A 300-Character Password Can Unlock Alpine Linux Servers Thanks to an OpenSSH Quirk
A newly patched OpenSSH flaw lets attackers bypass password checks on Alpine Linux systems running musl without PAM, turning an oversized password into an accidental skeleton key for...
A Hacker’s Exposed Server Reveals How AI Chatbots Were Weaponized to Breach Korean Banks
An open directory left behind on a hacking campaign's own Hong Kong jump server exposed the AI tooling — including a hijacked Claude Code setup rerouted to DeepSeek...
A Ransomware Gang’s Sloppy Encryption Code Is Accidentally Saving Victims’ Data
Check Point researchers found that the latest build of HYFLOCK ransomware only encrypts the first 4KB of larger files, letting victims recover partial content from Office documents despite...
Backdoor Smuggled Through a Chinese Keyboard App’s Update Check Hits Six Countries
A China-aligned group dubbed SlippyNunchucks hijacked unencrypted update traffic from the popular Sogou Input Method keyboard app to plant a modular backdoor called DarkVigil on victims across Hong...
Critical Rails Flaw Lets a Single Malicious Image Upload Expose Server Secrets
A critical, CVSS 9.8 flaw in Ruby on Rails' Active Storage lets an unauthenticated user trigger file writes, and in some configurations file reads, simply by uploading a...
Maximum-Severity Flaw in SolarWinds Dameware Puts Remote Support Sessions at Risk
SolarWinds has patched a near-maximum-severity command injection flaw in its Dameware remote support software, tracked as CVE-2026-28336 with a CVSS score of 9.9. An authenticated attacker could use...
Gorbag Hackers Weaponize a WinRAR Bug to Spy on Ukrainian Government Networks
A Russia-aligned group tracked as Gorbag is abusing a WinRAR path-traversal flaw to plant credential-stealing malware inside Ukrainian government, justice, and defense-adjacent networks. Researchers say the group favors...
DreamHost Confirms Breach After Attackers Exploited a File Manager Flaw
Hosting provider DreamHost has confirmed that attackers broke into its browser-based File Manager tool and made off with FTP/SFTP logins and some webmail credentials, with a handful of...