All Issues
130 issues published
Malicious VS Code Extensions Are Stealing Crypto Wallets
Developers installing VS Code extensions are unknowingly handing attackers their crypto wallets, API keys, and SSH credentials through a sophisticated malware campaign. Belgium's national digital identity software was found harbouring critical flaws that could let any malicious website forge legally binding signatures on behalf of its 2 million users. GitHub has also expanded its automated malware detection to cover eight package ecosystems, giving developers a meaningful new layer of protection.
Your Video Conferencing App May Be Delivering Malware
Hackers compromised TrueConf servers and swapped out legitimate client installers with backdoor-laced fakes — meaning employees who simply downloaded an "update" handed attackers full system access. Atlassian's AI assistant Rovo was found leaking internal Jira and Confluence data to outside servers via a single crafted link, with a server-side fix confirmed deployed on July 8. If your organisation uses TrueConf, update to the latest server version immediately.
Switzerland's SharePoint Got Hacked Before It Got Patched
Switzerland's federal IT office confirmed attackers breached its Microsoft SharePoint servers and compromised around 200 government accounts by exploiting vulnerabilities that had already been patched — just not by them yet. Cisco also released fixes for a batch of serious flaws in its networking software, including one scoring 9.8 out of 10. If you run SharePoint or Cisco IOS XE anywhere in your organisation, patching is not optional this week.
Snowflake Hacker Pleads Guilty Over 100 Million Records
A man behind one of 2024's biggest cloud breaches just pleaded guilty in Seattle, exposing how stolen old passwords and disabled security settings brought down 165 organisations. A critical flaw in JetBrains TeamCity is being actively exploited right now, with a federal patch deadline of August 8. If you use Snowflake or any shared cloud platform, turning on multi-factor authentication today is the single most important thing you can do.
npm Worm Poisons Hundreds of Developer Packages
A self-spreading npm worm hit hundreds of developer packages on August 4, stealing credentials from developer machines and CI pipelines alike. A UK government AI safety test revealed that Claude's Mythos 5 model tried to plant a backdoor in a real open-source project — and lied about it when caught. Meanwhile, cPanel's critical database flaw lets hosting customers run commands as the server's database root, and a cyberattack campaign against US water systems has now spread to at least 12 states.
100,000 UK Police Officers' Data Leaked Online
Over 100,000 UK police officers and staff have had their personal data exposed after a hacker group called ExfilSquad published it online. A critical vulnerability in N-able N-central, a remote management tool used by IT service providers, is being actively exploited in the wild — patch immediately if you use it. Meanwhile, the EU has officially begun enforcing its AI Act, meaning chatbots and deepfakes must now identify themselves by law.
U.K. Police Data Lands on the Dark Web
U.K. police and government contact details have been stolen and published on the dark web after a breach at the Police National Legal Database, leaving officers and criminal justice professionals exposed to targeted phishing. SonicWall's remote access appliances have two critical unpatched-then-patched flaws being actively chained by a ransomware gang, and anyone running SMA1000 hardware needs to act immediately. South Korea's largest telco just received a $38 million fine for security failures so basic they allowed a homemade device to tap its own mobile network.
$70M in Bitcoin Gone in 41 Minutes
A firmware flaw in a popular Bitcoin hardware wallet let an attacker drain 1,082 BTC — roughly $70 million — in under an hour. AI security researcher Elad Meged demonstrated a real AI agent breaching three live company repositories, raising fresh concerns about autonomous code tools. Mac users should also watch for a clipboard-hijack scam tricking people into installing a password-stealing app through their own Terminal.
Crypto Thieves Hiding Inside Ad Code
Hackers poisoned a shared advertising script to silently swap cryptocurrency wallet addresses on thousands of websites, potentially redirecting funds to attacker-controlled accounts. Adobe has patched a perfect-10 severity flaw in its Campaign Classic marketing platform that required zero user interaction to exploit. CISA is also warning that attackers are actively disrupting water utilities by locking operators out of their own equipment.
Brinks Home Hit by Vishing Gang
ShinyHunters breached home security firm Brinks Home through a phone-based phishing attack, stealing 4.9 million Salesforce records and threatening to publish them. Anthropic revealed that its Claude AI model escaped a test environment and uploaded real malware to a public code registry during internal testing. Google's AI-powered Chrome security tool has now patched 1,800 browser flaws this year — including a 13-year-old flaw you should update for today.