Collaborate Disseminate
Developers publishing crates (binaries and libraries written in Rust) on crates.io, Rust’s main public package registry, have been targeted with emails echoing the recent npm phishing campaign. The phishing email The emails started hitting developers&#… Continue reading Phishing campaign targets Rust developers
The US Cybersecurity and Infrastructure Security Agency (CISA) has affirmed its continuing support for the Common Vulnerabilities and Exposures (CVE) program. “If we want to outpace and outmaneuver our adversaries, we must first ensure that defen… Continue reading CISA looks to partners to shore up the future of the CVE Program
Over a year after SonicWall patched CVE-2024-40766, a critical flaw in its next-gen firewalls, ransomware attackers are still gaining a foothold in organizations by exploiting it. Like last September and earlier this year, the attackers are affiliates … Continue reading Akira ransomware affiliates continue breaching organizations via SonicWall firewalls
An out-of-the-box setting in Cursor, a popular AI source-code editor, could be leveraged by attackers to covertly run malicious code on users’ computers, researchers have warned. An exploitable vulnerability in the Cursor AI editor Cursor is an A… Continue reading Default Cursor setting can be exploited to run malicious code on developers’ machines
On September 2025 Patch Tuesday, Microsoft has released patches for 80+ vulnerabilities in its various software products, but the good news is that none of them are actively exploited. Among the critical and important vulnerabilities patched by Microso… Continue reading Microsoft, Adobe, SAP deliver critical fixes for September 2025 Patch Tuesday
Most organizations run an annual network penetration test, remediate the issues it uncovers, and move on. But attackers are probing networks every day, using publicly available tools to exploit common misconfigurations and overlooked vulnerabilities. A… Continue reading Automated network pentesting uncovers what traditional tests missed
Media streaming company Plex has suffered a data breach and is urging users to reset their account password and enable two-factor authentication. “An unauthorized third party accessed a limited subset of customer data from one of our databases. W… Continue reading Plex tells users to change passwords due to data breach, pushes server owners to upgrade
Malicious versions of at least 18 widely used npm packages were uploaded to the npm Registry on Monday, following the compromise of their maintainer’s account. “The packages were updated to contain a piece of code that would be executed on … Continue reading Fake npm 2FA reset email led to compromise of popular code packages
Researchers have spotted a malvertising (and clever malware delivery) campaign targeting IT workers in the European Union with fake GitHub Desktop installers. “We believe the goal of this campaign was to gain initial access to organizations for t… Continue reading Ongoing malvertising campaign targets European IT workers with fake GitHub Desktop installers
The attack that resulted in the Salesloft Drift data breach started with the compromise of the company’s GitHub account, Salesloft confirmed this weekend. Supply chain compromise On August 26, the company publicly revealed that earlier that month… Continue reading Salesloft Drift data breach: Investigation reveals how attackers got in