Fake 7-Zip Installers Are Turning PCs Into Proxy Nodes for Criminals
Download 7-Zip from the wrong site and your computer becomes a pawn in a proxy scheme. Researchers at Infoblox uncovered…
Security
Cybersecurity, vulnerabilities, threats, and defense
GhostApproval: Six AI Coding Assistants Vulnerable to Symlink Attack
Wiz researchers found a nasty trick that works against six popular AI coding assistants. A malicious repo can use symbolic…
Closing the Blind Spots in AI Identity Security
You can’t secure what you can’t see. That’s the problem with AI agents — they get created, do their job,…
Critical Bug in GitHub Agentic Workflows Lets Attackers Steal Private Repo Data
A nasty prompt injection vulnerability in GitHub Agentic Workflows could let unauthenticated attackers siphon data from private repositories. No credentials…
China-Linked APT Expands Backdoor Arsenal With LongLeash, DogLeash, JarLeash
A China-linked APT group has been building out its toolset, adding three new backdoors to an already active espionage campaign….
Mount Royal University Confirms Breach, Hackers Demand $1.9M Ransom
Mount Royal University in Calgary confirmed hackers broke into its network, stole data, and wiped file storage systems. The attack…
Cash App owner Block to pay $45 million after states say it made false security promises
Block Inc., the company behind Cash App and Square, agreed to pay $45 million to settle allegations from regulators in…
China-linked UAT-7810 expands ORB network with new LONGLEASH malware
A Chinese threat actor tracked as UAT-7810 keeps building out its relay network. The group is actively refining custom malware…
GitHub Copilot refuses harmful requests in chat — then writes them in code
Ask GitHub Copilot to do something dangerous in its chat box, and it’ll say no. Break that same request into…
Fake Paysafe and Skrill SDKs on npm and PyPI are stealing developer credentials
Someone published 17 fake packages on npm and PyPI posing as Paysafe, Skrill, and Neteller SDKs. Their real job? Stealing…