Editorial Team

A new large-scale attack on a popular JavaScript code registry has hit around 150 packages. The automatic propagation of the threat makes it especially dangerous — developers need to react ASAP.

Unknown attackers have compromised several popular npm packages in a supply-chain attack.

A popular developer tool has been trojanized and is uploading secrets to public GitHub repositories. We discuss what’s important to know for both developers and cybersecurity services.

Two critical zero-day vulnerabilities in SharePoint are actively exploited by attackers in real-world attacks.

Researchers have found a vulnerability that allows attackers to get root privileges on most Linux distributions.

Internet Explorer sends its regards: a vulnerability in the HTTP protocol extension allows attackers to run malicious code — even on a modern operating system.

Researchers have found a way to exploit a security mechanism in a popular machine-learning framework.

Microsoft’s March Patch Tuesday fixes several vulnerabilities that have already been used in the wild. Details are not clear at the moment, but it’s worth installing the patches ASAP.

Researchers have discovered a vulnerability in the 7-Zip file archiver software.

A vulnerability that permits bypassing authentication has been found in a popular security hardening plugin for WordPress.

Exploitation of vulnerability CVE-2024-43451 allows an attacker to steal an NTLMv2 hash with minimal interaction from the victim.

A backdoor implanted into XZ Utils has found its way into popular Linux distributions.

A vulnerability in the glibc library affects most major Linux distributions.

It means that some companies still have not installed MS Office patches that were published 5 years ago.

July Microsoft Patch Tuesday: a collection of exploited vulnerabilities.

Minecraft mods downloaded from several popular gaming websites contain dangerous malware. What we know so far.

Kaspersky experts discover a CLFS vulnerability being exploited by cybercriminals.

Cybercriminals are attacking 3CX VoIP telephony software users via trojanized applications.

Microsoft plans to throttle and block email from vulnerable Exchange servers to Exchange Online.

Researchers have found vulnerabilities in the desktop client of the Signal messenger. Let’s see how dangerous they really are.

New CryWiper malware irreversibly corrupts files posing as ransomware.