Exposed GitLab project email addresses let attackers push code
Private GitLab email addresses that allow developers to push issues or tasks to a project are being deliberately exposed in READMEs, contributing guides, and support…
Category: Bleeping Computer
FedRAMP VDR & VER: Daily Scans Are Only the Beginning
If you hold a FedRAMP certification, the nearest deadline on your calendar is December 7, 2026. FedRAMP’s notice responding to CISA’s BOD 26-04 puts it…
Microsoft fixes bug that broke Windows File History backup feature
Microsoft has fixed a known issue that breaks the built-in File History backup feature on some Windows systems after installing the September 2026 security updates.…
New RemControl Android banking malware targets users in Europe and Canada
A new Android malware-as-a-service (MaaS) platform called RemControl is targeting users through malvertising campaigns that impersonate the TVTap IPTV application. Although the infrastructure has been…
Placeholder domain used in dev docs now serves ClickFix attacks
The “third-party.com” domain, commonly used as a placeholder in developer documentation and code examples, is serving a fake Cloudflare verification page that attempts to trick Windows…
Hackers start exploiting critical WordPress flaw for code execution
Threat actors have moved from probing WordPress sites vulnerable to CVE-2026-87902 to exploiting the flaw to write files to disk that execute shell commands when…
How One Kubernetes YAML Can Hand Over a GCP Organization
When a developer needs to create a cloud resource — a database, a storage bucket, or a virtual machine — they need credentials to authenticate…
Ryuk ransomware member sentenced to 24 months in prison
An Armenian man was sentenced to 24 months in prison and 3 years of supervised release for hacking U.S. companies and encrypting their systems in…
Sweden fines Miljödata $183,000 over breach affecting 2.2 million
Sweden’s data privacy regulator, IMY, has imposed a $183,000 (SEK 1.8 million) fine on IT systems provider Miljödata for inadequate security measures leading to a…
Rogue external MFA providers can steal passwords during logins
Security researchers developed an attack that lets hackers with privileged access register a rogue external MFA provider that steals users’ passwords during legitimate login attempts.…
ShinyHunters claims FBI hack, data theft in PeopleSoft zero-day breach
The ShinyHunters extortion gang claims it breached FBI systems using a new Oracle PeopleSoft zero-day vulnerability, gaining access to internal services and stealing sensitive data…
Webinar tomorrow: Inside real-world Google Workspace breaches
Google Workspace breaches don’t always begin with sophisticated exploits or stolen passwords. Sometimes attackers simply convince users to grant them the access they need. Tomorrow,…