Hackers Infect 953 Online Stores With Scanner-Evading JavaScript, Mostly on Magento

Swati KhandelwalOct 26, 2026Vulnerability / Web Security PHP has rebuilt its official Windows packages for PHP 8.2 through 8.5 to...

Attackers Use Microsoft Teams IT Support Scams to Deploy Malware and Ransomware

Cybersecurity researchers are calling attention to what they say is a "recurring social engineering pattern" across hundreds of cases in...

⚡ Weekly Recap: This2Shell, That2Shell, Everything’s an RCE? Rogue AI, Supply Chain Chaos and More

This2Shell, That2Shell, Everything2Shell. That's pretty much how the last week went. Critical bugs that let attackers run code remotely are...

Two Critical Wasmtime Flaws Could Let Malicious WebAssembly Modules Escape Sandboxes

Two critical flaws in Wasmtime, a WebAssembly runtime that can be built into other software, could allow a malicious WebAssembly module...

Between alerts: What Attackers Do in the Spaces Ordinary Detection Misses

Every SOC struggles with a pile of alerts. Very few of those alerts explain how an attack started or how...

uCreator Android Spyware Can Steal Telegram 2FA Passwords and Clone WeChat Accounts

A rentable Android spyware kit called uCreator takes over Telegram and WeChat accounts by hiding its code inside working copies...

Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations

Cybersecurity researchers have disclosed a Microsoft 365 campaign that has been observed leveraging an adversary-in-the-middle (AitM) relay to capture sign-in...

Gheist Uses Stolen GitHub Tokens to Steal Private Repository Secrets via Actions Logs

An automated campaign is using stolen GitHub tokens to plant workflows that print a repository's secrets into its GitHub Actions...

Malicious File in Downloads Folder Tries to Trick AI Coding Agent Into Installing Malware