Blog

A trojanized Claude Code extension exposed up to 5,000 Cursor users to an SSH backdoor as researchers also disclosed a separate browser flaw.

WordPress 7.1.4 fixes an unauthenticated upgrade-process RCE after Wordfence blocked 62,969 attack attempts in 24 hours against exposed sites.

PHP2Shell attackers rooted exposed Palo Alto firewalls, while WordPress sites saw scanning but no confirmed compromises, researchers report.

Binance says attackers stole about $6.3 billion across ten blockchains, prompting a freeze of withdrawals and a probe into a compromised DevOps laptop.

Northstar Security has emerged from stealth with $7 million to map connected cyber risks and help security teams investigate and remediate them.

A Joplin OneNote importer flaw let crafted .one files overwrite files on disk. Users should update to version 3.5.7 before extracting attachments.

Google and Mozilla have released browser updates fixing 219 security flaws, including four critical Chrome bugs and 108 high-risk Firefox issues.

China-linked operators chained critical PHP2Shell flaws with a Linux exploit to root firewalls, plant webshells and breach a US government-affiliated network.

Three GoAhead TLS flaws can accept revoked certificates, bypass chain limits or expose sessions; version 6.1.1 fixes the bugs.

Skyw4lker phishing kit targets U.S. Microsoft 365 users with device-code lures, abusing legitimate authentication to steal access tokens without passwords.