Twenty-four malicious npm packages have been used to turn trusted package mirrors into staging points for ClickFix phishing pages. The campaign does not infect a developer by installing a package. …
Hackers Abuse Legitimate RMM Tools in 46-Country Phishing Campaign to Gain Remote Access
A phishing operation is abusing legitimate remote monitoring and management tools to give attackers direct control over victim systems. The campaign uses convincing document lures, rapidly changing hosting infrastructure, and …
SonicWall NetExtender Vulnerabilities Allow an Attacker to Write Arbitrary Files as Root
SonicWall has disclosed two security vulnerabilities in its NetExtender Linux client, including a critical path traversal flaw that could allow an attacker to write arbitrary files with root privileges. The …
WordPress Plugin Vulnerability Exposes 400,000 Sites to Account Takeover Attacks
A critical vulnerability in the TranslatePress WordPress plugin could allow unauthenticated attackers to hijack administrator accounts and fully compromise affected websites. The flaw, tracked as CVE-2026-19632, affects TranslatePress versions up …
Iran-Linked Hackers Abuse Legitimate Developer Tool to Hide Dindoor Backdoor
Iran-linked operators are using a trusted developer tool to conceal a backdoor called Dindoor inside Windows environments. The malware uses the Deno JavaScript and TypeScript runtime to execute encoded code, …
Mirage2FA Phishing Kit Bypasses MFA to Hijack Microsoft 365 Sessions, Targeting 3,500+ Organizations
Researchers tie the LinX Coders phishing-as-a-service toolkit to 9,332 compromise events across 94 countries, with 63.7% of victims in the United States and stolen session cookies accounting for more than …
Google Chrome 152 Released With 327 Security Fixes, Including 10 Critical Vulnerabilities
Google has released Chrome 152 for Windows, macOS, and Linux, delivering 327 security fixes and improvements. The update addresses 10 critical vulnerabilities, making it an important security release for individual …
28,000 Exposed Git Repositories Reveal API Keys, Bank Details and Employee Disciplinary Files
A routine development mistake has exposed thousands of software repositories. Researchers found 28,000 publicly reachable .git repositories containing credentials, financial information and internal employee records that could give criminals a …
NVIDIA NemoClaw Flaw Lets Attackers Hijack AI Agents With One Website Visit
A critical vulnerability in NVIDIA NemoClaw that could let attackers hijack an AI agent after a victim visits a malicious website. The issue, tracked as CVE-2026-65105, can expose the local …
Two Microsoft SharePoint Flaws Can Be Chained to Hack Servers Without a Password
Two serious Microsoft SharePoint Server vulnerabilities can be chained to let remote attackers take control of vulnerable servers without a password. The attack combines an authentication bypass tracked as 78 …