Over 200 Fake Android Apps Are Quietly Stealing Money From Phone Bills

Google needs to beef up its cybersecurity after last year's 150 Google Chrome extensions that were turned into viruses, ...

Ghost CMS SQL injection flaw exploited in large-scale ClickFix campaign

A large-scale campaign is exploiting a critical SQL injection vulnerability (CVE-2026-26980) in Ghost CMS to inject malicious ...

Websites have a new way to spy on visitors: Analyzing their SSD activity

Now sites have a new way to spy on their visitors: measuring subtle interactions with their solid-state drives. The technique ...
Microsoft

Malicious npm packages abuse dependency confusion to profile developer environments

A dependency confusion campaign leveraged 33 malicious npm packages to collect reconnaissance data from developer and build environments. This report details the attack chain, observed tradecraft, and ...

KnowledgeDeliver flaw exploited as a zero-day to install web shells

Hackers exploited a critical zero-day vulnerability in a server running the KnowledgeDeliver learning management system (LMS) to deploy the Godzilla web shell.
GitHub

0x04h-Testing-Code-Quality.md

Injection Flaws (MSTG-ARCH-2 and MSTG-PLATFORM-2) An injection flaw describes a class of security vulnerability occurring when user input is inserted into backend queries or commands. By injecting ...