The Hacker NewsJul 15, 2026Web Security / Supply Chain Security A single approved marketing tag can quietly load fourth-party code your security team has never seen, granting full access to your forms, customer data, and checkout pages. This on-demand webinar… Read More "Closing the Approval Gap in AI-Era Ad Tech"
Initially the attackers released new package versions with two malicious scripts that get executed at install time using a preinstall hook in the configuration script. The scripts also execute platform-specific binaries for Linux, macOS, and Windows embedded in an obfuscated… Read More "NPM ecosystem hit with two new supply chain compromises"
Your child’s first data breach may happen before they’ve even opened a bank account. Here’s how to keep their digital life safe. 03 Jun 2026 • , 6 min. read When we talk about cybersecurity and digital safety in the… Read More "Why children’s data is a long-term identity risk"
A previously unreported threat actor has been observed targeting cryptocurrency firms with custom macOS malware, fake recruiter approaches and the hijacking of internal development pipelines. Wiz has attributed the activity to a financially motivated cluster, now tracked as Jinx-0164, according… Read More "New Threat Actor Jinx-0164 Targets Crypto Developers on macOS"
Does a software feature exist if its code has been deployed to the devices of millions of people but they can’t use it yet? Not if you work at Meta. The company’s executives have spent the last few weeks making… Read More "Here’s the Truth About Whether Meta’s NameTag Face Recognition Tech ‘Exists’"
The White House announced on Tuesday the launch of Gold Eagle, a new coordination mechanism intended to speed up the detection, prioritization, and patching of vulnerabilities in critical infrastructure. The initiative pairs open source software maintainers with critical infrastructure operators… Read More "White House Launches AI-Driven ‘Gold Eagle’ Vulnerability Coordination Initiative"
Security researcher Chaotic Eclipse (aka Nightmare-Eclipse) has released a new proof-of-concept (PoC) exploit called LegacyHive. It has been described as a Windows User Profile Service arbitrary hive load elevation of privileges vulnerability. The Windows User Profile Service, also referred to… Read More "Researcher Drops New Windows Zero-Day PoC Hours After Microsoft Patch Tuesday"
There’s one cognitive bias that we humans are prone to, and it lies at the centre of some of the challenges that cybersecurity professionals face every day. It’s known as the normalcy bias – what Dr. Lauren Braithwaite defines as… Read More "the ‘auditors’ you never hired"
In a new bulletin, Microsoft has criticized security researchers for publicly reporting vulnerabilities in the company’s products before patches were available and without prior notice. These “uncoordinated disclosures put our customers at unnecessary risk,” the tech giant said. Six Microsoft… Read More "Microsoft Condemns “Uncoordinated” Zero Day Disclosures"
The US Justice Department on Tuesday unsealed an indictment charging three Russian nationals and two companies for allegedly running cybercrime services. The individuals are Aleksandr Alexandrovich Volosovik, Kirill Andreevich Zatolokin, and Yulia Pankova, and the targeted companies are ML.Cloud and… Read More "US Charges Russian Individuals and Firms for Running Cybercrime Services"
