New Shai-Hulud–like npm Worm Attack 19+ Packages to Steal dev/CI Secrets
Shai-Hulud–like npm Worm Attack A new supply chain worm is actively targeting the npm ecosystem, with a research team identifying at least 19 malicious npm…
Category: CyberSecurityNews
Anthropic Launches Claude Code Security to Scan Codebases for Security Vulnerabilities
Claude Code Security A new feature inside Claude Code enables developers and security teams to identify and remediate vulnerabilities across their codebases, known as Claude…
Silicon Valley Engineers Charged With Stealing Trade Secrets From Google and Other Tech Companies
Silicon Valley Engineers Charged Stealing Trade Secrets From Google Three Silicon Valley engineers have been indicted for allegedly stealing confidential technology data from Google and…
LLM-Generated Passwords Expose Major Security Flaws with Predictability, Repetition, and Weakness
Large language models, commonly known as LLMs, are increasingly being asked to generate passwords — and new research has shown that the passwords they produce…
Critical Vulnerabilities in VS Code Extensions Threaten 128 Million Developer Environments
128 Million Users at Risk VS Code Extensions Flaws Three critical vulnerabilities have been found in four popular Visual Studio Code extensions. These extensions have…
PayPal Data Breach Exposes SSNs and Business PII of Customers for Over Six Months
PayPal Data Breach PayPal has issued a formal data breach notification disclosing that a coding error in its PayPal Working Capital (PPWC) loan application exposed…
Grandstream VoIP Phones Vulnerability Allows Attackers to Gain Root Privileges
VoIP desk phones are trusted devices, but many are managed like office furniture. A newly disclosed flaw in Grandstream phones shows how a simple network-facing…
CharlieKirk Grabber Stealer Attacking Windows Systems to Exfiltrate Login Credentials
A new Python-based infostealer called CharlieKirk Grabber has been identified targeting Windows systems, with a focused goal of stealing stored login credentials, browser cookies, and…
Critical Jenkins Vulnerability Exposes Build Environments to XSS Attacks
Jenkins Vulnerability Exposes XSS Attacks Security Advisory has revealed multiple vulnerabilities in Jenkins Core, including a stored Cross-Site Scripting (XSS) flaw that could expose build environments to…
Apache Tomcat Vulnerabilities Let Attackers Bypass Security Constraints via HTTP/0.9 Requests
Apache Tomcat Vulnerabilities Apache Tomcat has disclosed CVE-2026-24733, a Low-severity security constraint bypass that can be triggered via HTTP/0.9 requests when certain access-control rules are…
PoC Released for Critical Chrome 0-day Vulnerability Exploited in the Wild
Chrome 0-day Vulnerability PoC A public proof-of-concept exploit has been released for CVE-2026-2441, a critical use-after-free zero-day vulnerability in Google Chrome’s Blink CSS engine that…
Ploutus Malware Drains U.S. ATMs Without a Card or Account — FBI Issues Emergency FLASH Alert
A 19 February 2026 FBI FLASH (FLASH-20260219-001) warns banks and ATM operators about a rise in malware-enabled “jackpotting,” where criminals exploit physical access and software…