Exposed Server Reveals 25,000 Compromised WordPress Websites

An exposed WP-SHELLSTORM server revealed tools, logs, cloud credentials, and thousands of webshells used in a large website ...
SecurityWeek

Network of 200 GitHub Repositories Used for Malware Infection

In Operation Muck and Load, over 200 GitHub repositories serve a Go module that leads to Windows malware infections.
9to5Mac

Swift Package Index joins Apple, pledges to remain open source

Community-run Swift package search engine and metadata index Swift Package Index is joining Apple, but says little is changing for developers in the near term. Here are the details. Most Swift ...
GameSpot

Destiny 2 Players, Time Is Running Out To Melt Bosses With This Exploit

GameSpot may receive revenue from affiliate and advertising partnerships for sharing this content and from purchases through links. It’s a story as old as time: a new Destiny 2 update arrives, and ...
TechSpot

The first unpatchable iPhone exploit in six years targets chips still running Apple's latest iOS

In context: Unpatchable, hardware-level vulnerabilities caused a stir some years ago when they repeatedly turned up in AMD and Intel processors, but they've been far rarer on Apple chips. This latest ...
AOL

Azul Addresses the Java Runtime Security Blind Spot Autonomous AI Can Now Exploit

Azul, the trusted leader in enterprise Java for today’s AI and cloud-first world, today launched a free JVM vulnerability risk assessment to address the blind spot that autonomous AI exploitation ...
ZDNet

Chainguard's new Athena coalition uses AI to fix open-source flaws - before attackers exploit them

Chainguard will use AI to protect open-source code. Athena pools open-source users, developers, and maintainers. Others are also using AI to secure open-source code. As Chainguard puts it, "The gap ...
IGN

Bank Balances Rolled Back for Forza Horizon 6 Players Who Used Exploit to Amass a Billion Credits

In response to an arcane but incredibly lucrative exploit discovered by Forza Horizon 6 players, Playground Games has confirmed that those who used the method to accumulate massive amounts of credits ...
Ars Technica

For the 2nd time in weeks, Microsoft packages laced with credential stealer

Dozens of cryptographically verified open source packages from Microsoft were compromised late last week to add advanced credential-stealing code that was triggered when developers opened them in AI ...
Dark Reading

With Complex Cloud Integrations, Small Errors Lead to Major Compromises

Low-code cloud services that allow users to create and run their own sandboxed code could be compromised by multistep exploit chains, leading to a complete platform takeover, if software-as-a-service ...
Ars Technica

Millions of AI agents imperiled by critical vulnerability in open source package

Millions of AI agents and tools around the world have been imperiled by a critical vulnerability that can allow hackers to breach the servers running them and make off with sensitive data and ...
CoinTelegraph

THORChain exploit tied to malicious node and GG20 flaw

The $10.7 million THORChain exploit was caused by a GG20 vulnerability, which allowed a malicious node to reconstruct a full private key to one of its vaults. THORChain said a malicious node operator ...