2+ day, 19+ hour ago   (248+ words) The attackers built their intrusion around Redis’s master-replica replication system, a feature meant to let one server mirror the data of another for backup or scaling purposes. According to Hunters.io, once the operators confirmed a target server had no…...

4+ day, 19+ hour ago   (507+ words) Four packages is a small blast radius next to the 639 malicious versions pushed during the May campaign. The significance sits elsewhere. npm rolled out publish-time scanning in July, a control that briefly holds new publications for automated analysis before they…...

6+ day, 4+ hour ago   (314+ words) Mathspace has taken its platform offline while remediation continues, and it has notified regulators in both countries. The company says it is still working through notifications to affected individuals and schools, and it has committed to publishing updates on changes…...

1+ week, 5+ day ago   (479+ words) kobaran.com...

2+ week, 3+ day ago   (401+ words) Ubiquiti has shipped patches for three maximum-severity security flaws, including CVE-2026-77537, a bug in its UniFi Protect video surveillance platform that carries a perfect 10.0 CVSS score. An unauthenticated attacker with network access can exploit the flaw without any user interaction,…...

2+ week, 5+ day ago   (588+ words) Microsoft says the vulnerability is already fixed and that customers do not need to do anything on their end. Still, the rollout of information around CVE-2026-69836 included an unusual wrinkle: an early report describing active exploitation that Microsoft later walked…...

2+ week, 6+ day ago   (530+ words) The discovery adds to a growing pattern of threat actors weaponizing everyday collaboration platforms rather than relying solely on traditional email phishing. By hiding behind familiar workplace communication and legitimate cloud infrastructure from Microsoft Azure, the campaign is engineered to…...

4+ week, 1+ day ago   (719+ words) Instead of resolving an attacker-controlled hostname the way most malware does, Aeternum performs a read-only query against the Polygon blockchain and pulls its current instructions directly from smart-contract storage. That single design choice replaces a centralized point of failure with…...

4+ week, 1+ day ago   (268+ words) The campaign is still active, and researchers say the fake GitHub page has been observed using a deceptive “Verified Publisher” badge to appear legitimate. Because the attack depends on user action rather than a software exploit, security teams and everyday…...