Multiple Jscrambler Packages Impacted by Supply Chain Attack
Several malicious versions of Jscrambler’s NPM package were published over the weekend as part of a supply chain attack involving compromised credentials. The popular NPM…
Category: SecurityWeek
Zimbra Patches Critical Code Execution Vulnerability
A critical-severity vulnerability in the popular collaboration solution Zimbra could lead to zero-click code execution. Previously known as Zimbra Collaboration Suite (ZCS), Zimbra is a…
RabbitMQ Vulnerability Threatens Enterprise Systems
A vulnerability in RabbitMQ could allow attackers to obtain the broker’s confidential OAuth secret, potentially posing a serious threat to enterprises, according to cybersecurity firm…
Hacker Conversations: Jesse McGraw (GhostExodus), From Blackhat Hacker to Redemption
Jesse McGraw isn’t a hacker; at least, not by his own definition. He accepts he was a hacker, and a blackhat hacker, and that he…
Cybersecurity M&A Roundup: 37 Deals Announced in June 2026
Thirty-seven cybersecurity-related merger and acquisition (M&A) deals were announced in June 2026. For a detailed view of the more than 420 acquisitions announced in 2025,…
Organizations Warned of Exploited Joomla Extension Vulnerabilities
Threat actors have been exploiting critical vulnerabilities in the Balbooa Forms and iCagenda Joomla extensions that allow unauthenticated attackers to achieve remote code execution (RCE).…
Ghost Accounts Abuse GitHub API in Mass Recon Campaign
Threat actors are abusing the GitHub API to systematically enumerate organizations, repositories, and user accounts, Datadog reports. Spanning multiple overlapping campaigns, the activity has been…
Network of 200 GitHub Repositories Used for Malware Infection
A threat actor has built a network of over 200 GitHub repositories that have been delivering Windows malware, supply chain protection provider Socket reports. Dubbed…
‘HalluSquatting’ Turns AI Hallucinations Into Botnet Delivery Mechanism
Researchers from Tel Aviv University, Technion, and Intuit have detailed a new attack technique dubbed ‘HalluSquatting’ that turns AI assistants’ tendency to hallucinate into a…
Okta Warns of Vishing Attacks Targeting Microsoft 365 Customers
Organizations across multiple sectors have been targeted in a vishing campaign aimed at harvesting Microsoft 365 credentials, Okta warns. The campaign started in April and…
China, India-Linked Hackers Both Targeted Same Pakistani Police Force
New research from SentinelOne shows that cyberespionage groups linked to both China and India spent more than two years quietly breaking into Pakistani law enforcement…
In Other News: DHS Database Hacked, Adobe Boosts Patch Cadence, Canada Disrupts Ransomware Ops
SecurityWeek’s weekly cybersecurity news roundup offers a concise overview of important developments that may not receive full standalone coverage but remain relevant to the broader…