A leading open source security body has warned of “stagnating awareness and structural unreadiness” in the community ahead of a key December 2027 deadline for compliance with the Cyber Resilience Act (CRA). The CRA is an EU effort to introduce… Read More "Two-Thirds of Open Source Community Unaware of Cyber Resilience Act"
Prompt injection remains an unsolved architectural problem that could hamper the development of AI, said Ariel Fogel, a contributor to the Open Worldwide Application Security Project (OWASP), during Infosecurity Europe 2026. Fogel, an AI security researcher at Pillar Security’s office… Read More "Prompt Injection Remains Unsolved, OWASP Researcher Warns"
ChatGPT users have gained two new security controls: one aimed at preventing data theft through prompt injection and another at tracking account sign-ins. According to OpenAI, the first of these, Lockdown Mode, is an optional setting that limits how far… Read More "OpenAI Unveils ChatGPT Account Security Controls"
A likely North Korean threat actor has phished software developers at almost 100 organizations with fake job and code-review lures to steal cryptocurrency and credentials. According to new analysis from Proofpoint, which tracks the cluster as UNK_DeadDrop, the campaign sent… Read More "North Korean Hackers Use Fake Coding Tasks to Steal Crypto"
WhatsApp has asked a US court to hold a blacklisted spyware firm in contempt, after claiming it has violated a permanent injunction banning it from targeting users. The messaging giant said on June 8 that it “successfully disrupted” social engineering… Read More "WhatsApp Discovers NSO Group-Linked Spearphishing Attempts"
Cybersecurity researchers have disclosed details of sustained cyber espionage activity against several Pakistani law enforcement organizations undertaken by suspected China- and India-aligned threat actors between February 2024 and April 2026. “At Balochistan Police, the compromised assets included servers hosting web… Read More "Hackers Weaponize Balochistan Police Portal in Multi-Group Espionage Campaigns"
When Jaguar Land Rover (JLR) was hit by a major cyber-attack in September 2025, one of the first things the company’s cybersecurity leader did was to call over 30,000 staff on site to reset their passwords. Speaking during Infosecurity Europe… Read More "Infosecurity Europe: Why JLR’s CISO Enforced In-Person Password Resets"
Version 8.14.0 of the jscrambler npm package shipped with a malicious preinstall hook that silently drops and runs a native infostealer during installation, one build each for Windows, macOS, and Linux. Published on July 11, 2026, it needs no import and no CLI call.… Read More "Compromised jscrambler 8.14.0 npm Release Drops Rust Infostealer During Install"
Check Point has urged customers to patch a critical zero-day vulnerability in its Remote Access VPN and Mobile Access solutions that is being actively exploited. CVE-2026-50751 is an authentication bypass flaw that affects deployments configured to use the deprecated IKEv1 key… Read More "Check Point Warns Critical Auth Bypass Bug Exploited in the Wild"
Threat actors are abusing the GitHub API to systematically enumerate organizations, repositories, and user accounts, Datadog reports. Spanning multiple overlapping campaigns, the activity has been ongoing for several months, relying on ghost accounts that were registered two to five years… Read More "Ghost Accounts Abuse GitHub API in Mass Recon Campaign"
