LMDeploy Vulnerability Exploited Within Hours of Release
A high-severity security flaw in LMDeploy, an open-source toolkit for compressing, deploying, and serving LLMs, has come under active exploitation in the wild l
Cybersecurity
673 articles
CISA Issues Urgent Patch Order for Active Windows Vulnerability
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to secure their Windows systems against a vulnerability exploited
New Threat Group UNC6692 Exploits Teams for Malware Distribution
A previously undocumented threat activity cluster known as UNC6692 has been observed leveraging social engineering tactics via Microsoft Teams to deploy a custo
Critical LiteLLM Vulnerability Exploited in Active Attacks
Hackers are targeting sensitive information stored in the LiteLLM open-source large-language model (LLM) gateway by exploiting a critical vulnerability tracked
AI-Powered Attacks Shrink Time to Fix Vulnerabilities
Imagine a world where hackers don't sleep, don't take breaks, and find weak spots in your systems instantly. Well, that world is already here. Thanks to AI, att
VECT 2.0 Ransomware Flaw Destroys Large Files Instead of Encrypting
Researchers are warning that the VECT 2.0 ransomware has a problem in the way it handles encryption nonces that leads to permanently destroying larger files rat
Supply Chain Vulnerabilities Persist as Attackers Exploit Familiar Flaws
You scroll past one incident and see another that feels familiar, like it should have been fixed years ago, but it still works with small changes. Same bugs. Sa
Vimeo Confirms User Data Exposed in Anodot Security Breach
Vimeo has disclosed that data belonging to some of its customers and users has been accessed without authorization following the recent breach at the Anodot dat
AI Bug Hunter: Anthropic Delays Release to Patch Vulnerabilities
Last week, Anthropic announced Project Glasswing, an AI model so effective at discovering software vulnerabilities that they took the extraordinary step of post
US Charges Scattered Spider Member Arrested in Finland
A 19-year-old dual United States and Estonian citizen arrested in Finland earlier this month faces federal charges in the U.S. alleging he was a prolific member
Bitwarden CLI Targeted in Major Supply Chain Security Breach
Bitwarden CLI has been compromised as part of the newly discovered and ongoing Checkmarx supply chain campaign, according to new findings from Socket. "The affe
Checkmarx Confirms LAPSUS$ Group Leaked Stolen Source Code
Application security company Checkmarx has confirmed that the LAPSUS$ threat group leaked data stolen from its private GitHub repository. [...]
Vercel Uncovers Additional Compromised Accounts in Security Breach
Vercel on Wednesday revealed that it has identified an additional set of customer accounts that were compromised as part of a security incident that enabled una
Microsoft Phases Out Legacy TLS in Exchange Online
Microsoft says it will start blocking legacy TLS connections for POP and IMAP email clients in Exchange Online starting in July 2026. [...]
China-Linked Hackers Target Mongolia Government with Go Backdoors
Mongolian governmental institutions have emerged as the target of a previously undocumented China-aligned advanced persistent threat (APT) group tracked as Goph
Threat Actors Publishing Structured OPSEC Playbooks
Threat actors are now publishing structured OPSEC playbooks to stay undetected. Flare reveals how these guides outline layered infrastructure, identity separati
Apple Fixes iOS Flaw That Retained Deleted Notifications
Apple has rolled out a software fix for iOS and iPadOS to address a Notification Services flaw that stored notifications marked for deletion on the device. The
Microsoft Addresses Remote Desktop Warning Display Glitch
Microsoft has confirmed a new issue causing newly introduced Windows security warnings to display incorrectly when opening Remote Desktop (.rdp) files. [...]
Malicious Docker Images Target Checkmarx KICS Supply Chain
Cybersecurity researchers have warned of malicious images pushed to the official "checkmarx/kics" Docker Hub repository. In an alert published today, software s
Microsoft Forces iPhone Users to Reauthenticate After Outlook Outage
After addressing a widespread outage that affected Outlook.com users worldwide on Monday, Microsoft has asked iPhone users to re-enter their credentials to rega
Self-Propagating Worm Targets npm Packages, Steals Developer Tokens
Cybersecurity researchers have flagged a fresh set of packages that have been compromised by bad actors to deliver a self-propagating worm that spreads through
Robinhood Flaw Exploited for Large-Scale Phishing Attack
Online trading platform Robinhood's account creation process was exploited by threat actors to inject phishing messages into legitimate emails, tricking users i
Harvester's Linux GoGra Backdoor Targets South Asia
The threat actor known as Harvester has been attributed to a new Linux version of its GoGra backdoor deployed as part of attacks likely targeting entities in So
73 Malicious Extensions Hide in OpenVSX Ecosystem
A new wave of the Glassworm campaign is targeting the OpenVSX ecosystem with 73 "sleeper" extensions that turn malicious after an update. [...]
