NPM ecosystem
Attacks targeting developer ecosystems are increasing in frequency and sophistication, with Node.js developers firmly in this week’s crosshairs, as multiple npm packages belonging to the open-source AsyncAPI and Jscrambl
Law Firm Data Breaches (11942 indexed)
A threat actor has published hundreds of fake GitHub repositories impersonating
A threat actor has published hundreds of fake GitHub repositories impersonating legitimate software and security projects to distribute infostealer malware. [...]
The defendant's lawyer
The defendant's lawyer told Finnish media that he does not know where his client is but believes Kivimäki is outside Finland.
Supermarket giant Lidl has
Supermarket giant Lidl has revealed details of a supplier breach impacting customer data
Attackers whose methods line up with the data-extortion
Attackers whose methods line up with the data-extortion group ShinyHunters have spent the past year walking into corporate Salesforce environments without exploiting a single flaw in the platform. The way in h
I was really unpleasantly surprised when they let him out while on appeal, and now they
I was really unpleasantly surprised when they let him out while on appeal, and now they may not be able to return him to prison? Did no one foresee that he might not stick around to be sent back to prison? Daryna Antoni
Microsoft Active Directory Federation Services Insufficient Granularity of Access
Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability — Microsoft Active Directory Federation Services contains an insufficient granularity of access control vulnerabili
Eduard Kovacs
Eduard Kovacs reports: A new ransomware group named D1R in recent days listed Synopsys and Bosch on its Tor-based leak website. The cybercriminals claimed to have exploited a vulnerability in Synopsys’ website to access
Abror Shuhratov
Abror Shuhratov reports: xAI, the company founded by Elon Musk, has announced emergency measures following a serious controversy involving the unauthorized uploading of users’ private code and confidential informat
The D1R cybercrime group claimed to have stolen valuable data from Synopsys and Bosch,
The D1R cybercrime group claimed to have stolen valuable data from Synopsys and Bosch, threatening to leak it unless a ransom is paid. The post Synopsys Finds No Evidence of Data Breach Amid Bosch Hack Claims appeared f
SonicWall SMA1000 Appliances
SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability — SonicWall SMA1000 Appliances contain a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to potentially
Microsoft SharePoint Server
Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability — Microsoft SharePoint contains a missing authentication for critical function vulnerability that allows an unauthorized attacker to
SonicWall SMA1000 Appliances
SonicWall SMA1000 Appliances Code Injection Vulnerability — SonicWall SMA1000 Appliances contain a code injection vulnerability which in specific conditions could potentially enable a remote authenticated attacker as adm
The WorldLeaks extortion group claimed to have stolen 720 GB of data from the healthcare
The WorldLeaks extortion group claimed to have stolen 720 GB of data from the healthcare testing and laboratory services provider. The post Centers Laboratory Data Breach Affects 540,000 Individuals appeared first on Sec
A statement on ZEGO Textilveredelungszentrum GmbH’s website explains why they are
A statement on ZEGO Textilveredelungszentrum GmbH’s website explains why they are filing for insolvency: Insolvency proceedings have been initiated – and why we are still looking ahead Ladies and gentlemen, dear b
Japan's largest taxi operator, Nihon Kotsu, announced that its systems were compromised
Japan's largest taxi operator, Nihon Kotsu, announced that its systems were compromised in a cyberattack, forcing the company to shut down part of its infrastructure. [...]
The retailer said the incident did not affect its online shopping platform itself but
The retailer said the incident did not affect its online shopping platform itself but involved a separately stored customer database maintained by a third-party provider. According to notifications sent to Lidl's German,
Fatima Abdullahi
Fatima Abdullahi reports: The Federal High Court in Abuja has fixed July 21, 2026, for the arraignment of Zenith Bank Plc and three other defendants over allegations of illegally accessing and disclosing the confidential
The Cybersecurity and Infrastructure Security Agency (CISA) has issued a postmortem on a
The Cybersecurity and Infrastructure Security Agency (CISA) has issued a postmortem on a data leak in which a contractor published dozens of internal CISA credentials -- including AWS Govcloud keys -- in a public GitHub
Cisco IOS
Cisco IOS Cross-Site Request Forgery Vulnerability — Cisco IOS 12.4 contains multiple cross-site forgery vulnerabilities that allows remote attackers to execute arbitrary commands via (1) a certain "show privilege" comma
Misconfigured server
Misconfigured server exposed three phishing operators running Evilginx forks to bypass MFA
The Jscrambler client-side web security company disclosed that a threat actor published
The Jscrambler client-side web security company disclosed that a threat actor published a malicious version of its npm package that has been downloaded almost 1,500 times. [...]
Daryna Antoniuk
Daryna Antoniuk reports: Dutch police said Thursday they had uncovered evidence suggesting that Dutch criminals were involved in the cyberattack on telecom provider Odido that exposed the personal data of more than 6 mil
PORTLAND, Ore.— An Armenian national extradited from Ukraine to the United States
PORTLAND, Ore.— An Armenian national extradited from Ukraine to the United States pleaded guilty yesterday for his role in Ryuk ransomware attacks and an extortion conspiracy targeting companies throughout the United Sta