An unauthenticated attacker can read any file the service account can access on Gitea, the self-hosted Git platform, in versions 1.22.1 through 1.27.0. No login, no repository write access. A public repository and crafted Org-mode markup are enough. The flaw is fixed in Gitea 1.2…
GitGuardian researchers found 321 n8n instances accepting API tokens exposed in public GitHub commits and demonstrated four ways attackers could use them to access sensitive data and downstream credentials without exploiting a software vulnerability. We scanned public GitHub com…
A cluster of 77 extensions on the Open VSX marketplace has been found to impersonate legitimate developer tools while transmitting information about the systems and development environments on which they were installed. The "evil twin" extensions were uploaded to the repository …
The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on August 5, 2026, added three flaws to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation in the wild. The list of vulnerabilities is as follows - CVE-2026-9198 (CVSS sc…
Learn how Kali365 has been abusing Microsoft device login to gain OAuth tokens, targeting US firms, and how SOC teams can detect, hunt, and stop these phishing attacks.
Cybersecurity researchers have disclosed what has been described as a "long-standing supply chain attack" on QuickFox, a virtual private network (VPN) and network acceleration tool designed for overseas Chinese users. According to Fortinet FortiGuard Labs, the supply chain attac…
TP-Link has patched 15 vulnerabilities in the zero-touch provisioning (ZTP) mechanism of its Omada network devices that could be chained with previously disclosed flaws to achieve remote code execution (RCE). [...]
The Greatness phishing-as-a-service (PhaaS) platform has expanded from credential phishing to adversary-in-the-middle attacks and device-code phishing targeting Microsoft 365 accounts. [...]
Mais de 24 mil interfaces de gerenciamento de servidores acessíveis pela internet divulgam hashes de autenticação antes do login. A vulnerabilidade CVE-2013-4786, introduzida em 2004 no protocolo IPMI 2.0, permite que invasores obtenham hashes de senha e os decifrem offline. A fa…
Um invasor comprometeu a conta de um mantenedor de pacotes populares no npm e espalhou um programa malicioso que rouba credenciais de acesso. Segundo Ilyas Makari, que divulgou o caso em 4 de agosto, o ataque atingiu diretamente o pacote keyv, usado em cerca de 127 milhões de dow…
A Proofpoint identificou que atacantes estão desenvolvendo e vendendo, em fóruns clandestinos, ferramentas para explorar injeção indireta de prompt (IDPI), com “assinaturas” a partir de US$ 150 por mês. As ofertas incluem geradores de IDPI para e-mails, PDFs, convites de calendár…
A new version of the XCSSET malware is targeting thousands of macOS users through compromised Xcode projects and GitHub repositories. [...]
77 extensions on the Open VSX marketplace impersonated legitimate developer tools while transmitting information about the systems and development environments where they were installed. [...]
The attacks use diverse social engineering lures and rotating payloads to deliver ScreenConnect for persistent remote access to compromised networks.
Shai-Hulud npm worm spreads through Keyv and hundreds of packages with 2 billion monthly downloads, stealing npm, GitHub, cloud and CI credentials in real time.
A Huge Networks, empresa brasileira especializada em mitigação de DDoS e infraestrutura cloud, publicou hoje seu relatório HugeReport. O estudo, desenvolvido com dados registrados pela empresa no atendimento a seus clientes, indica que houve 108.393 ataques DDoS em junho de 2026,…
The commercial phishing-as-a-service (PhaaS) toolkit known as Greatness has become the latest crimeware solution to add support for device code phishing, a rapidly growing cyber threat that abuses the legitimate OAuth 2.0 Device Authorization Grant to bypass Multi-Factor Authenti…
Self-propagating malware named 'ChainDrop' has compromised more than 1,300 packages with a combined 2 billion monthly downloads on the Node Package Manager (npm) registry. [...]
Las Vegas, United States, 4th August 2026, CyberNewswire
A credential-stealing npm worm that first appeared in keyv@6.0.0 spread beyond the Keyv and Cacheable namespaces into hundreds of packages across multiple organizations on August 4, 2026. SafeDep verified 353 poisoned versions across 79 package names in the npm registry. Its mon…
