Grafana Enterprise patched a critical CVSS 10.0 SCIM vulnerability, CVE-2025-41115, that allowed attackers to impersonate privileged users through numeric external IDs. Learn how the flaw worked, which versions were affected, and what steps security teams must take to secure Grafana deployments.
Hackers breached Red Hat and GitHub in coordinated attacks and stole customer data, underscoring risks even in widely trusted development platforms.
A worm-like spam campaign flooded npm with tens of thousands of fake packages, polluting search results and straining CI/CD. Consequently, treat registries as hostile input. Enforce allowlists, verify npm provenance with Sigstore, disable lifecycle scripts by default, and promote dependencies through SLSA-aligned stages to cut risk.
A widespread campaign exploited the Chrome Web Store to distribute 131 rebranded extensions that hijack WhatsApp Web for automated bulk messaging. These add-ons pose a significant risk to organizations and users alike, demanding immediate review of extension governance and messaging platform protections.
North Korea has transformed cryptocurrency theft into a state-backed, industrial cyber operation. With coordinated threat groups, refined malware pipelines, and aggressive targeting of exchanges and DeFi platforms, DPRK attackers continue scaling their global theft strategy despite expanding sanctions and international pressure.
AI-targeted cloaking feeds AI agents a different web than humans see. Learn the risks, detection tactics, and governance steps to keep answers trustworthy.
Security researchers revealed that ChatGPT’s Atlas Browser can be manipulated through hidden prompt injections, allowing attackers to hijack AI behavior, leak data, and bypass safeguards. Learn how it works and how to defend against it.
GootLoader reappeared with custom WOFF2 web-fonts that swap glyph shapes, so a gibberish string in source renders as a harmless-looking filename in the browser. Consequently, victims on SEO-poisoned WordPress sites download ZIP archives carrying JavaScript loaders that trigger rapid, hands-on compromises. Therefore, block risky downloads, hunt for loader execution, and harden WordPress and endpoints to cut dwell time and prevent domain-wide impact within hours.
Belgian chains such as Brico and Carrefour are increasingly playing AI-generated, royalty-free music in their stores to cut licensing costs. This shift could slash 25–28 % of public performance income for local artists, warn rights organizations. Here’s how the technology works, the risks it raises, and what defenses stakeholders must consider.
A newly discovered Android banking trojan combines overlay attacks with a stealthy hidden VNC server to gain full remote control over compromised devices.