Attackers Hijack .gh, .sl, and .as Registries to Obtain Certificates for Google Domains
Attackers compromised three country-code top-level domains (ccTLDs) and obtained unauthorized HTTPS certificates for several Google domains, Google said on October 6.
Eight Malicious npm Packages Downloaded 40,767 Times Deliver Overlord RAT and Stealer
Ravie LakshmananOct 07, 2026Supply Chain / Malware Cybersecurity researchers have disclosed details of a long-running npm supply chain malware campaign
Discord Users Data Exposed in Security Bot Double Counter Security Breach
Double Counter, a Discord security bot, has disclosed a breach that exposed user data after an attacker broke into its
Microsoft Outlook to block MSIX attachments starting November
Microsoft announced that it will add .msix and .msixbundle attachments to the list of blocked attachments in Outlook Web and
SonicWall warns of max severity SSRF flaw in SMA1000 gateways
SonicWall has released hotfixes to address a maximum-severity server-side request forgery (SSRF) flaw in SMA1000 series appliances. Tracked as CVE-2026-102255,
Anthropic Mythos AI Finds Rejetto HFS Flaw That Lets Attackers Forge Admin Sessions and Execute Code
Anthropic’s Mythos AI has identified a critical vulnerability in Rejetto HTTP File Server that could allow remote attackers to forge
Anthropic Expands Claude Access for Vetted Cyber Teams as Glasswing Finds 129,000 Flaws
Ravie LakshmananOct 07, 2026Artificial Intelligence / Vulnerability Anthropic on Tuesday said it’s expanding a program that allows vetted cybersecurity professionals
Anthropic Opens Claude Access to Red Teams and Verified Cyber Defenders With Reduced Restrictions
Anthropic has expanded its Cyber Verification Program, giving verified security professionals access to advanced Claude models with fewer cybersecurity restrictions.
Ninja Forms plugin flaw exploited to hack WordPress sites
Hackers are exploiting stored cross-site scripting (XSS) vulnerabilities in two unrelated WordPress plugins, Ninja Forms and WPC Product Bundles for
Hackers exploit 32 zero-days on first day of Pwn2Own Ireland
On the first day of the Pwn2Own Ireland 2026 competition, security researchers hacked the Samsung Galaxy S26 twice and earned
Fake ChatGPT, Gemini, and Claude Ad Portals Capture Credentials and MFA Codes
Cybersecurity researchers have disclosed details of a “human-operated phishing platform” that impersonates advertising products for artificial intelligence (AI) chatbots like
Critical Apache Struts Vulnerabilities Enables Remote Code Execution Attacks
Four security flaws described in the supplied Apache Struts advisories could expose affected applications to remote code execution, denial-of- service,