Security
Stay informed with the latest developments in cybersecurity through our Security category. Discover in-depth news, analysis, and updates on emerging cyber threats, malware incidents, and major data breaches. Whether you’re a cybersecurity professional or just keen on protecting your digital footprint, find insights and trends that are shaping the future of online security here.
Hugging Face malware campaign returns to hijack GPUs for crypto mining
A cryptomining and backdoor campaign that abuses Hugging Face model repositories came back within days of being taken down. Its most popular malicious model was downloaded more than 28,000 times. Separately, researchers flagged a fake Solana starter kit on GitHub, live since late 2025, that is positioned to trick AI coding agents into installing a […]
Japan Airlines suffers third-party data breach exposing passenger info
Japan Airlines (JAL) has announced that a data breach at Amadeus’s Passenger Service System exposed the data of about 92,000 customers. JAL Group, which operates the airlines JAL and Japan Transocean Air, uses the system to handle passenger reservations, ticketing, and check-in. According to its announcement, Amadeus notified the airline on October 23, 2026, that […]
Polymarket halts trading after crypto-draining script breach, $2.5M traced
Prediction market platform Polymarket temporarily suspended trading on Thursday after hackers compromised a third-party service to distribute cryptocurrency-draining JavaScript, with approximately $2.5 million in assets traced to a suspected attacker wallet. The company confirmed the security incident, saying it had identified and fixed the issue affecting its international platform, Polymarket.com, and referred the breach to […]
Fake crypto app on Apple App Store linked to $23K wallet theft
A fake cryptocurrency trading app called Padre Terminal, previously available on the Apple App Store for iOS devices, has been linked to the theft of approximately $23,000 from 27 Solana wallets. Blockchain investigator Iris confirmed that one victim was compromised through the malicious App Store app, but has not determined how the other affected wallets […]
Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware
A newly identified advanced persistent threat (APT) group tracked as UAT-11473 was observed exploiting CVE-2026-20127, an authentication-bypass flaw in Cisco Catalyst SD-WAN Controllers, to deploy a custom malware framework called KeyDrift. CVE-2026-20127 is a max-severity flaw that Cisco patched in February 2026, which allows remote attackers to gain privileged access to Catalyst SD-WAN Controller and […]
Chrome extensions with 13.4 million installs caught hijacking searches
A massive search-hijacking campaign involving 319 Chrome extensions with a combined 13.4 million reported installations redirected users’ searches through tracking servers to generate advertising revenue from Bing and Yahoo. A new report by Socket’s John Tuckner expands on the researcher’s April 2025 discovery of 57 Chrome extensions with 6 million users, adding 264 newly identified […]
CISA warns of Fragnesia Linux flaw chained in PHP2Shell attacks
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned federal agencies to patch a high-severity Linux kernel privilege escalation bug that attackers are chaining with the PHP2Shell flaws in the wild. Tracked as CVE-2026-46300 and known as Fragnesia, this vulnerability stems from a logic bug in the Linux XFRM ESP-in-TCP subsystem that lets attackers run malicious code with […]
New Cisco firewall zero-day exploited to crash SSL VPN devices
Cisco released security updates to patch a denial-of-service zero-day in Adaptive Security Appliance (ASA) and Threat Defense (FTD) software that attackers are exploiting to remotely crash vulnerable firewall devices. Tracked as CVE-2026-76418, this high-severity vulnerability affects devices running ASA and FTD software with configurations containing the ‘webvpn’ keyword and SSL VPN enabled on at least […]
Police seize Virtualine bulletproof service tied to ransowmare, cybercrime
U.S. law enforcement has seized the primary domain of Virtualine, a bulletproof hosting service advertised on cybercrime forums for facilitating illegal activities. The service also operated under the names Secury, Massgod, Spamhouse, Lanedo, and Omegatech, and promised to shield customers from legal complaints and requests from law enforcement and other authorities. The U.S. Department of […]
Discord to let search engines index public server messages
Discord will allow search engines to index discussions in Discoverable Servers and make them accessible on the web to users outside the platform without an account or invitation. The goal is to surface useful information to the wider internet community instead of keeping it buried in Discord conversations. “Discussions in Discoverable Servers will soon be […]