Keyv npm Package with 127M Weekly Downloads Compromised in Shai-Hulud Attack

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

Attackers have compromised the GitHub account of the maintainer behind keyv, a popular key-value storage library that pulls in roughly 127 million weekly downloads on npm, and used that access to push credential-stealing malware across the maintainer’s entire package portfolio. …

Critical Gitea Arbitrary File Read Vulnerability Enables Remote Code Execution Attacks

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

August 4, 2026 A critical security flaw in Gitea, tracked as CVE-2026-59774, allows unauthenticated remote attackers to read arbitrary files from vulnerable servers and potentially escalate the attack to remote code execution. The issue affects Gitea versions from 1.22.1 through …

Critical Adobe Campaign Classic Vulnerabilities Enables Arbitrary Code Execution

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

August 4, 2026 Adobe has issued a critical security update for Adobe Campaign Classic, addressing multiple flaws that could enable arbitrary code execution on vulnerable systems. The update, tracked as APSB26-120 and published on August 3, 2026, carries Adobe’s highest …

A Malicious GitHub Issue Could Turn Google’s AI Agent Against Its Own CI/CD Pipeline

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

August 4, 2026 A first practical, real-world case of agent-to-agent exploitation inside a production multi-agent system, a novel attack class that turns one AI agent against another to compromise a software supply chain. The flaw was found in google/adk-python, the …

Chinese Military Researchers Use AI Distillation to Train Drone and Battlefield Systems

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

Chinese military-linked researchers are studying ways to turn the outputs of advanced Western AI systems into smaller, cheaper models for drones, battlefield tools, cyber work, and public-security platforms. The concern is not a single malicious program, but a technique that …

Fake AI Tool Campaign Turns Developer Interest Into Enterprise Initial Access

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

August 4, 2026 A new malware campaign is turning interest in artificial intelligence tools into a route for enterprise intrusion. Attackers are cloning trusted GitHub projects, then hiding malicious files inside downloads that appear useful to developers and AI users. …

BINDCLOAK Steals Windows User and Process Tokens to Run Malware With Higher Privileges

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

August 4, 2026 A newly uncovered Windows backdoor is giving an East Asia-linked espionage operation a quiet way to deepen control inside targeted networks. Named BINDCLOAK, the modular implant is deployed after initial access and can run malware using more …

Apache NiFi Vulnerabilities Enable Authorization Bypass Attacks

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

Apache NiFi users should upgrade to version 2.11.0 after the project disclosed four security vulnerabilities affecting the NiFi Web API and Parameter Context authorization controls. The flaws could enable authorization bypass, unauthorized configuration changes, validation abuse, memory exhaustion, and, in …

Critical cPanel Vulnerability Allows Execution of SQL Commands as Root User

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

August 4, 2026 A critical privilege-escalation flaw in cPanel & WHM has been disclosed that could allow authenticated hosting users to execute arbitrary SQL commands with full database administrative privileges. This vulnerability poses a risk of root-level server compromise in …

North Korean Hackers Are Hiding Malware Servers Inside Empty Crypto Transfers

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

August 4, 2026 North Korean-linked attackers are using a new way to hide the servers that control malware. The method places a command server address inside an empty Ethereum transaction, making the activity look like a normal crypto transfer rather …