Malware Alert
GitLab Patches Critical CVSS 10.0 Flaw Allowing Server Takeover
GitLab released patches on October 21 for a critical security flaw that scored a perfect 10.0 on the CVSS scale. According to the company, the…
The Entire Internet’s Security Just Failed in a Way No One Thought Possible
Eight certificate authority keys from Indian company eMudhra had private values so weak that anyone could recover them almost instantly. Security researcher “Wayne” discovered the…
Over 40,000 Developers May Have Downloaded This Malware Without Knowing
A malicious npm package called imgdecode hides malware inside image files hosted on GitHub. Security researchers at SafeDep discovered the package as part of the…
Your Banking App Might Not Be Real Anymore, Thanks to This Malware
Security researchers at ThreatFabric discovered a new Android banking trojan called Hirudo that replaces real banking apps with trojanized copies. The malware currently targets eight…
Critical Ivanti VPN Zero-Day Exploited in Active Cyberattacks
A critical zero-day vulnerability in Ivanti Connect Secure VPN appliances is under active exploitation. The flaw lets remote attackers bypass authentication and execute arbitrary commands…
Uploading One PDF Can Give Hackers Full Control of Your Server
Three dangerous vulnerabilities in Ghostscript now put millions of servers at risk. Attackers can exploit these flaws by uploading a malicious PDF or PostScript file…
Hackers Just Built a Stealthier Way to Steal Your iPhone’s Crypto Wallets
Security researchers have discovered P7 DarkSword, a stealthier variant of the iOS exploit kit that now steals crypto wallets and keychain data. iVerify first spotted…
Hackers Are Using NeedyMantis Malware to Maintain Long-Term Access in Targeted Network Breaches
Microsoft disclosed a sophisticated malware family called NeedyMantis that attackers are using to maintain long-term access in networks they have already breached. The malware has…
This LastPass Scam Wipes Out Your Antivirus Before Stealing Everything
Researchers at LastPass and Delphos Labs identified a malicious LastPass Authenticator installer distributed via a fake GitHub repository that ranks high in search results. The…
Attackers May Need Just A Long Username To Take Over Your Network
Check Point released an urgent security patch on September 16 for a critical vulnerability enabling unauthenticated attackers to run code as root on Security Management…
Chinese Threat Actors Exploited Chrome “Patch Gap” to Hit NGOs
A China-linked threat actor has chained multiple software flaws to target non-governmental organizations. Security firm Volexity tracked the campaign under the name UTA0560. It observed…
Attackers Hijack MikroTik Routers Through Exposed SSH
Attackers are actively hijacking MikroTik routers around the world. They exploit the router’s Secure Shell (SSH) remote-access service when it faces the internet. Alarmingly, this…
New AI-Enhanced BraZetsu Malware is Hacking Windows PCs
Cybersecurity researchers disclosed BraZetsu, a sophisticated Python-based Windows malware framework that turns compromised systems into commercial assets. The AI-enhanced toolkit profiles infected hosts, harvests financial…
