Latest

A self-propagating worm called IndonesianFoods has infected npm, spawning new packages every seven seconds. According to Sonatype security researchers, the malware has already created over 100,000 packages, and the number continues to grow. The Worm's Naming Scheme The worm's name references its package naming pattern,

Law enforcement agencies from nine countries have dismantled over 1,000 servers used by the Rhadamanthys info-stealer, VenomRAT trojan, and Elysium botnet. This represents the latest phase of Operation Endgame, an international campaign against cybercrime coordinated by Europol and Eurojust. International Cooperation The operation brought together agencies from Australia, Canada,

Security researchers have discovered that Uhale digital photo frames running Android contain multiple critical vulnerabilities. Even more concerning, some models automatically download and execute malware during the boot process. Discovery and Disclosure Attempt Researchers from Quokka, a mobile security firm, analyzed the Uhale application and identified activity linked to two

Amazon's threat intelligence team has uncovered attacks exploiting two critical zero-day vulnerabilities: CVE-2025-5777 (dubbed "Citrix Bleed 2") in NetScaler ADC/Gateway and CVE-2025-20337 in Cisco Identity Services Engine (ISE). The findings reveal that attackers were exploiting these flaws weeks before the vendors disclosed them or released

This week, Microsoft released its November security updates, addressing 63 vulnerabilities across its product line. The most serious among them is CVE-2025-62215, a zero-day flaw in the Windows kernel that attackers are actively exploiting in the wild. Patch Tuesday Overview Four vulnerabilities received Critical severity ratings, while 59 were classified

Researchers from Veracode discovered a malicious npm package named acitons/artifact that masqueraded as the legitimate actions/artifact package and targeted GitHub's own repositories. However, the "attack" turned out to be an internal Red Team exercise conducted by GitHub itself—one that inadvertently exposed the public

Google has filed a lawsuit against the operators of Lighthouse, a phishing-as-a-service (PhaaS) platform that cybercriminals worldwide use to steal bank card data. The attackers primarily operate through SMS messages, impersonating the United States Postal Service (USPS) and the E-ZPass toll payment system. Scale of the Operation According to Google&