Cybersecurity
News
MCP Python SDK OAuth flaw lets attackers steal credentials
High-severity OAuth credential theft flaw found in MCP Python SDK versions 1.9.1–1.29.1 and 2.0.0–2.1.1.Attacker-controlled MCP server can trick client into sending client secret, authorization...
News
Storm-3168: AI-Orchestrated Azure Attacks Hit Service Principals
Microsoft's Storm-3168 used AI orchestration and compromised service principals to launch a destructive ransomware attack on Azure, demanding Bitcoin payment.The attack deleted storage accounts,...
News
ShinyHunters renew Oracle PeopleSoft attacks via WAF bypass
Google warns of renewed mass exploitation of CVE-2026-35273 in Oracle PeopleSoft by ShinyHunters-linked group UNC6240Attackers bypass WAF rules using URL-encoded paths, deploying web shells...
News
Bitget hacked: $351.6M stolen by North Korea
Bitget lost $351.6 million from hot and warm wallets on September 24, 2026, in an attack attributed to North Korean hackers.The exchange confirmed cold...
News
Placeholder domain third-party.com now serves ClickFix malware
The long-trusted documentation placeholder domain "third-partycom" has been weaponized to serve a ClickFix malware lure to Windows users.Unlike "examplecom," the domain was not IANA-reserved...
News
Critical WordPress RCE bug actively exploited within hours
Threat actors are actively exploiting a critical WordPress vulnerability, CVE-2026-87902, just hours after its public disclosure.The unauthenticated remote code execution (RCE) flaw carries a...
News
MikroTik SSH flaws chained for full router takeover
A chain of two SSH vulnerabilities—CVE-2026-67279 and CVE-2026-86060—allows unauthenticated attackers to gain full administrative control over exposed MikroTik RouterOS devices.Active exploitation began before patches...
News
MemTensor npm, PyPI packages push credential-stealing malware
Compromised MemTensor packages on npm and PyPI delivered the Go-based sckit implant across Windows, Linux, and macOS.Attackers stole publish tokens from MemTensor’s GitHub Actions...
Latest news
Chainalysis Hit by Cybersecurity Incident; No Sensitive Data Breached
Blockchain analytics firm Chainalysis disclosed a Cybersecurity incident affecting its systems.The investigation found no evidence that investigation content, authentication...
CISA Adds Two Ivanti Connect Secure Vulnerabilities to KEV
CISA added two Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalog on Friday following active exploitation.The flaws...
ChatGPT Share Link Flaw Let Hackers Read Private Chats
A malicious ChatGPT share link could execute attacker code in a victim’s logged‑in session, allowing private conversations to be...
