3+ day, 14+ hour ago   (80+ words) As outlined in IT Pro, the Shai-Hulud npm worm, previously thought to be neutralized, has reappeared in a new campaign that successfully bypassed npm's recently implemented security measures. The targeted entities are developers and organizations relying on the npm registry…...

4+ day, 4+ hour ago   (196+ words) A developer runs pip install. Nothing crashes. No ransomware appears. No antivirus alert fires. Thirty seconds later, a Python process makes an outbound connection to infrastructure nobody on the team recognizes. Recent 2026 incidents show how quickly this can become a…...

5+ day, 2+ hour ago   (240+ words) LONDON, UNITED KINGDOM; SEPTEMBER 08, 2026 – Inmarsat Maritime, a Viasat company, has received Cyber Security Type Approval from Bureau Veritas Marine & Offshore (BV) for NexusWave, its fully managed, bonded multi-network connectivity service. Inmarsat Maritime worked with BV to demonstrate that NexusWave architecture…...

5+ day, 8+ hour ago   (330+ words) A previously documented Shai-Hulud npm supply-chain worm payload has reportedly reappeared after 111 days of inactivity, using the exact same malicious file linked to the May 19 compromise of hundreds of @AntV package versions. The reactivation raises concerns about registry-level malware detection…...

6+ day, 4+ hour ago   (764+ words) Why AI Agent Sandboxes Are Failing Security Tests Berlin Ransomware Leak Exposes State Secrets Your MikroTik Router May Already Be Compromised: Look for SSH User “-2” AI Agents Hijacked German Wiki to Cheat, OpenAI Delayed Disclosure Security Affairs newsletter Round 593 by…...

1+ week, 4+ hour ago   (517+ words) Rescana Active Exploitation Alert: North Korean APTs Deploy Ted Backdoor in Compromised HAProxy Builds to Hijack Web Traffic Technical Analysis of Malware/TTPs The Ted backdoor is not a vulnerability in the official HAProxy codebase, but rather a malicious plugin…...

1+ week, 19+ hour ago   (731+ words) Once triggered, the background task restarts the credential-harvesting cycle on the newly infected machine, which is what gives ChainDrop its worm-like, self-sustaining spread across a team or an organization rather than a single compromised build. For command and control, ChainDrop…...

1+ week, 2+ day ago   (623+ words) Coder’s compromised module registry served malicious Terraform modules that stole cloud, CI/CD, AI, and SSH credentials during a 14-hour attack window. Coder confirmed that an unidentified attacker compromised infrastructure supporting its module registry and served modified Terraform modules designed…...

1+ week, 3+ day ago   (366+ words) Cybercriminals are increasingly hijacking Node.js, the widely used JavaScript runtime, to slip malicious code past security defenses, according to new findings from the Symantec Threat Hunter Team. Since February 2026, multiple threat actors have abused the legitimate, digitally signed tool…...

1+ week, 2+ day ago   (665+ words) Threat actors are leveraging the trusted Node.js JavaScript runtime in multiple cyber attacks as a way to deploy malicious payloads. According to a new report published by the Symantec Threat Hunter Team today, the attack method has been put…...