GitHub has confirmed a breach of its internal repositories, caused by a compromised employee device due to a malicious version of the Nx Console Visual Studio Code extension. This breach marks a significant cybersecurity incident, raising concerns about the security protocols of widely-used platforms. The issue arose when unauthorized actors gained access to a developer’s […]
The mini Shai-Hulud hijacks have unveiled a new dimension in software supply chain attacks, as cybersecurity experts reveal a breach compromising assorted npm packages in the @antv ecosystem. This campaign exploits the npm maintainer account known as atool, notably affecting echarts-for-react. This specific React wrapper for Apache ECharts enjoys widespread usage, with about 1.1 million […]
Europol removes a major online propaganda network linked to the Iranian Revolutionary Guard Corps (IRGC), taking down 14,200 extremist links spread across multiple digital platforms. In a concerted effort to combat misinformation, the European Union’s law enforcement agency worked alongside international partners to dismantle the network orchestrating these propaganda activities. The operation not only targeted […]
In a concerning development, threat actors have targeted GitHub Actions tags, redirecting them to unauthorized commit points as part of a sophisticated software supply chain attack. This breach specifically involves the popular GitHub Actions workflow, actions-cool/issues-helper, which attackers have manipulated to execute malicious code. This code is designed to harvest sensitive CI/CD credentials and transmit […]
Microsoft Entra ID was recently exploited by hackers in a sophisticated cyberattack targeting Microsoft 365 and Azure data. This incident involved a compromised version of the Nx Console VS Code extension, which appeared on the Visual Studio Code Marketplace on May 18, 2026. The malware targeted developer credentials, cloud tokens, and CI/CD secrets, spreading across […]
The recent Pwn2Own Berlin 2026 competition showcased the prowess of security researchers as they collectively earned $1,298,250 for discovering and exploiting 47 zero-day vulnerabilities. This esteemed contest, known for rewarding top-notch hacking skills, saw participants tackle a range of software and hardware challenges. Their success underscores the importance of public cybersecurity events in identifying flaws […]
Anthropic’s Claude Code tool recently faced a significant security breach due to a remote code execution (RCE) flaw. Discovered by security researcher Joernchen of 0day.click, this vulnerability allowed attackers to execute arbitrary commands on a victim’s machine using malicious deeplinks. The issue originated from a naive command-line argument parser in the tool’s claude-cli:// deeplink handler. […]
A cybersecurity researcher has unveiled a proof-of-concept exploit for a Windows vulnerability known as ‘MiniPlasma’. This Windows Miniplasma zero-day allows attackers to gain SYSTEM privileges even on fully updated Windows systems. The exploit poses a serious threat, as it enables malicious actors to take over a system with elevated permissions, potentially leading to significant data […]
A critical vulnerability, known as the Burst Statistics flaw, has compromised over 200,000 websites by allowing attackers to bypass authentication and take control of accounts. The flaw, identified by Wordfence’s PRISM platform on May 8, 2026, impacts the Burst Statistics plugin used for privacy-focused analytics on WordPress sites. This vulnerability, tracked as CVE-2026-8181 with a […]
GitLab has issued a critical patch to address high-severity vulnerabilities impacting its self-managed instances. The update, available for both Community Edition (CE) and Enterprise Edition (EE), comprises versions 18.11.3, 18.10.6, and 18.9.7. These patches fix serious security flaws, including a cross-site scripting (XSS) vulnerability and an unauthenticated denial-of-service (DoS) flaw, which could potentially be exploited […]
The cybersecurity community is on high alert following the disclosure of critical security vulnerabilities within OPNsense firewalls. These vulnerabilities, identified as CVE-2026-44194 and CVE-2026-45158, allow attackers to execute remote code with root privileges. The OPNsense flaw enables root access, posing significant risks to these widely used open-source firewall systems. The exposure of full technical details […]
An 18-year-old NGINX flaw has emerged as a significant cybersecurity threat. Depthfirst recently identified a critical vulnerability in both NGINX Plus and NGINX Open, which could have severe implications for server security. This flaw is a heap buffer overflow issue within the ngx_http_rewrite_module, tagged as CVE-2026-42945, with a CVSS v4 score of 9.2. Such a […]