Over 400 malicious versions of 170 packages were published as part of the new Mini Shai-Hulud campaign.

The post TanStack, Mistral AI, UiPath Hit in Fresh Supply Chain Attack appeared first on SecurityWeek.

The zero-day was designed to bypass 2FA and it was developed by a prominent cybercrime group.

The post Google Detects First AI-Generated Zero-Day Exploit appeared first on SecurityWeek.

The company topped revenue and earnings forecasts for the first quarter of 2026, but its shares plunged more than 20%.

The post Cloudflare Lays Off 1,100 Employees in AI-Driven Restructuring appeared first on SecurityWeek.

The incident occurred on April 20 and did not affect customer data in the company’s production and staging environments.

The post SailPoint Discloses GitHub Repository Hack appeared first on SecurityWeek.

Also called Copy Fail 2 and tracked as CVE-2026-43284 and CVE-2026-43500, the exploit was disclosed before a patch was released.

The post New ‘Dirty Frag’ Linux Vulnerability Possibly Exploited in Attacks appeared first on SecurityWeek.

Lax extension permissions and improper trust implementation allow attackers to inject prompts in the Claude Chrome extension.

The post Vulnerability in Claude Extension for Chrome Exposes AI Agent to Takeover appeared first on SecurityWeek.

CVE-2026-6973 is a high-severity vulnerability that allows an attacker who has admin privileges to execute arbitrary code.

The post Ivanti Patches EPMM Zero-Day Exploited in Targeted Attacks appeared first on SecurityWeek.

The cybersecurity firm has not explicitly accused China of being behind the attack, but the evidence suggests it was. 

The post Palo Alto Zero-Day Exploited in Campaign Bearing Hallmarks of Chinese State Hacking appeared first on SecurityWeek.

“TrustFall” attack shows how AI coding agents can be manipulated into launching stealthy supply chain compromises.

The post AI Coding Agents Could Fuel Next Supply Chain Crisis appeared first on SecurityWeek.

Agency issued guidance and calls on operators to build resilient OT environments capable of surviving extended isolation and cyber compromise.

The post CISA Launches ‘CI Fortify’ to Prepare Critical Infrastructure for Geopolitical Cyber Conflict appeared first on SecurityWeek.

CVE-2026-0300 affects the Captive Portal service of PAN-OS software on PA and VM series firewalls.

The post Palo Alto Networks to Patch Zero-Day Exploited to Hack Firewalls appeared first on SecurityWeek.

AI red team specialist details his methods for manipulating AI guardrails through jailbreaking and data poisoning, helping developers harden machine learning models.

The post Hacker Conversations: Joey Melo on Hacking AI appeared first on SecurityWeek.

Dubbed Bleeding Llama, the heap out-of-bounds read issue can be exploited remotely, without authentication.

The post Critical Bug Could Expose 300,000 Ollama Deployments to Information Theft appeared first on SecurityWeek.

The vulnerabilities were reported to Meta through its bug bounty program and were patched with updates released earlier this year.

The post WhatsApp Discloses File Spoofing, Arbitrary URL Scheme Vulnerabilities appeared first on SecurityWeek.

The cybersecurity firm’s investigation has not found any impact on its source code release or distribution process. 

The post Trellix Source Code Repository Breached appeared first on SecurityWeek.

Hackers delivered malware via a customer chat channel, infected an analyst’s system, and accessed the internal support portal.

The post DigiCert Revokes Certificates After Support Portal Hack appeared first on SecurityWeek.

CISA has added the bug to its KEV list, and Microsoft has observed limited exploitation, mainly associated with PoC testing.

The post Exploitation of ‘Copy Fail’ Linux Vulnerability Begins appeared first on SecurityWeek.

Hackers disrupted services and stole names, email addresses, student ID numbers, and user messages.

The post Edtech Firm Instructure Discloses Data Breach Amid Hacker Leak Threats appeared first on SecurityWeek.

Google, Microsoft, Amazon Web Services, Nvidia, OpenAI, Reflection and SpaceX will provide resources to help augment warfighter decision-making in complex operational environments,” the Defense Department said.

The post US Military Reaches Deals With 7 Tech Companies to Use Their AI on Classified Systems appeared first on SecurityWeek.

The maximum reward for a zero-click Pixel Titan M exploit with persistence has increased to $1.5 million.

The post Google Adjusts Bug Bounties: Chrome Payouts Drop as Android Rewards Rise Amid AI Surge appeared first on SecurityWeek.