Security News
Breach & incident coverage
Distinct breaches, incidents, and newly disclosed issues as they're reported — separate from the CVE-anchored advisories, which track confirmed exploited vulnerabilities specifically.
616 stories published
Malicious Solidity Pro VS Code Extensions Steal Crypto Wallets and API Keys
Malicious VS Code extensions targeting Web3 developers deliver info stealers, bypass market controls, and harvest crypto wallets and credentials.
Aug 10, 2026Critical Vulnerabilities Exposed in Belgian eID Software Used by Millions
Severe flaws in Nitro's Connective eID software allowed remote signature forgery, identity theft, and code execution across Belgian banks and agencies.
Aug 10, 2026Head Mare Hackers Trojanize TrueConf Server Installers to Deploy Backdoors
Unpatched TrueConf video conferencing servers are being exploited by Head Mare to distribute trojanized client updates carrying PhantomCore malware.
Aug 8, 2026Head Mare Trojanizes TrueConf Server Installers to Deploy Backdoors
Hacktivists exploit unpatched TrueConf video conferencing servers to swap client installers with backdoor malware and compromise enterprise networks.
Aug 8, 2026Critical One-Click RovoBlast Vulnerability Exposed Atlassian Rovo Enterprise Data
Varonis disclosed RovoBlast, a critical parameter-to-prompt injection flaw in Atlassian Rovo AI that enabled automated enterprise data exfiltration.
Aug 8, 2026Webmail CSS Attacks Allow Password Theft, UI Hijacking, and AI Exploitation
PortSwigger research shows how HTML and CSS in webmail can escape message containers to steal credentials, hijack UI actions, and manipulate AI agents.
Aug 8, 2026Atlassian Rovo Vulnerabilities Allow Indirect Prompt Injection and Data Theft
Two flaw paths in Atlassian Rovo let attackers trick the AI assistant into exfiltrating sensitive Jira and Confluence data to external servers.
Aug 8, 2026N-able Issues Emergency N-central Hotfix 2 Amid Active Tunneling Attacks
N-able released Hotfix 2 for N-central vulnerability CVE-2026-18577 as attackers breach managed endpoints and install persistent Cloudflare Tunnels.
Aug 8, 2026Metabase Zero-Day Exploited in Wild Grants Unauthenticated Admin Access
Metabase has patched a CVSS 10.0 zero-day SQL injection flaw impacting version 1.58+ that allows unauthenticated remote administrative access.
Aug 8, 2026Water Utilities Partner with DEF CON Franklin to Launch Water Watch Center
The National Rural Water Association and DEF CON Franklin launched the Water Watch Center to provide free MDR and threat intelligence to rural utilities.
Aug 7, 2026Metabase SQL Injection Zero-Day Exploited in Customer Data Theft Attacks
A critical unauthenticated Metabase SQL injection zero-day with a 10.0 CVSS score was exploited to steal customer data from Framework, Tally, and LexisNexis.
Aug 7, 2026Nearly 800 Malicious npm Packages Deliver Cross-Platform RATs and Infostealers
A massive npm supply chain campaign uses AI-generated typosquatting packages to deploy cross-platform malware and Sliver C2 across dev environments.
Aug 7, 2026No news matches your search.