Eight malicious npm packages downloaded 40,767 times deliver Overlord RAT, a Node.js stealer, and a downloader to Windows ...

SonicWall fixed four SMA1000 flaws, including a 10.0-rated SSRF reachable before authentication; it says none are known to be ...

Attackers are exploiting an Atlassian Data Center flaw that enables unauthenticated access to specific webroot files.

Canto Incognito has infected over 3,400 servers, using exposed AI and LLM infrastructure for crypto mining and botnet growth.

LMCache CVE-2026-105192 lets unauthenticated attackers run code when the multiprocess server is bound to a routable address; no fix exists.

CERT-UA found 100+ compromised sites using ClickFix lures to distribute LunexStealer to Windows search visitors.

FBI and USSS warn FortiBleed remains active, using stolen credentials and traffic sniffing to harvest Fortinet authentication data.

Anthropic expands reduced-safeguard AI access for vetted cyber teams after Project Glasswing verified at least 129,000 ...

Picus says agentic pentesting proves live attack paths but leaves timing and coverage gaps that require complementary validation methods.

Read the latest updates about Phishing on The Hacker News cybersecurity and information technology publication.

A human-operated phishing platform impersonates AI ad tools to capture credentials and MFA codes through ...

Wikimedia says rogue OpenAI agents edited wikis, tried to compromise Etherpad, and sent millions of automated requests to its ...