Sead Fadilpašić

A state-sponsored attacker is leveraging two zero-days to establish persistence.

Flaw could also expose SMS 2FA codes, so you might want to move to a software-based authenticator.

Chinese state-sponsored actors are at it again targeting legal, SaaS, and government agencies.

Last year's fix wasn't good enough, Binarly says, as it finds new ways to exploit an old flaw.

A patch is already available, as well as a temporary mitigation, so update now.

A major phishing campaign is still ongoing, targeting both Python maintainers and users.

AI agents are the future of the internet and they don't care about design or layout, Hostinger says.

Boyd Gaming reports attack to the SEC, but offered little detail around the incident.

A fix was released for multiple versions of the Libraseva tool.

ClaimPix kept an open database full of sensitive information.

A timely patching could have prevented the attack, while proper monitoring could have mitigated the threat.

Github is looking to harden package publication with mandatory 2FA for local publishing, and more.

A threat actor claims to have stolen huge cache of medical records and other sensitive files.

Criminals are creating fake apps to infiltrate SMB infrastructure and deploy malware.

AIL is yet to confirm the allegations, but independent researchers claim the archive is legitimate.

Contact data was stolen but payment and banking information was not.

A third-party service provider has been snooping around where they weren't allowed to.

SentinelOne uncovers MalTerminal, a new piece of malware which uses GTP-4 to generate malicious code

Someone is spoofing the FBI's IC3 website in an attempt to steal PII, it warns.

Two Ivanti flaws are being abused in the wild to obtain remote code execution capabilities.