AI Agent Platform Moltbook Exposed 1.5M API Tokens
On January 31, 2026, researchers disclosed that Moltbook, a social network built for AI agents, had left its database wide open, exposing 35,000 email addresses
Canadian Police Bust SMS Blaster Ring in Toronto
Canadian authorities have arrested three men for operating an "SMS blaster" device that pretends to be a cellular tower to send phishing texts to nearby phones.
Microsoft Releases Emergency Patch for Critical ASP.NET Core Flaw
Microsoft has released out-of-band updates to address a security vulnerability in ASP.NET Core that could allow an attacker to escalate privileges. The vulnerab
Chinese National Extradited to US Over Cyberespionage
A Chinese national accused of carrying out cyberespionage operations for China's intelligence services has been extradited from Italy to the United States to fa
Lotus Wiper Malware Strikes Venezuelan Energy Infrastructure
Cybersecurity researchers have discovered a previously undocumented data wiper that has been used in attacks targeting Venezuela at the end of last year and the
Social Media Scams Cost Americans Over $2.1B in 2025
The U.S. Federal Trade Commission (FTC) warned of a massive increase in losses from social media scams since 2020, exceeding $2.1 billion in 2025. [...]
New LOTUSLITE Malware Variant Targets Indian Banks
Cybersecurity researchers have discovered a new variant of a known malware called LOTUSLITE that's distributed via a theme related to India's banking sector. "T
Proactive Threat Detection: Catching Cyberattacks Early
On Thursday, April 30 at 2:00 PM ET, BleepingComputer will host a live webinar with threat intelligence company Flare and threat intelligence researcher Tammy H
Critical Terrarium Sandbox Flaw Allows Root Code Execution
A critical security vulnerability has been disclosed in a Python-based sandbox called Terrarium that could result in arbitrary code execution. The vulnerability
Popular Python Package Compromised in Data Theft Attack
An attacker pushed a malicious version of the popular elementary-data package Python Package Index (PyPI) to steal sensitive developer data and cryptocurrency w
Ransomware Gang Deploys Proxy Malware to 1,570+ Victims
Threat actors associated with The Gentlemen ransomware‑as‑a‑service (RaaS) operation have been observed attempting to deploy a known proxy malware called System
Crypto Heist Accomplice Sentenced to Nearly 6 Years
22-year-old Evan Tangeman of Newport Beach, California, was sentenced to 70 months in prison for laundering funds stolen in a massive $230 million cryptocurren
22 Critical Flaws Found in Serial-to-IP Converters
Cybersecurity researchers have identified 22 new vulnerabilities in popular models of serial-to-IP converters from Lantronix and Silex that could be exploited t
Medtronic Confirms Major Security Breach Affecting Millions
Medical device giant Medtronic disclosed last week that hackers breached its network and accessed data in "certain corporate IT systems." [...]
Ransomware Negotiator Guilty in BlackCat Attack Scheme
A third individual who was employed as a ransomware negotiator has pleaded guilty to conducting ransomware attacks against U.S. companies in 2023. Angelo Martin
ADT Data Breach Compromises 5.5 Million Customer Records
The ShinyHunters extortion group stole the personal information of 5.5 million individuals after breaching the systems of home security giant ADT earlier this m
Why Your SOC's Response Time Lags Behind Industry Leaders
Security teams often present MTTR as an internal KPI. Leadership sees it differently: every hour a threat dwells inside the environment is an hour of potential
Voice Deepfakes: A Growing Threat to Enterprise Security
Three seconds of audio is all it takes to clone a voice for fraud. Adaptive Security shows how deepfake calls trick employees into sending real money—and why mo
Stolen Credentials: Why Attackers Skip Exploits
The cybersecurity industry has spent the last several years chasing sophisticated threats like zero-days, supply chain compromises, and AI-generated exploits. H
Outlook.com Hit by Major Outage Blocking User Access
Microsoft is investigating an ongoing Outlook.com outage that is causing intermittent signing issues and preventing customers from accessing their mailboxes. [.
Hackers Exploit Meta's AI Bot to Breach High-Profile Instagram Accounts
The Instagram accounts for the Obama White House and the Chief Master Sergeant of the U.S. Space Force were briefly defaced with pro-Iranian images and messages
NGate Malware Evolves: Hijacks HandyPay App to Steal NFC Data
Cybersecurity researchers have discovered a new iteration of an Android malware family calledNGate that has been found to abuse a legitimate application called&
Itron Reports Unauthorized Access to Internal IT Systems
Itron, Inc. has disclosed, via an 8-K filing with the U.S. Securities and Exchange Commission (SEC), a cybersecurity incident in which an unauthorized third par
Google Fixes Critical Prompt Injection Flaw in Antigravity IDE
Cybersecurity researchers have discovered a vulnerability in Google's agentic integrated development environment (IDE), Antigravity, that could be exploited to
Microsoft Overhauls Windows Insider Program for Better Testing
Microsoft says it's rolling out a revamped Windows Insider Program experience as part of the broader plans to address performance and reliability concerns affec
CISA Adds 8 Critical Exploited Vulnerabilities to KEV Catalog
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added eight new vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog,