A credential-stealing NPM worm in Keyv spread beyond the original namespace and poisoned hundreds of npm packages. It also planted editor hooks that can trigger the payload when a workspace is trusted.
Researchers uncovered SMOKE#SCREEN fake updates using Adobe/Zoom-themed lures to push ScreenConnect into victims’ systems. The campaign ends with persistent remote access via attacker-controlled relay servers.
Security researchers disclosed 15 Omada ZTP vulnerabilities. Some flaws can be combined to steal credentials and potentially take over controller accounts and managed device fleets.
Obsidian Security welcomes $85 million in new funding and continues building AI-agent governance. The platform helps teams determine what AI agents are allowed to do in enterprise applications.
Generative AI is changing how attackers work: less reliance on deep expertise, more iteration via natural-language help. Defenders must continuously validate security controls as exploit timelines compress.
Google removed three ADK AI workflows after an investigation showed that a public GitHub issue could steer a triage agent toward a privileged code-fixing agent. Potential impacts included CI execution and bot PAT theft.
A researcher found an agent-to-agent attack path in Google’s Python ADK that could expose sensitive tools and enable pull request tampering. Mitigations were applied, but the scenario still required social engineering to merge malicious code.
cPanel has patched a cPanel critical flaw (CVE-2026-58048) that could allow an authenticated account to execute SQL with database administrative root privileges. The update also addresses additional cPanel and Exim-related issues and offers temporary workarounds.
A decades-old weakness in BMC management through IPMI can leak password hashes and allow offline password cracking. Thousands of internet-facing interfaces increase the urgency for patching and credential hardening.
A new Russian loader-as-a-service called DOUBLECUP stages malware through ClickFix by hiding code in images stored in the browser cache. It then decrypts and executes second-stage payloads like CountLoader and DeviceManager.
