Threat actors exploited Craft CMS zero-days CVE-2025-32432 and CVE-2024-58136, compromising 300 of 13,000 vulnerable servers.

I'd buttoned things up pretty nicely from a security standpoint, but even so, it would only have taken a vulnerability in an ...

Cybercriminals are targeting WooCommerce users with fake patch emails that use IDN homograph spoofing to deliver backdoor malware.

Microsoft has revealed that a threat actor it tracks as Storm-1977 has conducted password spraying attacks against cloud ...

ToyMaker deploys LAGTOY malware to steal credentials and sell access to CACTUS ransomware groups for double extortion.

Non-Human Identities, for the most part, authenticate using secrets: API keys, tokens, certificates, and other credentials ...

"In 2023, UNC3782 conducted phishing operations against TRON users and transferred more than $137 million USD worth of assets ...

Cybersecurity researchers have disclosed three security flaws in the Rack Ruby web server interface that, if successfully ...

Lotus Panda breached 6 Southeast Asian organizations using custom tools, browser stealers, and sideloaded malware.

The solution provides 99% discovery and visibility of all users, workloads, and devices across IT, IoT, OT, and IoMT ...

As many as 159 CVE identifiers have been flagged as exploited in the wild in the first quarter of 2025, up from 151 in Q4 ...

The web shells grant the threat actor the ability to execute arbitrary commands in system context, with the privileges of the ...