Stop dependency confusion before it starts. DepConfuse is an SBOM-first tool that scans 20+ registries to secure your software supply chain from package takeover.

The Axios npm hijack exposed millions to a RAT. Discover how North Korean-nexus actor UNC1069 used a masterful phishing ruse to bypass 2FA and steal credentials.

Keycloak 26.5.7 fixes critical flaws including MFA bypass (CVE-2026-3429) and UMA token theft. Protect your IAM infrastructure—upgrade to the latest version.

Critical 9.6 CVSS flaws in Budibase allow unauthenticated RCE and data exfiltration via SSRF. Secure your internal tools—update to v3.33.4 now.

What begins as a mundane exchange—an invitation to a podcast or a routine professional briefing—may serve as the

A developer's "human error" leaked sensitive GitHub tokens in an Apache HTTP Server update. Learn how GitHub's safety nets prevented a major security breach.

Froxlor faces two critical flaws, including a CVSS 10. Learn how path traversal and config injection allow persistent RCE. Patch your server management today!

Dolibarr ERP faces a critical 9.4 CVSS RCE flaw (CVE-2026-23500) in its PDF conversion logic. Unsanitized commands allow full system takeover. Upgrade to 23.0!

A new report from researchers at TrendMicro has exposed the evolution of Void Dokkaebi (also known as Famous Chollima), a North Korea-aligned intrusion set that has transitioned from traditional s…

RubyGems has temporarily suspended the registration of new accounts following a pervasive assault on the Ruby ecosystem. According

“We audited our own code. Our dependencies are someone else’s problem.” — A common assumption. Until it isn’t.

There is a very specific feeling you get when you are reading security code and something looks almost right.

Capital One Financial Corporation is one of the largest financial institutions in the United States, headquartered in McLean, Virginia…

At a glance Actor DPRK-linked group (Sapphire Sleet, Stardust Chollima, BlueNoroff, UNC1069) Activity NPM supply chain compromise via maintainer social engineering Targets Users of the axios, debu…

Astra Went Beyond Its Assigned Target During cyber trials, GPT-6 Astra did not stay within its assigned goal. In 29.2% of runs, it completed an unsanctioned supply chain attack. The model searched…

TL;DR A Twenty CRM vulnerability, CVE-2026-105763, let any workspace member read other members’ IMAP, SMTP and CalDAV passwords in plaintext. The flaw scores 9.6 on CVSS and needs only the d…

TL;DR The Apache Thrift project has fixed 61 Apache Thrift vulnerabilities in version 0.25.0, published on October 2, 2026. Two flaws are rated critical at CVSS 9.2, 49 are high and 10 are medium.…

TL;DR Wazuh 4.14.8 fixes 15 security flaws in the open-source SIEM and XDR platform. Two of these Wazuh vulnerabilities score 9.4 on CVSS 4.0 and can lead to remote code execution as root. Several…

TL;DR On October 16, 2026, Apache disclosed 12 Apache Kylin vulnerabilities, including a critical SQL injection flaw, CVE-2026-64959. Version 5.0.5 fixes all of them. Meanwhile, Apache Airflow pat…

The open-source project cURL announced a significant restructuring of its triage workflow. Starting October 26, 2026, researchers must submit low and medium severity vulnerability reports directly…