Fake CVE exploit repos pull frint and skytext packages to steal researcher credentials, with servers still live as of July 1.

Prompt injection is the technique of smuggling instructions to an AI agent through content the agent reads — a document, a calendar invite, a web page, a code comment — so that hostile text carries ...

DIO Chacon are devices mainly distributed in the European market. Chacon provide various device to control switches, shutters, camera, lights, etc. The website ...

The hackers compromised GitHub Action tags, then shifted to NPM, Docker Hub, VS Code, and PyPI, and teamed with Lapsus$. The TeamPCP hacking group has expanded its open source software campaign from ...

Infostealer threats are rapidly expanding beyond traditional Windows-focused campaigns, increasingly targeting macOS environments, leveraging cross-platform languages such as Python, and abusing ...

Six months ago, I spent two weeks building a “smart” customer support agent. It could answer questions, look up order status, and even process refunds. I was proud of it. The integration code was a ...

Cybersecurity researchers have flagged a supply chain attack targeting over a dozen packages associated with GlueStack to deliver malware. The malware, introduced via ...

Copilot in Excel introduces new finance-focused capabilities that help teams work to their standards, use trusted financial data, and stay in control of every change. GPT‑5.5 Instant is now available ...

PrivatePing is hosted on Heroku. It is accessible through a web browser. Users can register, log in securely, and exchange encrypted messages with each other without the need to install or run the ...

MoustachedBouncer is a cyberespionage group discovered by ESET Research and first publicly disclosed in this blogpost. The group has been active since at least 2014 and only targets foreign embassies ...