Unpatched Backdoor in Tenda Routers Gives Attackers Full Admin Access
There’s an undocumented backdoor in Tenda firmware, and there’s no fix for it. Tracked as CVE-2026-11405, the vulnerability lives in…
Security
Cybersecurity, vulnerabilities, threats, and defense
Fake 7-Zip Installers Are Turning PCs Into Proxy Nodes for Criminals
Download 7-Zip from the wrong site and your computer becomes a pawn in a proxy scheme. Researchers at Infoblox uncovered…
GhostApproval: Six AI Coding Assistants Vulnerable to Symlink Attack
Wiz researchers found a nasty trick that works against six popular AI coding assistants. A malicious repo can use symbolic…
Closing the Blind Spots in AI Identity Security
You can’t secure what you can’t see. That’s the problem with AI agents — they get created, do their job,…
Critical Bug in GitHub Agentic Workflows Lets Attackers Steal Private Repo Data
A nasty prompt injection vulnerability in GitHub Agentic Workflows could let unauthenticated attackers siphon data from private repositories. No credentials…
China-Linked APT Expands Backdoor Arsenal With LongLeash, DogLeash, JarLeash
A China-linked APT group has been building out its toolset, adding three new backdoors to an already active espionage campaign….
Mount Royal University Confirms Breach, Hackers Demand $1.9M Ransom
Mount Royal University in Calgary confirmed hackers broke into its network, stole data, and wiped file storage systems. The attack…
China-linked UAT-7810 expands ORB network with new LONGLEASH malware
A Chinese threat actor tracked as UAT-7810 keeps building out its relay network. The group is actively refining custom malware…
GitHub Copilot refuses harmful requests in chat — then writes them in code
Ask GitHub Copilot to do something dangerous in its chat box, and it’ll say no. Break that same request into…
Fake Paysafe and Skrill SDKs on npm and PyPI are stealing developer credentials
Someone published 17 fake packages on npm and PyPI posing as Paysafe, Skrill, and Neteller SDKs. Their real job? Stealing…