AsyncAPI Malware Contains Modules to Steal GitHub, npm, Cloud and AI API Credentials

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

July 29, 2026 A dangerous supply chain attack struck the AsyncAPI project on the npm registry, putting developers and automated build systems at risk. Attackers republished five package versions in about ninety minutes on July 14, 2026. Each version carried …

A Leaked Android RAT Is Powering 170 Servers and Its Successor Is Already Online

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

July 29, 2026 A leaked Android remote access trojan called Flying Eagle is being used across a large and growing criminal network. The toolkit lets operators create fake Android apps, take control of infected phones, and steal information that can …

20-Year-Old Vulnerability Enables Takeover of Thousands of Data Centers in Minutes

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

July 29, 2026 A two-decade-old vulnerability in the Intelligent Platform Management Interface (IPMI) protocol could allow attackers to gain control of thousands of publicly exposed data center servers in just minutes, researchers have warned. The issue affects Baseboard Management Controllers …

WhatsApp Adds End-to-End Encryption for Voice and Video Calls

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

July 29, 2026 WhatsApp has introduced a new set of calling features alongside expanded end-to-end encryption for voice and video communications, emphasizing its commitment to secure, cross-platform communication. This update now allows users to make encrypted calls on WhatsApp Web, …

Check Point SmartConsole 0-Day Exploited to Gain Full Administrator Access – PoC Released

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

July 29, 2026 A critical authentication bypass in SmartConsole that was actively exploited as a zero-day before patches were available. Tracked as CVE-2026-16232, the flaw affects Security Management Server and Multi-Domain Security Management Server (MDS) and can give an unauthenticated …

JFrog Artifactory Zero-Day Exploited by OpenAI Models to Escape Sandbox

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

July 29, 2026 Artificial intelligence models have now demonstrated how quickly a security test can become a real infrastructure risk. In an isolated evaluation, OpenAI systems found and chained previously unknown flaws in self-hosted JFrog Artifactory, gaining internet access that …

WordPress Plugin Backdoor Sends Site and Administrator Details to Attacker C2

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

July 29, 2026 A critical supply chain backdoor in the Advanced Responsive Video Embedder WordPress plugin, which can give unauthenticated attackers complete administrator access. The malicious version, 10.8.7, affects a plugin with roughly 20,000 active installations and is tracked as …

Critical Gitea Vulnerability Allows Attackers to Execute Malicious Code Remotely

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

July 29, 2026 A critical vulnerability in Gitea, identified as CVE-2026-60004, could enable attackers to execute arbitrary shell commands on vulnerable servers. This issue affects Gitea versions 1.17 through 1.27.0 and has been resolved in version 1.27.1. The flaw resides …

Bank of Baroda Data Breach – Hackers Gained Access Via Employee Email Account

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

July 29, 2026 Bank of Baroda has confirmed a cybersecurity incident in which attackers gained unauthorized access to an employee’s email account, exposing internal communications and potentially sensitive information, raising concerns about phishing attacks, account security, and customer data protection. …

Malicious npm Packages Deploy Cross-Platform RAT Targeting Alibaba Developers

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

July 29, 2026 A cluster of malicious npm packages has been used to deliver a cross-platform remote access trojan against developers who use Alibaba-related tools. The campaign hides its harmful code across several packages, making each part look ordinary when …