Security Stuff

Drupal has announced it will release critical security updates for its core platform on May 20th and is urging website administrators to prepare for immediate patching. The advisory indicates the updates address serious security vulnerabilities, though specific details haven't been disclosed to prevent exploitation before the patches are available. Site owners running Drupal are being advised...

Dark Reading editors reflect on twenty years of cybersecurity evolution, highlighting a persistent paradox in the industry: while organizations rush to adopt cutting-edge technologies like AI and cloud computing, they continue to struggle with basic security fundamentals like strong authentication, timely patching, and network segmentation. The pandemic emerged as a major inflection point that acc...

A critical security flaw in NGINX web servers that went undetected for 16 years is now being actively exploited by hackers just days after patches were released. The vulnerability, dubbed "Nginx Rift," affects millions of internet-exposed servers and can trigger denial-of-service conditions on default installations, while potentially allowing remote code execution on systems without prop...

Just days after the hacking group TeamPCP released the Shai-Hulud worm's source code on GitHub, the first clones have emerged in active supply chain attacks. Ox Security reports that four malicious NPM packages, with over twenty-six hundred weekly downloads combined, have been published by a single threat actor, including one package that's a direct clone of the credential-stealing worm....

Grafana has confirmed a data breach after hackers compromised a token that gave them access to the company's GitHub environment, allowing them to download source code. The analytics software provider says no customer data or personal information was stolen and they've refused to pay the ransom demanded by the Coinbase Cartel cybercrime group. The gang, which security experts link to Shin...

Seven-Eleven has confirmed a data breach after the hacking group ShinyHunters claimed to have stolen over 600,000 Salesforce records containing personal and corporate information. The intrusion, detected on April 8th, affected systems storing franchisee documents, though the company says the impact appears limited with only two Maine residents affected according to state filings. ShinyHunters dema...

A security researcher has released an exploit called MiniPlasma that targets a Windows vulnerability from 2020, claiming Microsoft never actually patched it despite issuing fixes in December 2020. The vulnerability in the Windows Cloud Filter driver allows attackers to escalate privileges and potentially execute system-level code, and testing confirms it still works on Windows 11 systems with the...

Multiple major healthcare data breaches have been officially logged on the US Department of Health and Human Services tracker, with millions of Americans affected. The largest incident impacted New York City Health and Hospitals Corporation, affecting 1.8 million people after hackers accessed systems through a third-party vendor between November 2025 and February 2026, exposing personal, medical,...

Cybersecurity firm Cyera has discovered four vulnerabilities in the OpenClaw AI assistant that can be chained together to allow attackers to escape the sandbox and plant backdoors on the host system. The so-called Claw Chain attack exploits race conditions and access control flaws to let attackers leak credentials, escalate privileges, and gain persistent control, with over 60,000 publicly accessi...

Four malicious packages were discovered in the npm software repository, designed to infect developers' computers with information-stealing malware and a DDoS bot called Phantom. The packages targeted JavaScript developers who unwittingly downloaded them while building applications, turning their machines into tools for stealing sensitive data and launching distributed denial of service attack...

Major tech vendors including Ivanti, Fortinet, SAP, VMware, and n8n have released security patches for critical vulnerabilities including remote code execution flaws, SQL injection bugs, and privilege escalation issues. These patches address serious security gaps that could allow attackers to compromise systems and gain unauthorized access. Organizations using these platforms are urged to apply th...

Security researchers have discovered a zero-day vulnerability called MiniPlasma in Windows that allows attackers to escalate their privileges to SYSTEM level, the highest access tier in the operating system, even on fully patched systems. The exploit poses a serious threat as it can be leveraged by attackers who have already gained initial access to a machine to take complete control of the system...

Developer workstations are increasingly being recognized as a critical component of the software supply chain that needs protection. As organizations focus on securing their development processes, the machines where code is written have become attractive targets for attackers looking to inject malicious code or steal credentials. This shift reflects a broader understanding that supply chain securi...

The cybersecurity landscape is shifting dramatically as AI agents become capable of finding and exploiting obscure software vulnerabilities at scale. At the same time, developers are churning out massive amounts of AI-generated code that may contain hidden flaws, creating a perfect storm where attackers have powerful new tools while the codebase they're targeting grows larger and potentially...

Phishing remains one of the fastest and most effective ways cybercriminals gain access to business networks, often serving as the initial entry point for larger breaches. Organizations can reduce their phishing exposure by implementing multi-layered defenses including employee security awareness training, email filtering systems, and multi-factor authentication to prevent stolen credentials from b...

Grafana has disclosed a security breach involving a compromised GitHub token that allowed an attacker to download the company's codebase. The incident escalated into an extortion attempt after the unauthorized access was discovered. Grafana is investigating the scope of the breach and working to secure its systems while determining what data may have been exposed.

Proof-of-concept exploit code is now publicly available for a critical NGINX vulnerability that went undetected for 16 years. The bug, tracked as CVE-2026-42945 with a CVSS score of 9.2, is a heap buffer overflow in the rewrite module that can cause denial-of-service conditions and potentially enable remote code execution if certain security protections are disabled. F5 has patched the vulnerabili...

The notorious hacking group TeamPCP has released the source code for its Shai-Hulud worm on GitHub, dramatically lowering the barrier for copycat supply chain attacks targeting open source software ecosystems. The group is even running a contest on BreachForums with cash rewards for cybercriminals who successfully deploy the worm and cause maximum damage. Security experts warn that the malware&apo...

Google has released Chrome 148, patching 79 vulnerabilities including 14 critical-severity bugs that could potentially allow remote code execution. The most significant flaws include a heap buffer overflow in WebML that earned a 43-thousand-dollar bug bounty and an integer overflow in Skia that paid out 25-thousand dollars, though Google says there's no evidence of any exploits in the wild. T...

OpenAI has confirmed it was hit by the recent TanStack supply chain attack that compromised developer tools in May. Two employee devices were infected with the Shai-Hulud worm, allowing hackers to steal credentials and access internal code repositories containing code-signing certificates for the company's apps across multiple platforms. While OpenAI says no customer data or intellectual prop...

Microsoft is warning users about a newly disclosed zero-day vulnerability in Exchange Server that's being actively exploited in the wild. The flaw, tracked as CVE-2026-42897, is a spoofing and cross-site scripting issue that allows attackers to execute arbitrary JavaScript when targeted users open specially crafted emails in Outlook Web Access. Microsoft has released mitigation guidance while...

American Lending Center, a California-based non-bank lender managing three billion dollars in small business loans, has disclosed a ransomware attack that compromised the personal information of over 123,000 individuals. The breach, detected in July 2025, potentially exposed names, dates of birth, and social security numbers, though the company says its investigation found no evidence of data misu...

In a significant supply chain attack targeting the TanStack JavaScript library, two OpenAI employee devices were compromised, prompting the company to force macOS updates across its systems. The breach highlights growing concerns about supply chain vulnerabilities in popular open-source libraries that are widely used in software development. OpenAI responded quickly by implementing security measur...

A cybersecurity professional spent 45 days monitoring their own organization's tools and infrastructure to understand what attackers actually see when targeting their systems. The exercise revealed critical gaps in visibility and highlighted how the actual attack surface often differs significantly from what security teams think they're protecting. This kind of "attacker's eye...

Dark Reading asked several prominent cybersecurity columnists to revisit their favorite pieces from the past 20 years and reflect on how those topics have evolved. The contributors include Robert Hansen on bot scraping that's now morphed into AI content scraping, Katie Moussouris warning that AI-accelerated bug discovery is overwhelming security teams, Rich Mogull on the principle that simple...