keyv npm supply chain attack on August 4, 2026 let the Shai-Hulud worm compromise 400-plus packages and more than two billion monthly downloads. The Wave Six payload hid inside AI agent config files ...

Securities regulators draw a line on sports prediction markets and the science behind the Morrisseau fraud case ...

Taking vibe-coding a step further, Naïve claims its infra can automate most of the work in setting up and running a business.

Alleged Chinese-speaking actor breached Philippine nuclear and naval targets by exploiting known flaws, stealing sensitive ...

Seven years of work on a project that let people read X posts without an account came to an end on a legal clock: X Corp. gave Nitter until 5 p.m. EST on ...

A phishing-as-a-service (PhaaS) toolkit tracked as Mirage2FA has been linked to the potential compromise of 4,532 Microsoft ...

For most defenders, a phishing alert ends with a forced password change. Mirage2FA is built to make that response useless.

The Rust incident fits a broader pattern of attacks against open-source ecosystems. North Korea-linked operators have targeted npm, PyPI, Rust, Go and PHP packages while also using fraudulent ...

Mirage2FA uses AiTM phishing to steal Microsoft 365 credentials and authenticated sessions, bypassing conventional MFA and ...

The type confusion vulnerability allows a guest-to-host sandbox escape which can lead to remote code execution ...