Popular
Nothing found for . Try a course, an exam code (SC-200), a tool or a topic.
↑↓ moveEnter openEsc close
Cyber security news, as it breaks.
Updated 109 stories in 24 hours
Malware & Exploits
Malware, exploited flaws, phishing and botnets, from the researchers who found them.
117stories this week
16today
the last seven days
Most fromThe Hacker News, BleepingComputer, SecurityWeek, Help Net Security
In the news hereMicrosoft8GitHub6Fortinet6Linux6Lazarus2APT411APT29 (Cozy Bear)1Lumma Stealer1
MyCyberWay trainingYou can't patch everything at once. Learn what to fix first.See the Analyst curriculum
-
OpenBSD flaws, including a 37-year-old BSD bug, enable local attackers to bypass security protections and gain root access. Patches are available. Cybersecurity firm Calif published a full exploit and write-up this week for a local privilege escalation on OpenBSD 7.9 that chains two separate kernel flaws, one of them a 37-year-old integer overflow inherited from…
Security Affairs
-
A fake Web3 accelerator has been observed pushing information stealers and backdoors to Windows and macOS systems using malicious npm packages under the pretext of offering free artificial intelligence (AI) credits for Anthropic Claude and Google Gemini, coding tools, and security audits. “The tools delivered information-stealing malware and backdoors for macOS and Windows machines,” Elastic…
The Hacker News
-
The confirmed and suspected targets include a university rector backing Serbia’s protests and a prosecutor who investigated a Trump-linked Belgrade development, weeks before parliamentary elections.
CyberScoop
-
Malware is evolving rapidly, driven by advances in AI and changes in computing infrastructures. Security professionals must continuously educate themselves on these trends to defend against increasingly sophisticated threats. The traditional game of cat and mouse between security attackers and defenders has got fiercer with fresh techniques evolving and older less effective approaches falling out…
CSO Online UK+1 source
-
Attackers are exploiting vulnerability CVE-2026-106931 in SiteGuard Server Edition to run commands as root or SYSTEM. EG Secure Solutions published an urgent alert warning of CVE-2026-106931, an OS command injection bug in SiteGuard Server Edition. Threat actors are already exploiting it in the wild. A successful exploit lets them run commands with root or SYSTEM…
Security Affairs
-
A flaw in Broadcom’s Wi-Fi setup software lets an attacker within radio range run code as root on Broadcom-based routers, without the network password or any pairing step, security researcher Quentin Kaiser disclosed on October 16. He showed the attack working against home gateways supplied by three Belgian internet providers, in one case reading the…
The Hacker News+1 source
-
A Broadcom Wi-Fi flaw dating back to 2010 allows attackers within Wi-Fi range to execute code on vulnerable routers without authentication. Researcher Quentin Kaiser presented a talk at Hexacon in Paris documenting a vulnerability in Broadcom’s proprietary 802.11 implementation that has been present in their SDK since at least 2010. The bug allows an attacker…
Security Affairs+1 source
-
Attackers are targeting an OS command injection vulnerability in SiteGuard Server Edition that lets them execute commands as root or SYSTEM on affected servers.
BleepingComputer
-
Here is the YARA rule I used to detect “Orphaned VBA Projects Inside DWG Files”.
SANS Internet Storm Center
-
Drupal has patched two critical vulnerabilities that could allow attackers to execute code remotely on websites running any supported version of the content management system.
BleepingComputer
-
Cybersecurity researchers have discovered a malicious npm package that’s part of a recently disclosed software supply chain attack campaign dubbed MALFEX. The package, named “imgdecode,” was uploaded to the package registry on September 30, 2026, by a user named “malfexteste8.” It has been downloaded 979 times as of writing and is still available on npm…
The Hacker News
-
Israeli company Discover-Tech’s ads allow threat actors to fingerprint and track devices at scale and infect selected targets.
SecurityWeek
