As organizations prepare for 2026, cybersecurity predictions are everywhere. But many of these outlooks are shaped by headlines and speculation rather than solid evidence. The real challenge is no longer finding predictions. It is figuring out which ones point to…
Researchers uncovered a phishing setup that relies on a concealed HTML form element containing a webhook[.]site URL. JavaScript embedded in the page quietly sends a “page opened” signal, captures any credentials entered by the victim, and forwards them to the…
If you’re using the @adonisjs/bodyparser npm package, you should update to the latest version. A newly disclosed high-severity vulnerability could allow a remote attacker to write arbitrary files on your server if they can reach a file upload endpoint. The…
n8n recently introduced a task runner-based native Python option to improve security isolation. This feature first appeared in version 1.111.0 as an optional setting and could be turned on using the environment variables N8N_RUNNERS_ENABLED and N8N_NATIVE_PYTHON_RUNNER. With the release of…
Several popular AI-driven code editors built on Visual Studio Code are raising new supply-chain security concerns after researchers found they recommend extensions that don’t actually exist in the Open VSX registry. The affected tools include VS Code forks such as…
There was a time when identity lived in one place. A single LDAP directory, an HR database, or one IAM portal handled who could access what. That reality is gone. Today, identities are scattered across SaaS platforms, on-prem systems, cloud…
I want to draw attention to a new malware campaign security researchers are tracking under the name PHALT#BLYX, which is actively targeting organizations in the European hospitality sector. According to findings from Securonix, the campaign relies on ClickFix-style social engineering…
Cybersecurity analysts have uncovered two newly published Chrome browser extensions that secretly siphon conversations from AI chatbots such as ChatGPT and DeepSeek, along with users’ browsing activity, and transmit the data to attacker-controlled servers. The extensions, which together have been…
The Cyber Security Agency of Singapore (CSA) has issued an urgent warning about a critical security flaw affecting SmarterMail, a widely used email and collaboration platform. The vulnerability, tracked as CVE-2025-52691, has been given the highest possible severity score of…
In this campaign, attackers begin by directing victims through a seemingly legitimate workflow that gives the attack an air of authenticity. The initial link sends users to content hosted on googleusercontent[.]com, a trusted Google-controlled domain, which helps lower suspicion. At…
