Shai Hulud attack ships signed malicious TanStack, Mistral npm packages
Hundreds of packages across npm and PyPI have been compromised in a new Shai-Hulud supply-chain campaign delivering credential-stealing malware targeting developers. [...]
Últimas Notícias
3579 notíciasWorm Redux: Fresh Mini Shai-Hulud Infections Bite Supply Chain
Hundreds of npm packages infected by the self-propagating, credential-stealing worm from TeamPCP are related to the open source TanStack ecosystem.
SAP fixes critical vulnerabilities in Commerce Cloud and S/4HANA
SAP has released the May 2026 security updates addressing 15 vulnerabilities across multiple products, including two critical flaws in the Commerce Cloud enterprise-grade e-commerce platform and the S/4HANA ERP suite. [...]
Google vê risco crescente no uso de IA por Cibercriminosos
O Google identificou o que considera um marco preocupante na evolução das ameaças digitais: um grupo criminoso teria usado inteligência artificial para descobrir uma vulnerabilidade desconhecida e desenvolver uma exploração contra uma ferramenta amplamente usada de administração …
Your private medical records are vulnerable. Here’s why. – The Washington Post
Your private medical records are vulnerable. Here’s why. The Washington Post
Why Agentic AI Is Security's Next Blind Spot
Agentic AI is already running in production environments across many organizations today. It is executing tasks, consuming data, and taking actions — most likely without meaningful involvement from the security team. The industry conversation has largely framed this as a question…
70% dos brasileiros já foram vítimas de golpe digital, aponta organização
Sete em cada dez brasileiros foram vítimas de golpe digital nos últimos 12 meses. O dado é do relatório "Estado dos Golpes no Brasil 2025", da Global Anti-Scam Alliance (GASA), que também aponta uma média de 252 tentativas de fraude por pessoa ao longo do ano. É nesse cenário que…
Instructure reaches 'agreement' with ShinyHunters to stop data leak
Instructure, the edtech giant behind the widely popular Canvas learning management system (LMS), has reached an "agreement" with the ShinyHunters extortion group to prevent the data stolen in a recent breach from being leaked online. [...]
Mini Shai-Hulud Worm Compromises TanStack, Mistral AI, Guardrails AI & More Packages
TeamPCP, the threat actor behind the recent supply chain attack spree, has been linked to the compromise of the npm and PyPI packages from TanStack, UiPath, Mistral AI, OpenSearch, and Guardrails AI as part of a fresh Mini Shai-Hulud campaign. The affected npm packages have been …
HistoSonics seeks FDA de novo authorization in kidney cancer
Investors including Bezos Expeditions and Thiel Bio supported HistoSonics’ expansion plans last year by participating in a $250 million financing round.
Instructure Reaches Ransom Agreement with ShinyHunters to Stop 3.65TB Canvas Leak
American educational technology company Instructure, the parent company of Canvas, said it reached an "agreement" with a decentralized cybercrime extortion group after it breached its network and threatened to leak stolen information from thousands of schools and universities. In…
OpenAI Launches Daybreak for AI-Powered Vulnerability Detection and Patch Validation
OpenAI has launched Daybreak, a new cybersecurity initiative that brings together frontier artificial intelligence (AI) model capabilities and Codex Security to help organizations identify and patch vulnerabilities before attackers find a way in using the same issues. "Daybreak c…
iOS 26.5 Brings Default End-to-End Encrypted RCS Messaging Between iPhone and Android
Apple on Monday officially released iOS 26.5 with support for end-to-end encryption (E2EE) to Rich Communication Services (RCS) in beta as part of a "cross-industry effort" to replace traditional SMS with a more secure alternative. To that end, E2EE RCS messaging is rolling out t…
GM agrees to $12.75M California settlement over sale of drivers’ data
California Attorney General Rob Bonta announced a proposed $12.75 million settlement agreement with General Motors (GM) over allegations that the company violated the California Consumer Privacy Act (CCPA). [...]
Linux bitten by second severe vulnerability in as many weeks
Production-version patches are coming online and should be installed pronto.
Official CheckMarx Jenkins package compromised with infostealer
Checkmarx warned over the weekend that a rogue version of its Jenkins Application Security Testing (AST) plugin had been published on the Jenkins Marketplace. [...]
New GhostLock tool abuses Windows API to block file access
A security researcher has released a proof-of-concept tool named GhostLock that demonstrates how a legitimate Windows file API can be abused in attacks to block access to files stored locally or on SMB network shares. [...]
Google Says Hackers Used AI to Develop a Zero-Day Exploit
Google researchers say hackers used AI to develop zero-day exploits, Android backdoors, and automated supply chain attacks targeting GitHub and PyPI.
Conectividade e IA impulsionam Hospitalar 2026 como hub de inovação e negócios
Com mais de 1.200 marcas expositoras, principal evento de saúde da América Latina reunirá líderes do setor em torno de inovação, eficiência operacional, experiência do paciente e transformação digital. Participe! The post Conectividade e IA impulsionam Hospitalar 2026 como hub de…
Phishing em empresa de água gera multa de €1,1 mi
Uma empresa britânica de água potável foi multada em 1,1 milhão de euros devido a uma violação de dados iniciada por um e-mail de phishing que levou a um ataque de ransomware. A penalidade foi aplicada pelo regulador britânico de privacidade ICO, conforme divulgado ontem (11 de m…