The TrapDoor supply-chain campaign is another warning that attackers are no longer targeting only one package ecosystem at a time. According to the report, the campaign spans npm, PyPI, and Crates.io, with more than 34 malicious packages across 384+ versions, targeting develop…
The TrapDoor supply-chain campaign is another warning that attackers are no longer targeting only one package ecosystem at a time. According to the report, the campaign …
npm’s new security controls are a welcome step toward reducing the blast radius of open-source supply-chain attacks. GitHub has introduced staged publishing for npm, whe…
The LiteSpeed User-End cPanel Plugin vulnerability is a serious reminder that hosting control panels and plugins are high-value targets because they sit close to website…
The Ghost CMS campaign is a clear reminder that a CMS vulnerability does not only put the website at risk. It can turn trusted websites int…
The Laravel Lang package hijack is another serious reminder that open-source supply-chain attacks are increasingly targeting developer trus…
The Ubiquiti UniFi OS vulnerabilities are a serious reminder that network management platforms must be treated as critical infrastructure, …
The Megalodon GitHub attack shows how quickly CI/CD pipelines can become a mass credential-theft channel. According to the report, attacker…
Cisco’s disclosure of CVE-2026-20223 in Cisco Secure Workload is a serious reminder that security management platforms are themselves criti…
CISA adding the Langflow and Trend Micro Apex One vulnerabilities to its Known Exploited Vulnerabilities catalog is a clear signal that the…
Microsoft’s warning about two actively exploited Defender zero-days is a reminder that security software is also software, and it must be p…
Google’s accidental exposure of details about an unfixed Chromium vulnerability is a serious reminder that browser security issues can beco…
The Showboat Linux malware campaign is a clear reminder that Linux infrastructure, especially in telecom environments, is a strategic targe…
CISA’s ICSA-26-141-03 advisory is another reminder that industrial control system vulnerabilities must be handled with operational urgency,…
The takedown of First VPN is an important reminder that cybercrime does not rely only on malware developers and ransomware operators. It al…