Google Gemini Broke Into Real Company Systems After Security Test Domain Mix-Up
Ravie LakshmananSep 19, 2026Artificial Intelligence / Web Security Google's Gemini model has become the latest artificial intelligence (AI) system to...
Blog
CrowdSec Says TanStack npm Attack Led to Copy of 170 Private GitHub Repositories
An attacker copied about 170 of CrowdSec's private GitHub repositories on May 22 using the account of an employee who...
Flock Offers Employees Buyouts as Customers Flee
As dozens of cities end contracts for its controversial license plate readers, Flock is rolling out a voluntary severance program,...
Brevo Supply-Chain Attack Infected Over 100,000 Websites
Brevo Supply-Chain Attack Infected Over 100,000 Websites Pierluigi Paganini September 18, 2026 A Brevo supply-chain attack used compromised Cloudflare access...
Friday Squid Blogging: On Squid Egg Sacs
Friday Squid Blogging: On Squid Egg Sacs Short essay about squid egg sacs. As usual, you can also use this...
Public Exploits Released for Four Linux Kernel Flaws That Enable Local Root
A security researcher has released working exploit code for four Linux kernel flaws that each let a local user gain...
An Undercover Google Analyst Infiltrated a Notorious Supply-Chain Hacking Gang
TeamPCP pulled off the worst-ever software supply-chain hacking spree and breached thousands of companies. Now Google’s threat intelligence group has...
Gyazo Data Breach Exposes 23 Million User Records
Gyazo Data Breach Exposes 23 Million User Records Pierluigi Paganini September 18, 2026 A Gyazo breach exposed 23 million user...
Microsoft mops up after Patch Tuesday broke logins, audio, Excel
if ( !emtpy($headline_subheadline ) ) : ?> Patch early and often, but not too early or you'll be doing it...
GhostCode attackers abuse device codes to take over Microsoft 365 accounts
if ( !emtpy($headline_subheadline ) ) : ?> A new phishing kit abuses a legitimate Microsoft device authorization flow to steal...
With Siri Recap, Apple threw a punch at OpenAI no one saw coming
if ( !emtpy($headline_subheadline ) ) : ?> If it manages to force regulation to define appropriate use of ambient AI,...
New WordPress Click2Shell Flaw Forces Theme Installs, Can Chain to Code Execution
Swati KhandelwalSep 18, 2026Vulnerability / Web Security WordPress today released patches to fix a new set of vulnerabilities in its...
Transparent Tribe Deploys New Rust Backdoor Using Private GitHub Repositories for C2
Ravie LakshmananSep 18, 2026Malware / Cyber Espionage The Pakistan-aligned threat group tracked as Transparent Tribe (aka APT36 and Earth Karkaddan)...
Microsoft Patches CVSS 10.0 Azure AI Foundry Flaw Enabling Unauthorized Privilege Escalation
Ravie LakshmananSep 18, 2026Vulnerability / Cloud Security Microsoft has released fixes for a maximum-severity security flaw in Azure AI Foundry...
An Abandoned CDN Domain Was Re-Registered. Thousands of Sites Still Call It.
In July 2025, someone registered a domain that used to belong to a content delivery network. The CDN had been...