Cybersecurity researchers have uncovered a long-running supply chain attack that compromised QuickFox, a VPN and network acceleration application widely used by Chinese citizens living overseas. According to researchers at Fortinet FortiGuard Labs, attackers secretly modified the Windows installer for QuickFox…
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has expanded its Known Exploited Vulnerabilities (KEV) catalog by adding three newly confirmed security flaws that are actively being exploited by attackers. The update, published on August 5, 2026, serves as an…
A sophisticated phishing toolkit known as Kali365 is exploiting Microsoft’s legitimate authentication process to compromise Microsoft 365 accounts, giving attackers potential access to corporate email, cloud storage, and other business resources. Unlike traditional phishing attacks that rely on fake login…
Cybersecurity researchers have uncovered a new blockchain-based technique that allows attackers to hide malware command-and-control (C2) server addresses in a way that is even more difficult to detect than previous methods. The technique, dubbed NullReceiver, was discovered in two malicious…
Security researchers have disclosed three serious vulnerabilities in Paperclip, an open-source control platform designed to manage teams of AI agents. Two of the flaws could allow attackers to execute malicious commands on either a server or a developer’s local machine,…
OpenAI has dismantled a network of ChatGPT accounts connected to a large-scale scam operation believed to be operating from Poipet, Cambodia. According to the company, the group used generative AI to support multiple fraud campaigns, including investment scams, romance fraud,…
Security researchers have revealed 12 critical vulnerabilities affecting the popular vm2 Node.js library, exposing applications to sandbox escapes and remote code execution attacks. The vm2 package is widely used by developers to safely run untrusted JavaScript code inside isolated environments.…
Security researchers have disclosed 12 high-severity vulnerabilities affecting the widely used vm2 Node.js library, raising serious concerns for developers and organizations that rely on the package to securely execute untrusted JavaScript code. The open-source vm2 library is commonly used to…
Cybersecurity researchers have uncovered a new supply chain attack involving malicious packages uploaded to the Python Package Index (PyPI) repository that secretly install a previously undocumented malware strain called ZiChatBot on both Windows and Linux devices. According to researchers at…
Many organizations believe that signing an incident response retainer agreement means they are prepared for a cyberattack. Security experts say that assumption is dangerously misleading. A retainer may guarantee that someone answers the phone during a crisis, but it does…
