Ionut Arghire

By default, npm install will no longer execute scripts from dependencies, unless explicitly allowed.

The hackers published 5GB of data, including customer personal information and credentials for the RTKBase platform.

The critical-severity OS command injection vulnerability allows attackers to execute arbitrary code with root privileges.

The browser refresh resolved critical and high-severity security defects, including a dozen use-after-free bugs.

The new BOD 26-04 requires agencies to review and update vulnerability management policies with a focus on KEV catalog entries.

Disclosed in March, the security defect enables unauthenticated attackers to write files to arbitrary locations on the system.

The security defects could allow attackers to create or modify arbitrary files and access and modify protected resources.

The PoC exploits Microsoft Defender’s offline scan to spawn a SYSTEM shell when rebooting in Recovery Mode.

Cyera is positioned as one of the most valuable privately held cybersecurity firms in the world with total funding topping $2 billion.

In the post-Mythos era, the company’s platform helps organizations enforce security controls across environments.

Exploiting a race condition in Microsoft Defender, the exploit leads to local privilege escalation to SYSTEM.

Two OS command injection flaws can be exploited remotely, without authentication, for arbitrary code execution.

Organizations are advised to apply vendor-supplied mitigations or discontinue the vulnerable devices.

Public LLM models with safeguards turned off can also build working exploits, increasing patch gap risks.

The flaws could lead to the disclosure of sensitive information, memory corruption, and disruption of normal system usage.

The most recent variants of the self-propagating attacks are named Miasma and Hades.

The authentication bypass vulnerability allows attackers to establish VPN connections without a valid password.

The flaw allows attackers to execute arbitrary code remotely and has been exploited in the wild for two months.

Hackers accessed personal information stored on certain Lansing Community College systems in February 2025.

Focusing on hacking law firms in the US, the ransomware group relies on fast flux to hide its C&C infrastructure.