ClickFix finds a new way to infect Macs
ClickFix campaigns are looking for alternatives now that many Mac users have been made aware of the dangers of pasting certain commands into Terminal. Researchers…
Author: Cybernoz
Marimo RCE Flaw CVE-2026-39987 Exploited Within 10 Hours of Disclosure
Ravie LakshmananApr 10, 2026Vulnerability / Threat Intelligence A critical security vulnerability in Marimo, an open-source Python notebook for data science and analysis, has been exploited within…
OpenAI ‘pauses’ Stargate UK: Sudden setback or calculated move?
OpenAI has paused plans for its Stargate UK investment, which was to take place in concert with artificial intelligence (AI) datacentre builder Nscale and in…
Digital Asset Cybersecurity Initiative Announced By Treasury
The U.S. Department of the Treasury has unveiled a new digital asset cybersecurity initiative, aimed at strengthening defenses across the rapidly growing digital asset ecosystem.…
Orthanc DICOM Vulnerabilities Lead to Crashes, RCE
Nine vulnerabilities in the open source Digital Imaging and Communications in Medicine (DICOM) server Orthanc allow attackers to crash servers, leak data, and execute arbitrary…
Bitcoin Depot hack leads to $3.6M Bitcoin theft via stolen credentials
Bitcoin Depot hack leads to $3.6M Bitcoin theft via stolen credentials Pierluigi Paganini April 10, 2026 Hackers breached Bitcoin Depot, stole credentials, and took about…
How to Avoid Aperture Collapse
I’ve been playing with this idea of Aperture Collapse. It’s a problem I have that I suspect a lot of people have as well. It’s…
Nearly 4K industrial control devices vulnerable to Iran-linked hacking campaign
A research firm tallied the internet-exposed devices Iran is targeting and recommended mitigations for any infrastructure operator using them. Source link
Commerce setting up new AI export regime to push adoption of ‘American AI’ abroad
The Department of Commerce is putting together a catalog of AI tools that will be given special export status by the federal government to be…
Old Docker authorization bypass pops up despite previous patch
No one checked oversized requests While the previous authorization bypass was triggered when request Content-Length was set to 0, no one checked at the time…
The Phishing-as-a-Service Pipeline: How a Scalable Fraud Ecosystem Is Driving Global Attacks
Phishing is no longer a standalone tactic. It has matured into a service-based ecosystem where specialized actors provide each component of an attack lifecycle, from…
Huntress and Our Culture of BElonging
Building a strong company culture is a journey without a final destination. It’s a blend of different factors—programs, decisions, collective experiences, and behaviors—all shaping who…