TrueConf Server Flaws Exploited to Replace Client Installers with PhantomCore
The threat actor known as Head Mare has been observed weaponizing security flaws in unpatched TrueConf servers once again in attacks targeting Russian companies spanning…
Category: TheHackerNews
New Passkey Attacks Can Recover Synced Private Keys or Bypass Phishing-Resistant MFA
Three separate research efforts last week demonstrated ways to defeat passkey protections without breaking the cryptography they rest on. Passkeys are designed to replace reusable…
BdThemes Supply Chain Attack Poisons JSON to Create Rogue WordPress Admins
Ravie LakshmananAug 11, 2026Supply Chain Attack / Vulnerability Cybersecurity researchers have warned of a supply chain compromise impacting WordPress plugin vendor BdThemes, prompting the content…
Gunra Ransomware Exploits Fortinet FortiOS, FortiProxy Flaws to Breach Networks
Cybersecurity and intelligence agencies from South Korea and the U.S. warned of Gunra ransomware attacks targeting critical infrastructure sectors and organizations across the world. Targets…
Malicious MCP Servers Can Split Instructions to Make AI Coding Agents Exfiltrate Secrets
Swati KhandelwalAug 11, 2026AI Security / Cyber Attack A malicious tool server connected to an AI coding assistant can quietly walk off with SSH keys,…
Researchers Turn USB Auto-Install Into a Full SYSTEM Takeover on Windows 11
Swati KhandelwalAug 11, 2026Vulnerability / Enterprise Security Windows Plug and Play can be abused to fetch signed vendor software for an emulated USB device and…
Researchers Built a Fake Crypto Startup and Hired Three Suspected North Korean IT Workers
Swati KhandelwalAug 11, 2026Insider Threat / Cyber Espionage Security researchers invented a cryptocurrency startup, advertised developer jobs, and hired three people they believe were North…
Mozilla Revokes Firefox and Thunderbird Linux Signing Key After Key Lands in Private Repo
Swati KhandelwalAug 11, 2026Cryptography / Software Supply Chain Mozilla has scrapped the cryptographic key behind Firefox and Thunderbird downloads for Linux after an unencrypted copy…
DeadLock Ransomware Uses Polygon Smart Contracts to Make Extortion Infra Harder to Disrupt
The ransomware group known as DeadLock has been observed using decentralized infrastructure to facilitate victim communications and data leak operations in a bid to improve…
Researchers Disclose AI-Assisted SharePoint Exploit Chain Reaching Unauthenticated RCE
Swati KhandelwalAug 11, 2026Vulnerability / Enterprise Security Security researchers found a way to enter Microsoft SharePoint servers as any user, including an administrator, with no…
Sandworm-Linked UAC-0145 Uses Fake Job Interviews to Push VPN That Can Run Commands
Ravie LakshmananAug 11, 2026Social Engineering / Malware The Computer Emergency Response Team of Ukraine (CERT-UA) has disclosed details of a new social engineering campaign orchestrated…
Cisco ASA and FTD Flaw Exploited in the Wild Can Trigger Remote DoS
Ravie LakshmananAug 12, 2026Network Security / Vulnerability Cisco has warned that a new vulnerability impacting Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall…