BlackX Bootkit Targets Central Asian Diplomats by Bypassing Secure Boot Protections
PremiumBlackX UEFI bootkit exploited Baton Drop to bypass Secure Boot, deployed in espionage targeting diplomatic entities in Central Asia.
Monday, October 26
Friday, October 23
Wednesday, October 21
AOMEI Backupper Software Falls Victim to Short-Lived Supply Chain Attacks
AOMEI Backupper updates briefly served a downloader for ShinyRoad backdoor during multiple short compromise windows.
Siemens Software Center Exploit Uncovered in Malware Campaign
Attackers used genuine Siemens Software Center paired with malicious DLLs to infect Windows PCs via ClickFix lures.
Fake Web3 Accelerator Uses npm Packages to Spread Malware and Compromise AI Traffic
Malicious npm packages from fake Web3 accelerator deliver info-stealers and backdoors and hijack AI agent traffic.
OVHcloud CLI Downloads Compromised by Malware Attack
Attackers replaced five OVHcloud CLI release downloads on GitHub with builds that steal developer secrets from disk.
Monday, October 19
MALFEX Campaign Continues with Malicious npm Package 'imgdecode'
PremiumMalicious npm package 'imgdecode' contains a Windows native addon shellcode loader, part of the MALFEX supply-chain campaign.
Google Enhances Chrome Security with Significant Vulnerability Patches
PremiumGoogle patched 10 Chrome vulnerabilities including a DOM memory corruption reported via Anthropic's Claude, one critical flaw fixed.
AOMEI Backupper Update Servers Compromised to Deliver Backdoor
PremiumAttackers intermittently tampered AOMEI Backupper update servers between May and July to deliver a backdoor via updates.
Critical Flaw in Collabora Online Jeopardizes Nextcloud Servers
PremiumAttackers exploit Collabora Online CVE-2026-110447 to execute OS commands and plant web shells on Nextcloud servers.
Friday, October 16
CISA Alerts on Ivanti and Microsoft Vulnerabilities Amid Record Patch Tuesday
PremiumCISA issues warning about newly exploited Ivanti vulnerability while Microsoft ships record-breaking Patch Tuesday fixes.
Security Experts Use AI to Develop Chrome Exploit in Record Time
PremiumResearchers used a public GPT-5.6 model to craft a full-chain Chrome exploit in six days, leading Google to patch three bugs.
Critical Windows Shell Vulnerability Patched Amid Active Exploitation
PremiumMicrosoft patched actively exploited Windows Shell zero-day CVE-2026-96951 that bypasses Mark of the Web protections (CVSS 8.8).
Microsoft Sets New Record with Patch Tuesday, Addressing Over 1,400 Vulnerabilities
PremiumMicrosoft released fixes for 1,413 vulnerabilities including an actively exploited Windows Shell zero-day; prioritize high-severity updates.
Wednesday, October 14
Zoom Flaws Risk Sensitive Data Exposure via Network Access
Certificate validation flaws in Zoom clients could allow attackers to access sensitive notes and data without authentication via network control.
Microsoft Introduces Risk Cohorts in October Patch Tuesday Update
Microsoft's October patch batch addresses over 1,400 vulnerabilities and introduces risk cohorts to help prioritization.
Monday, October 12
Wednesday, October 7
MALFEX Malware Campaign Exploits NPM Packages with Over 40,000 Downloads
MALFEX campaign published eight malicious NPM packages since 2023, accumulating ~40,000 downloads and supply-chain compromise risk.
Engineer Sentenced for Network Sabotage Impacting Thousands of Devices
Former engineer sentenced for locking 3,000+ employer devices in a ransomware-style sabotage on a Windows network.
Ransomware Attack Hits University of Illinois Chicago's Medical School
Ransomware impacted University of Illinois Chicago College of Medicine, with data theft reported from servers.
Get these articles delivered to your inbox.
Subscribe free