Researchers uncover 7,600 FakeGit GitHub repos, including 800 AI skills and MCP lures spreading SmartLoader malware.

Rapid7 pulls 1,048 files from an exposed server, linking an LLM-assisted phishing pipeline to a live WebDAV campaign ...

HollowGraph uses Microsoft 365 calendar events dated to 2050 to receive commands and exfiltrate encrypted files through ...

This recap covers exploited flaws, exposed systems, malware campaigns, weak defaults, and the security gaps demanding ...

Russian intelligence hijacks exposed cameras to track military routes as Censys flags 87,000 devices matching known-exploited ...

OpenSSL fixed HollowByte after 11-byte TLS requests could strand memory on glibc systems, but shipped no CVE, advisory, or ...

Opening a crafted XZ archive in 7-Zip could let an attacker run code on the machine. The flaw, CVE-2026-14266, is a ...

A solo Russian-speaking threat actor known as "bandcampro" outsourced a chunk of their operations to Google's open-source ...

AI agents inherit long-lived secrets and standing privilege, turning old identity gaps into machine-speed risk across ...

Hugging Face says an autonomous AI agent breached production through a malicious dataset, accessing internal data and service ...

Three malicious RubyGems packages in the SleeperGem attack skip CI runners, target developer machines, and install persistent ...

Cybersecurity researchers have discovered nearly 7,600 malicious GitHub repositories, out of which more than 800 pose as artificial intelligence (AI) skills or Model Context Protocol (MCP) servers to ...