icarus’ attack campaign. Threat actors exploited compromised OAuth credentials to access sensitive sales and customer relationship data stored in connected S
A critical vulnerability in Visual Studio Code’s URI handling mechanism allows attackers to steal GitHub OAuth tokens through a single click. By exploiting the `vscode://` protocol handler and the GitHub Pull Requests extension, threat actors can craft malicious links that trigger automatic authenti
The RondoDox botnet is actively exploiting CVE-2018-5999, a six-year-old critical vulnerability in ASUS routers, to compromise devices and expand its network. This authentication bypass flaw allows attackers to execute arbitrary commands remotely, converting vulnerable routers into botnet nodes for
Fortinet has released security patches for a critical vulnerability in FortiSandbox that could allow unauthenticated attackers to execute arbitrary code remotely. The flaw, affecting multiple versions of the sandbox analysis platform, represents a significant risk to organizations relying on FortiSa
CISA has added CVE-2026-42897, an actively exploited Microsoft Exchange Server XSS vulnerability, to its Known Exploited Vulnerabilities catalog. Federal agencies have until May 29, 2026 to remediate the flaw, which enables spoofing attacks via Outlook Web Access.
Metasploit Framework has released new exploit modules targeting critical remote code execution (RCE) vulnerabilities in Apache ActiveMQ and Gogs, alongside a Windows kernel pointer enumeration module. These additions enable security professionals to test their defenses against CVE-2023-46604 (Active
A Russian national has been formally charged by U.S. authorities for their involvement in the Void Blizzard espionage campaign, a sophisticated cyber operation targeting government entities, critical infrastructure, and defense contractors. The indictment reveals a multi-year campaign leveraging cus