6 Reasons Why Device Code Phishing is the Fastest-Growing Threat of 2026
Device code phishing - the abuse of the OAuth 2.0 device authorization grant to steal access tokens - has evolved...
code
New Gitea RCE Lets Repository Writers Plant a Git Hook to Run Shell Commands
Swati KhandelwalJul 29, 2026Vulnerability / DevOps Gitea, the self-hosted Git platform, has patched a critical remote code execution vulnerability. A...
Flying Eagle Android RAT Traces Found on 170 Servers as Source Code Circulates
Swati KhandelwalJul 29, 2026Mobile Security / Threat Intelligence Source code for the Flying Eagle Android remote access trojan (RAT) framework...
Cursor Quietly Patches High-Severity Git Vulnerability After Seven-Month Delay
Opening a Git repository in a vulnerable version of Cursor could be enough to give attackers code execution on a...
Third-Party SDKs Raise Privacy Questions for Apps Marketed to U.S. Military
The biggest privacy risk on smartphones may not be the apps themselves, but the third-party code quietly running inside them....
New wp2shell WordPress Core Flaw Lets Unauthenticated Attackers Run Code
Swati KhandelwalJul 17, 2026Vulnerability / Web Security An anonymous HTTP request can run code on a WordPress site. The bug...
Forg365 PhaaS Targets Microsoft 365 with Device Code and AitM Session Theft
A new phishing-as-a-service (PhaaS) operation called Forg365 is using a combination of device code phishing, adversary-in-the-middle (AitM) tactics, antibot evasion,...
Claude Code Espionage Campaign Exposes a New Enterprise AI Risk
In September 2025, Anthropic detected suspicious activity in its Claude Code tool, which turned out to be a state-sponsored espionage...
China Warns of Claude Code ‘Backdoor’ Security Risk
China is telling organizations to remove certain versions of Anthropic’s Claude Code. The warning claims the AI coding assistant has...
Top AI Agents Built to Catch Malicious Code Can Be Tricked Into Running It
Ask an AI coding agent to scan open-source code for security holes, and it might run the attacker's code on...
GhostApproval Symlink Flaws Could Let Malicious Repos Run Code in AI Coding Agents
Researchers at Wiz found that a flaw in six popular AI coding assistants lets a booby-trapped code project quietly take control of...
NordVPN, 1-Year Subscription for 10 Devices is Only $30 With This Code
TL;DR: Use code SECURE to get a NordVPN 1-year subscription (MSRP $69.99) for $29.99. Public Wi-Fi at airports, hotels, and coffee shops...
DEBULL Tooling Abuses Microsoft Device-Code Flow to Target M365 Accounts
A Microsoft 365 device code phishing campaign has been observed leveraging collaboration-themed lures to take control of victim accounts between...
When AI agents look like attackers: what behavioral telemetry tells us
AI coding agents (Claude Code, Cursor, Codex, and others built on skill packs such as GStack) are showing up in customer environments. They...
New ChocoPoC RAT Targets Vulnerability Researchers via Fake PoC Exploit Repos
Attackers are hiding a data-stealing trojan inside fake exploit code aimed at the people who hunt bugs for a living....
