Cybersecurity

U.S. CISA added two maximum-severity Joomla extension flaws to its Known Exploited Vulnerabilities (KEV) catalog after zero-day attacks in the wild.Both vulnerabilities—CVE-2026-48939 in iCagenda...

Suspected China- and India-aligned threat actors targeted Pakistani law enforcement in a sustained cyber espionage campaign between February 2024 and April 2026.The operation compromised...

Three high-severity flaws in the OpenClaw AI assistant (CVSS 8.8, 8.8, 8.4) could enable credential theft, privilege escalation, and arbitrary code execution.Researcher Chinmohan Nayak...

A remote crash vulnerability dubbed XRING affects all versions of Alibaba's XQUIC library, disclosed July 8.The flaw requires only 260 bytes of legitimate QPACK...

GitHub released npm version 12 with install scripts disabled by default, making previously automatic behaviors like dependency lifecycle scripts opt-in.Granular Access Tokens (GATs) designed...

AI-powered attacks, like the Mythos model, now execute in minutes what previously took attackers days.Traditional network-based defenses lag behind because they were built for...

Microsoft patched a Defender privilege escalation flaw called RoguePlanet, tracked as CVE-2026-50656, nearly a month after public disclosure.The vulnerability, rated 7.8 on the CVSS...

Threat actor Lurking Lizard has operated a residential proxy business since August 2022, using over 230 lookalike domains.The group lures victims with trojanized installers...