News
Paws Runner Loader Uses Steganography To Deploy Pure Logs Infostealer
1+ hour, 7+ min ago (372+ words) Cybercriminals are continually upgrading their stealth tactics to bypass modern security defenses. Instead of directly downloading malicious files, threat actors now hide their dangerous payloads within everyday media formats. The attackers use a steganography loader called Paws Runner to deploy…...
SQL Injection, File Read Vulnerability Affect 1 M Avada Word Press Sites
2+ hour, 17+ min ago (342+ words) Two severe security vulnerabilities discovered in the Avada Builder Word Press plugin have put approximately 1 million active websites at risk of credential theft, database compromise, and full-site takeover. Wordfence published the findings on May 13, 2026, after researcher Rafie Muhammad responsibly disclosed…...
Critical Funnel Kit Bug Leaves Woo Commerce Stores Open To Attacks
1+ hour, 9+ min ago (435+ words) A severe vulnerability has compromised the security of over 40, 000 Woo Commerce storefronts, allowing cybercriminals to steal customer payment data during checkout silently. Active attacks are already underway, leveraging a critical flaw in the popular Funnel Builder by Funnel Kit plugin…...
Rogue npm Packages Target Developers SSH Keys, Cloud Tokens, and Crypto Wallet Data
2+ hour, 51+ min ago (452+ words) The open-source ecosystem has become a dangerous minefield for developers. A fierce new typosquatting campaign is actively hunting software engineers, threatening to hijack cloud environments, drain cryptocurrency wallets, and turn infected machines into a massive DDo S botnet. This escalating…...
Apple M5 mac OS Kernel Exploit Built in Five Days with Mythos Preview
2+ hour, 59+ min ago (415+ words) The first public mac OS kernel memory-corruption exploit running on Apple M5 silicon was built in just five days using a combination of human expertise and Anthropic's AI model, Mythos Preview. On May 14, 2026, the Calif research team personally visited Apple Park…...
Tycoon 2 FA Adopts OAuth Device Code Attacks In MFA Bypass Campaign
3+ hour, 45+ min ago (352+ words) Threat actors rarely stay down for long. Just weeks after a massive global takedown in March 2026, the notorious Tycoon 2 FA Phishing-as-a-Service (Phaa S) kit has resurfaced with a dangerous new trick. Security researchers at the e Sentire Threat Response Unit (TRU)…...
Palo Alto PAN-OS 0-Day Exploited to Execute Arbitrary Code as Root on Firewalls
3+ day, 28+ min ago (256+ words) The vulnerability, tracked as CVE-2026-0300 with a CVSS score of 9. 3, was weaponized as early as April 9, 2026, nearly a month before public disclosure on May 6, 2026 granting threat actors significant time to quietly compromise exposed systems. CVE-2026-0300 is a buffer overflow flaw…...
Critical Next. js Flaw Exposes Cloud Credentials, API Keys, and Admin Panels
2+ day, 23+ hour ago (371+ words) A high-severity vulnerability in Next. js, one of the world's most widely used React frameworks, is putting thousands of organizations at risk of credential theft, API key exposure, and unauthorized access to internal admin panels. Tracked as CVE-2026-44578 with a…...
Android 16 VPN Bypass Lets Apps Reveal Users" Real IP Address
2+ day, 17+ hour ago (271+ words) A critical security flaw discovered in Android 16 allows malicious apps to leak a user's real IP address even when "Always-On VPN" and "Block connections without VPN" are fully enabled, two settings users trust as an ironclad guarantee of privacy. The…...
Amazon Redshift JDBC Driver Flaws Enable Remote Code Execution
2+ day, 21+ hour ago (335+ words) Amazon Redshift users are facing a serious security risk after researchers uncovered a high-severity vulnerability that could allow attackers to execute arbitrary code on affected systems. The flaw, tracked as CVE-2026-8178, affects the widely used Amazon Redshift JDBC Driver and…...