Collaborate Disseminate
Mistic is used by Woodgnat, an initial access broker working with Qilin, Interlock, Rhysida, Akira, 8Base, and Black Basta.
The post New ‘Mistic’ RAT Opens Door to Several Ransomware Families appeared first on SecurityWeek.
Continue reading New ‘Mistic’ RAT Opens Door to Several Ransomware Families
The security defects allow unauthenticated users to take control of the open source software supply chain.
The post Exploitable CI/CD Vulnerabilities Expose Millions of Repositories to Hijacking appeared first on SecurityWeek.
Continue reading Exploitable CI/CD Vulnerabilities Expose Millions of Repositories to Hijacking
Over a dozen Klue customers have confirmed that hackers stole data from their Salesforce instances.
The post BeyondTrust, LastPass Impacted by Klue-Salesforce Incident appeared first on SecurityWeek.
Continue reading BeyondTrust, LastPass Impacted by Klue-Salesforce Incident
Attackers could abuse Dify’s multi-tenant cloud service to read private chats, preview other tenants’ documents, and reach internal APIs.
The post Data Exposure Flaws Threaten Dify AI Platform Used by 1 Million Apps appeared first on SecurityWeek.
Continue reading Data Exposure Flaws Threaten Dify AI Platform Used by 1 Million Apps
Attackers can send crafted media files to execute code in any application that uses FFmpeg’s libavcodec library.
The post FFmpeg PixelSmash Flaw Allows RCE on Video Players, Media Servers, NAS Appliances appeared first on SecurityWeek.
Continue reading FFmpeg PixelSmash Flaw Allows RCE on Video Players, Media Servers, NAS Appliances
Using a custom sniffer, the threat actor has captured over 110 million credentials since at least February 2026.
The post Russian Initial Access Broker Behind FortiBleed Campaign appeared first on SecurityWeek.
Continue reading Russian Initial Access Broker Behind FortiBleed Campaign
Hackers stole customers’ names, addresses, email addresses, phone numbers, and account information.
The post Canadian Electricity Provider London Hydro Discloses Data Breach appeared first on SecurityWeek.
Continue reading Canadian Electricity Provider London Hydro Discloses Data Breach
Vulnerable WordPress plugin iterations leak API keys, secrets, tokens, server information, and other data.
The post Attackers Exploit Gravity SMTP Plugin Flaw to Harvest Valuable WordPress Data appeared first on SecurityWeek.
Continue reading Attackers Exploit Gravity SMTP Plugin Flaw to Harvest Valuable WordPress Data
A malicious dependency the attackers added to over 140 Mastra packages fetches a payload targeting cryptocurrency extensions.
The post North Korean Hackers Blamed for Mastra NPM Supply Chain Attack appeared first on SecurityWeek.
Continue reading North Korean Hackers Blamed for Mastra NPM Supply Chain Attack
A database of over 86,000 confirmed working credentials was created during the credential-harvesting campaign.
The post Fortinet Responds to FortiBleed Campaign appeared first on SecurityWeek.
Continue reading Fortinet Responds to FortiBleed Campaign