Stolen and leaked credentials lead to Node.js packages from AsyncAPI and Jscrambler Code Integrity being poisoned with ...

Artificial intelligence company OpenAI has confirmed that the mystery attacker behind last week's Hugging Face breach was two ...

Chrome Firefox security update July 2026 delivered emergency patches across five vendors on July 15: Mozilla confirmed public ...

Zimbra zero-click vulnerability CVE-2025-66376 is being actively exploited by Russian hackers targeting NATO governments and defense contractors. Unit 42 and CISA warn that Void Blizzard has raided ...

Capital One has open-sourced VulnHunter, an AI security tool that finds exploitable code flaws, maps attack paths and helps ...

Attackers are exploiting two WordPress flaws as wp2shell, chaining them for unauthenticated RCE and deploying web shells and ...

A researcher who discovered a critical vulnerability in WordPress has used OpenAI’s latest model to develop an exploit chain ...

The Swift Package Index is no longer independent as Apple has taken control, but it will remain an open source search engine for third-party code. The Swift Package Index gave developers one trusted ...

The Jscrambler client-side web security company disclosed that a threat actor published a malicious version of its npm ...

Malicious Jscrambler NPM package versions distributed a cross-platform credential stealer in a new supply chain attack.

Five malicious versions of AsyncAPI packages were published to the Node Package Manager (npm) in a supply-chain attack that ...

The popular product lifecycle management platform is under active exploitation for an RCE vulnerability that could put intellectual property in jeopardy. Hackers are exploiting a critical ...