North Korean hackers planted 67 malicious npm packages with 17K+ downloads, using new XORIndex malware in an evolving supply chain attack.

Octalyn Stealer on GitHub poses as a forensic tool, stealing VPN, browser, and crypto data via stealthy C++/Delphi malware builder.

Multiple severe vulnerabilities have been addressed affecting VMware ESXi, Workstation, Fusion, and Tools that could allow attackers to execute malicious code on host systems. 

Here’s how NCSC vulnerability research and the VRI strengthen UK cybersecurity through collaboration with experts, and the UK government.

An international law enforcement action dismantled a Romanian ransomware gang known as 'Diskstation,' which encrypted the systems of several companies in the Lombardy region, paralyzing their businesses.

North Korean threat actors planted 67 malicious packages in the Node Package Manager (npm) online repository to deliver a new malware loader called XORIndex to developer systems.

Microsoft has rolled out the Patch Tuesday updates for July 2025, ensuring the updates. This month’s update bundle is rather huge, addressing 137 different vulnerabilities across different products. Users with eligible devices should ensure keeping

Microsoft has released an emergency update to fix a bug that prevents Azure virtual machines from launching when the Trusted Launch setting is disabled and Virtualization-Based Security (VBS) is enabled.

ESET researchers observed tens of thousands of machines infected with AsyncRAT and its variants over the past year. The open-source malware is a popular tool among cybercriminals.

In congressional testimony, President Trump’s former national security adviser said his use of Signal to coordinate military operations was “driven by” cybersecurity guidance from CISA.

OpenAI's image gen model, which is available via ChatGPT for free, now lets you easily create AI images even if you're not familiar with trends or prompt engineering.

Google released a critical Chrome update (138.0.7204.157/.158) patching six vulnerabilities, including CVE-2025-6558, a high-severity zero-day actively exploited in the wild. Update immediately!

Broadcom has released urgent patches for four critical (CVSS up to 9.3) VMware vulnerabilities affecting ESXi, Workstation, and Fusion, allowing host code execution.

Apache CXF versions are vulnerable to DoS attacks and sensitive data leaks (CVE-2025-48795) due to improper handling of large messages. Update immediately!

Cameron Wagenius faces a maximum of 27 years in prison. A researcher that helped with the investigation called this ‘one of the most significant wins in the fight against cybercrime.'

A former US Army soldier, Cameron John Wagenius (kiberphant0m), pleaded guilty to hacking telecom companies, stealing data, and attempting to extort $1 million.

Google secures 3GW of hydropower in a $3B deal to power its AI data centers, while the tech industry faces mounting criticism over its massive water consumption.

The Rainbow Hyena threat cluster is unleashing PhantomRemote, a new backdoor, in phishing attacks against Russia's healthcare and IT sectors, leveraging compromised emails.

GLOBAL GROUP, a rebranded RaaS operation, is aggressively targeting critical infrastructure worldwide, leveraging AI chatbots for automated, high-pressure ransom negotiations.

Cyfirma uncovers "Octalyn Forensic Toolkit," a GitHub-hosted "educational" tool that's actually a modular credential stealer exfiltrating data via Telegram.