A misconfigured AWS CodeBuild webhook allowed bypass of actor ID checks, risking takeover of four AWS GitHub repositories ...

Enterprise AI agents boost automation but often run with broad permissions, allowing actions beyond user access and weakening ...

A critical WordPress Modular DS plugin flaw (CVE-2026-23550) allows unauthenticated attackers to gain admin access; patched in version 2.5.2.

This week's stories show how fast attackers change their tricks, how small mistakes turn into big risks, and how the same old ...

AI security risks are shifting from models to workflows after malicious extensions stole chat data from 900,000 users & ...

In 2026, leading SOCs reduce MTTR and MTTD by using automated, behavior-based analysis instead of manual reviews and static scans.

Microsoft shut down RedVDS, a crimeware subscription service used for phishing and BEC fraud, linked to $40M U.S. losses and ...

Palo Alto Networks fixed CVE-2026-0227, new GlobalProtect flaw that lets unauthenticated attackers trigger firewall DoS & ...

The Kimwolf botnet compromised more than 2 million Android devices, turning them into residential proxies for DDoS attacks and traffic abuse.

Active malware exploits DLL side-loading in a signed GitKraken binary to deliver trojans, stealers, and remote access malware ...

Fortinet patches a critical FortiSIEM vulnerability (CVE-2025-64155) that allows unauthenticated remote code execution via ...

A study of 4,700 websites finds 64% of third-party apps access sensitive data without business need, exposing government and ...