Cybersecurity
69 articles RSS
npm, PyPI, and Crates.io Cannot Afford Basic Security as Malware Costs Devour Thin Budgets, Alpha-Omega Audit Reveals
An audit of the world's largest open source package registries finds they spend 12 percent of their budgets fighting malware and just 2 percent on new features, with no path to sustainable security funding.
Microsoft Patches Six Actively Exploited Zero-Days in February 2026, Matching Last Year's Record High
Microsoft's February Patch Tuesday fixes 58 flaws including six zero-days already under attack, with CISA ordering immediate federal remediation.
PackageGate flaws let Git dependencies bypass npm’s post–Shai-Hulud install defenses
Researchers say Git-sourced dependencies can re-enable code execution paths even when npm is run with --ignore-scripts, undermining a widely recommended mitigation after 2025’s Shai-Hulud worm.
OpenAI Introduces Trusted Access for Cyber, Gates Its Most Capable Security Model Behind Identity Verification
OpenAI launches a tiered access framework for cybersecurity professionals alongside $10 million in API grants, as GPT-5.3-Codex becomes the company's first model rated 'high' for cyber risk.
BeyondTrust Patches Critical Pre-Auth RCE Flaw Rated 9.9 as 11,000 Instances Sit Exposed on the Internet
A CVSS 9.9 command-injection bug in BeyondTrust Remote Support and Privileged Remote Access lets unauthenticated attackers execute OS commands, echoing the zero-days that gave Chinese state hackers access to the U.S. Treasury in 2024.
CISA Orders Federal Agencies to Rip Out Unsupported Edge Devices as Nation-State Hackers Exploit Aging Firewalls and Routers
Binding Operational Directive 26-02 gives agencies 18 months to inventory and replace end-of-life firewalls, routers, and switches that advanced threat actors are actively exploiting.
Substack Confirms Data Breach Exposing Nearly 700,000 Users After Hacker Dumps Records on Dark Web Forum
Substack disclosed a breach that went undetected for four months, with a hacker leaking email addresses, phone numbers, and internal metadata for hundreds of thousands of users on BreachForums.
Chinese State Hackers Hijacked Notepad++ Updates for Six Months in Targeted Espionage Campaign
Lotus Blossom APT group compromised Notepad++ update infrastructure from June to December 2025, delivering Cobalt Strike and custom backdoors to select government and telecom targets
Single Threat Actor Behind 50 Corporate Breaches Using Stolen Cloud Credentials
Threat actor exploited infostealer-harvested passwords to breach enterprise file-sharing platforms at major companies lacking MFA protection.