Category: CYBER SECURITY

GitHub says hackers who accessed about 3,800 internal repositories got in through a malicious version of the Nx Console Visual Studio Code extension, which was compromised during last week’s TanStack npm supply-chain attack.

Microsoft has shared temporary mitigation steps for YellowKey, a newly disclosed Windows BitLocker zero-day vulnerability that could allow attackers to access protected drives.

GitHub has confirmed that around 3,800 of its internal repositories were accessed after one of its employees installed a malicious Visual Studio Code extension.

GitHub is investigating a security breach involving its internal repositories after a hacker group known as TeamPCP claimed it had accessed around 4,000 private repositories containing internal code.

The FBI says Americans lost more than $388 million in 2025 to scams involving cryptocurrency kiosks, also known as crypto ATMs or Bitcoin ATMs.

The Tycoon2FA phishing kit has added support for device-code phishing attacks and is now abusing Trustifi click-tracking URLs to steal access to Microsoft 365 accounts.

Two security vulnerabilities in the Avada Builder plugin for WordPress could allow hackers to read sensitive files from websites and extract private information from their databases.

A critical security flaw in the Funnel Builder plugin for WordPress is being actively exploited by hackers to inject malicious JavaScript into WooCommerce checkout pages and steal customer payment details.

A hotel check-in system used by several hotels in Japan left more than 1 million customer passports, driver’s licenses, and selfie verification photos exposed on the open web after a major security lapse.

Hackers are actively exploiting a critical security flaw in the WordPress plugin Burst Statistics that can allow them to gain admin-level access to vulnerable websites.

The alleged main administrator of Dream Market, once one of the largest dark web marketplaces before it was shut down, has been indicted in the United States on money laundering charges.

Foxconn, the electronics manufacturing giant that produces devices and components for major tech companies, including Apple, Google, Nvidia, Sony, and others, has confirmed that it was recently hit by a cyberattack that may have affected some of its factories.

More than 1,000 fake IPL-related domains are being used to run online scams and malware attacks against cricket fans during the ongoing Indian Premier League season, according to a new report.

The UK Information Commissioner’s Office has fined South Staffordshire Water Plc and its parent company South Staffordshire Plc £963,900, or about $1.3 million, after a cyberattack exposed the personal data of 663,887 customers and employees.

Instructure, the education technology company behind the popular Canvas learning management system, has reached an “agreement” with the ShinyHunters extortion group to stop stolen data from a recent breach from being leaked online.

What separates defense contractors who pass their CMMC assessment on the first attempt from those who struggle is rarely the sophistication of their technology.

Google says it has discovered and stopped what it believes is the first zero-day exploit developed with the help of AI.

Attackers are abusing Google Ads and legitimate Claude.ai shared chats in a new malvertising campaign that targets Mac users looking for Claude downloads.

German authorities have shut down a relaunched version of the criminal marketplace Crimenetwork and arrested the man suspected of running it.