Google Chrome is implementing enhanced security controls to automatically block extensions that hijack New Tab pages, a common tactic used by malicious actors to redirect user traffic and inject unwanted content. This browser-level protection will activate by default, significantly reducing the atta
Cybercriminals are exploiting users’ desire for free Spotify Premium subscriptions by distributing infostealer malware through social media platforms. These campaigns leverage YouTube tutorials, TikTok videos, and Instagram posts promising free account upgrades, but instead deliver sophisticated inf
UNC3753, a financially motivated threat actor, has executed an alarming hybrid attack campaign combining social engineering vishing calls with physical break-ins to steal data and extort U.S. organizations. The group targets help desks to obtain VPN credentials, then conducts reconnaissance before s
Agentjacking is a novel attack technique that manipulates AI-powered coding assistants into executing malicious commands by exploiting their autonomous code generation and execution capabilities. Attackers inject specially crafted prompts into documentation, configuration files, or project contexts
GitHub has taken down over 70 repositories linked to Microsoft following a suspected worm infection that compromised multiple code repositories. The mass removal has caused widespread CI/CD pipeline failures across numerous projects that depended on these repositories. The incident highlights the ca
Security teams are bridging the gap between threat intelligence consumption and proactive threat hunting through automated pipelines that transform raw intelligence feeds into actionable hunt plans. These systems parse indicators of compromise (IOCs), tactics, techniques, and procedures (TTPs), and
ISO 42001:2023, the world’s first AI management system standard, fundamentally changes how organizations must approach cloud-based AI data risk. This certification framework mandates comprehensive risk assessment, data governance, and accountability measures specifically designed for AI systems. Org
OWASP has launched CVE Lite CLI, a lightweight command-line vulnerability scanner designed to help developers quickly identify known vulnerabilities in their project dependencies. This open-source tool provides fast, offline-capable CVE scanning without the overhead of enterprise solutions, making s
Popular Laravel localization packages maintained by the Laravel-Lang organization were compromised in a supply chain attack, with malicious actors injecting credential-stealing malware into legitimate translation packages. The attack affected multiple packages downloaded thousands of times, potentia
CISA has added CVE-2026-45247, a critical remote code execution (RCE) vulnerability in Adobe Magento, to its Known Exploited Vulnerabilities (KEV) catalog. The flaw is being actively exploited in the wild, allowing attackers to execute arbitrary code on vulnerable e-commerce platforms. Federal agenc