Blog

ESET says UAC-0099 breached a Ukrainian grain logistics firm before handing access to Sandworm, which used a new Yggdrasil-linked backdoor and wiped data.

Capcom says a breach exposed 11.7 million CAPCOM ID email records and changed 196 passwords, prompting phishing warnings and an ongoing investigation.

PHP2Shell attacks have surged into the millions after AWS found exploitation four days before disclosure, prompting urgent patching and log reviews.

A critical OpenCode flaw let hostile MCP servers execute code on Windows and WSL during OAuth sign-in. Update to version 1.18.33 or later.

Oracle’s October 2026 CPU fixes 1,295 security issues, including 95 critical CVEs and 590 remotely exploitable flaws across 33 product families.

Marvell, Microsoft and Oracle are developing an OCP specification for server-integrated HSMs that keep cloud encryption keys inside FIPS 140-3 Level 3 boundaries.

curl will move low- and medium-severity vulnerability reports into public GitHub issues on October 26, while keeping high-risk cases private.

PHP is preparing an emergency release for two critical flaws rated CVSS 9.2, amid leaked vulnerability details and unverified public exploit code.

A poisoned Amazon search result led users to a fake CAPTCHA that abused Windows finger.exe to deliver Lumma Stealer and remote-access malware.

Google Chrome 156 patches 353 security flaws, including six critical memory-safety bugs, as updates roll out for Windows, macOS and Linux users.