Malware Alert
A Single JSON Request Can Now Hijack Java Servers, and There Is No Fix
Attackers are actively exploiting a critical flaw in Fastjson, and Alibaba has not released a fixed 1.x version yet. The vulnerability, tracked as CVE-2026-16723, carries…
New Attack Makes Coding Assistants Run Strangers’ Commands
Ask an AI agent to summarise product reviews, and a single planted review can make it click “Buy Now” instead. That is the unsettling demonstration…
New Ghostcommit Attack Tricks AI Coding Agents Into Stealing Secrets
Security researchers have exposed a clever new way to weaponize AI coding assistants, and it hides in plain sight. The attack, named Ghostcommit, buries malicious…
Your Wi-Fi Router Could Be Hiding Chinese Spy Traffic
Chinese hackers have developed a new LONGLEASH malware to expand their covert relay network, as per Cisco Talos researchers, who exposed the campaign this week.…
New RustDuck Malware Targets Routers and Cameras to Build DDoS Botnet
A new two-stage malware family called RustDuck is hijacking devices worldwide. It targets home routers, IP cameras, Android boxes, and poorly secured servers. It then…
There’s A New Malware Hitting Governments Worldwide Now
Security researchers have uncovered a new malware family called SharkLoader. The loader deploys Cobalt Strike Beacon on compromised systems. The campaign casts a wide net…
Hackers Are Draining 100,000 WordPress Sites Now
A security flaw in the Gravity SMTP plugin for WordPress is under active exploitation. Cybercriminals are abusing the bug, prompting urgent warnings for site owners…
Outdated Routers Are Being Hijacked Worldwide
A previously undocumented malware botnet named AryStinger has compromised more than 4,000 outdated routers. The malware is turning them into proxies for malicious traffic. Researchers…
Operation Endgame Cleans 14,971 Infected WordPress Sites Worldwide
International law enforcement disrupted SocGholish, a malware network linked to Russia’s Evil Corp, cleaning 14,971 hacked WordPress sites and seizing 106 servers. Authorities urge WordPress…
How DragonForce Ransomware Hid in Plain Sight Using Microsoft Teams Infrastructure
A notorious ransomware group secretly infiltrated the network of a major US services firm for up to two months by hiding command-and-control traffic inside Microsoft…
Phishing Overtakes the Dark Web as the Biggest Source of Stolen Personal Data
Phishing and social engineering have overtaken the dark web as the primary source of stolen personal information, according to the 2026 Enterprise Social Engineering Report.…
Researchers Build Self-Replicating AI Malware That Learns and Adapts
Cybersecurity researchers at the University of Toronto have demonstrated a working prototype of an AI-powered computer worm that spreads autonomously between devices, learning and adapting…
A Single WhatsApp Notification Could Have Hacked Your Gemini AI, Research Finds
A single poisoned notification could have hijacked Google Gemini’s voice assistant on Android. The malicious message could come from WhatsApp, Slack, SMS, Signal, Instagram, or…
