OpenCode hack exposes API keys amid AI distillation attacks
The open-source AI coding project OpenCode has notified some users that stored API keys they used with external providers were exposed in a security breach.…
Year: 2026
Critical Drupal RCE Vulnerability Could Let Attackers Take Over Websites Without Authentication
Drupal has released security updates for a critical remote code execution vulnerability that could let attackers take over affected websites without logging in. Tracked as…
A New OT Security Playbook for Connected Robots
A recently disclosed vulnerability affecting Universal Robots’ collaborative robot platform should be a wake-up call for all industrial security leaders. In May, the Danish robotics…
WhatsApp Help Pages Leaked Hidden Instructions for a Meta Chatbot
Dozens of WhatsApp web pages designed to answer people’s questions about Meta’s encrypted messaging app inadvertently exposed the company’s own instructions to its chatbot. These…
Researchers Hack Snowflake PostgreSQL Database to Gain Full Server-Level Code Execution
A security test of Snowflake-managed PostgreSQL has shown how a database role with limited privileges could be turned into control of the server running the…
US Ransomware Negotiator Suspected of Helping ShinyHunters Extort Victims
The unnamed US executive is separate from Canadian ransomware negotiator Edward Dubrovsky, who was arrested on federal extortion charges. US federal investigators suspect executives at…
Cybersecurity Underpins Saudi Arabia’s Digital Future
19 Oct Cybersecurity Underpins Saudi Arabia’s Digital Future Posted at 08:57h in Blogs by Taylor Fox This week in cybersecurity from the editors at Cybercrime…
ConnectWise suspends Cloud Backup service after attackers abuse its Microsoft 365 access
American software company ConnectWise is contending with a security incident that has allowed unknown attackers to use its application identities to break into organizations’ Microsoft…
AOMEI Backupper update servers hijacked to push malware: Check your PC
The Google Threat Intelligence Group (GTIG) reports that attackers compromised AOMEI Technology’s update and notification infrastructure in a campaign investigated between April and July. AOMEI…
GhostAction Attackers Plant Credential Stealer Disguised as Font in 94 GitHub Repositories
The threat actor behind the GhostAction supply chain attack has expanded beyond injecting malicious GitHub Actions workflows into compromised projects to phish open-source developers and…
Sustainability efforts could reverse public datacentre backlash
The summer of 2026 will be remembered for datacentres becoming a mainstream issue. Unfortunately, for all the wrong reasons. A topic long-confined to IT and…
Drupal Warns of Fast Exploitation Risk for Critical Core RCE Flaw
Drupal has rolled out patches for five vulnerabilities, including two critical-severity bugs that could be exploited for remote code execution (RCE). The first resides in…