KarstoRAT is a newly observed Windows remote access trojan that gives attackers deep control over infected systems. It can capture webcam images, record audio, log…
Hackers exploited two authentication bypass vulnerabilities in the Qinglong task scheduler to run cryptominers on publicly exposed servers. The attacks targeted self-hosted Qinglong panels and…
A malicious npm campaign called PromptMink shows how attackers can use AI-assisted development workflows to slip harmful dependencies into real software projects. ReversingLabs researchers found…
A new open-source project called CVE MCP Server gives Claude access to 27 security intelligence tools across 21 data sources. The goal is simple: help…
OpenAI has published a new cybersecurity action plan that explains how AI can help trusted defenders respond faster to modern cyber threats. The plan focuses…
A WordPress plugin used for page and post redirects was found with a years-old backdoor that could inject content into websites without showing it to…
Jenkins has released security updates for seven plugin vulnerabilities that affect widely used CI/CD environments. The advisory includes three High-severity flaws involving path traversal and…
Google has patched a critical security flaw in Gemini CLI and its related GitHub Action that could let attackers execute commands on host systems. The…
The popular Python package lightning was compromised in a supply chain attack that pushed credential-stealing malware to PyPI. The malicious releases affected versions 2.6.2 and…
The FBI, CISA, the Department of Energy, the Department of State, and the Department of War have released new joint guidance to help organizations apply…
November 21, 2025
1 comment 
