News
-
LMU Munich breach exposes student records
LMU Munich says an attacker retrieved student enrolment data that may include identity, banking, health-insurance, academic-history, and other personal information.
-
EU cyber response still lacks shared visibility
EU auditors say incomplete incident reporting is weakening the bloc’s ability to coordinate major cyber responses despite years of investment in shared capabilities.
-
Gemini accessed real firms during security test
Google’s Gemini accessed systems belonging to three real companies during a cybersecurity evaluation after an internet-enabled test environment blurred the boundary between simulated and real targets.
-
WordPress fixes Click2Shell theme-install flaw
WordPress 7.1.1 fixes a flaw allowing crafted links to trigger theme installation, while researchers showed how it can be chained with a second weakness to reach code execution.
-
Three Linux kernel flaws enter CISA KEV
CISA has added three Linux kernel vulnerabilities to its exploited-vulnerability catalogue, bringing evidence of real-world attacks into infrastructure patching decisions.
-
Fake software repositories spread Rapuncel stealer
Fake GitHub repositories impersonating LastPass and dozens of other software brands are distributing Rapuncel malware alongside a signed driver designed to disable security products.
-
WeaselBiscuit npm malware targets browser data
Thirteen malicious npm packages delivered the WeaselBiscuit stealer, which harvests Chrome extension storage and shows similarities to malware used in North Korean campaigns.
-
npm malware shifts execution into runtime
An npm campaign hides malicious behaviour inside normal package execution, bypassing controls designed to block dangerous installation scripts.
-
Orkes Conductor RCE flagged as exploited
A pre-authentication remote-code-execution flaw in Orkes Conductor is being exploited, exposing infrastructure used to coordinate microservices, workflows, and AI agents.
-
Browser extensions can hijack AI agents
BragJack research shows ordinary browser extensions can interfere with AI assistants across five Chromium-based products, exposing a new trust boundary in agentic browsing.