A malicious website can work out which sites you visit and which apps you open, using nothing but JavaScript and the timing of your SSD. The attack, called FROST, needs no native code, no extension, and no permission prompt. You open the page, leave the tab sitting there, and it…
The Miasma supply chain campaign has sparked a fresh attack wave called Hades, this time involving 37 malicious wheel artifacts across 19 packages in the Python Package Index (PyPI) registry, as the Mini Shai-Hulud-style attacks continue to be refined and splintered to target spe…
CISA has ordered U.S. government agencies to secure their Check Point Remote Access VPN and Mobile Access deployments against a critical vulnerability exploited in zero-day attacks by Qilin ransomware affiliates. [...]
Google has released emergency updates to patch another Chrome zero-day vulnerability that has been exploited in the wild, the fifth such flaw patched since the start of the year. [...]
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a high-severity flaw impacting BerriAI LiteLLM to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerability, tracked as CVE-2026-42271 (CVSS score:…
A IBM e a AT&T teriam ocultado do governo americano invasões de hackers estrangeiros em seus sistemas e redes, segundo processo aberto por William Barlow, ex-vice-presidente de inteligência de ameaças da IBM, apresentado em 2020 e divulgado agora, após o Departamento de Justiça d…
WhatsApp says it blocked Israeli firm NSO’s Pegasus spyware activity and is asking a US court to treat the targeting as an injunction breach.
A Meta informou que aproximadamente 20 mil contas do Instagram podem ter sido comprometidas após hackers explorarem uma vulnerabilidade na ferramenta de recuperação de contas assistida por IA, de acordo com comunicado enviado ao procurador-geral do Maine e reportado pela Security…
New variants of the NFCShare Android malware are being distributed as fake updates for legitimate banking apps hosted on GitHub. [...]
AI-generated content threatens credibility in cybersecurity. This "Ask the Expert" column explores why human oversight matters and how to maintain authentic narratives.
SoFi Hong Kong is warning that it suffered a data breach after hackers gained access to a database at a third-party vendor containing customer information. [...]
Uma investigação iniciada em 4 de junho de 2026 identificou a exploração ativa da falha CVE-2026-50751 (CVSS de 9.3) em implantações de VPN de acesso remoto e acesso móvel que utilizam o protocolo de troca de chaves descontinuado IKEv1. A informação foi publicada hoje (8) por Lot…
At WWDC 26, Apple announced an Apple Intelligence-powered feature that can automatically fix weak and compromised passwords. This works in Safari, and it's rolling out with iOS 27. [...]
The financially motivated group is combining vishing, IT impersonation, and in-person office intrusions to steal data and extort victims.
Hackers compromised 19 packages on the PyPI, collectively downloaded hundreds of thousands of times, in a new Shai-Hulud supply-chain attack that delivered malware designed to steal developer secrets. [...]
A newly discovered, critical zero-day vulnerability is under attack; a Qilin ransomware affiliate has been blamed for at least one incident.
Security researchers have published a detailed, working exploit for a Linux kernel use-after-free that lets an unprivileged local user escalate to root and break out of a container. The flaw, CVE-2026-23111, sits in the kernel's nf_tables packet-filtering code and was patched up…
Uma vulnerabilidade de gravidade crítica no plugin Everest Forms Pro, presente em mais de 100 mil sites WordPress, está sendo explorada ativamente desde 13 de abril para tomar controle de páginas, de acordo com alerta da empresa de segurança Defiant. A falha, registrada como CVE-…
O GitHub desativou 73 repositórios da Microsoft em um intervalo de 105 segundos depois que seus alarmes foram acionados na última sexta-feira (5 de junho), ao detectar sinais de infecção pelo worm Miasma, de acordo com análise da StepSecurity divulgada pelo The Register. Hackers …
Está aberta até 15 de junho a consulta pública sobre a minuta de decreto que institui a Estratégia Nacional de Segurança da Informação (E-SegInfo) e o Sistema Integrado de Segurança da Informação (SISInfo), iniciativa da Secretaria de Segurança da Informação e Cibernética (SSIC/G…
