Researchers uncover 7,600 FakeGit GitHub repos, including 800 AI skills and MCP lures spreading SmartLoader malware.

Russian intelligence hijacks exposed cameras to track military routes as Censys flags 87,000 devices matching known-exploited ...

HollowGraph uses Microsoft 365 calendar events dated to 2050 to receive commands and exfiltrate encrypted files through ...

Three malicious RubyGems packages in the SleeperGem attack skip CI runners, target developer machines, and install persistent ...

Hugging Face says an autonomous AI agent breached production through a malicious dataset, accessing internal data and service ...

A solo Russian-speaking threat actor known as "bandcampro" outsourced a chunk of their operations to Google's open-source ...

AI-driven discovery widens the exposure window as attackers break out in 29 minutes while critical application flaws take 55 ...

Rapid7 pulls 1,048 files from an exposed server, linking an LLM-assisted phishing pipeline to a live WebDAV campaign ...

This recap covers exploited flaws, exposed systems, malware campaigns, weak defaults, and the security gaps demanding ...

F5 patches CVE-2026-42533, a regex map heap overflow that crashes nginx workers and may allow RCE in specific configurations.

Opening a crafted XZ archive in 7-Zip could let an attacker run code on the machine. The flaw, CVE-2026-14266, is a ...

AI agents inherit long-lived secrets and standing privilege, turning old identity gaps into machine-speed risk across ...