“This multi-account strategy provides redundancy when one account gets flagged, creates the illusion of independent developers, and demonstrates professional-level social engineering: GitHub repositories for credibility, consistent branding across extensions, detailed feature lists, professional marketplace presentations, and strategic naming that mimics… Read More "TigerJack’s malicious VSCode extensions mine, steal, and stay hidden"
A network of at least four organizations running illegal scam centers in Southeast Asia has been sanctioned by the UK and US government. The sanctions will freeze these businesses and properties some of the network’s operators own in the UK… Read More "UK, US Sanction Southeast Asia-Based Online Scam Network"
Modern organizations are increasing cloud adoption to reap the operational benefits of outsourcing critical business functions. A 2021 study found that 90% of surveyed organizations now use cloud computing, such as software-as-a-service (SaaS) services. SaaS solutions help organizations achieve vital… Read More "Top 7 SaaS Security Risks (and How to Fix Them)"
Oct 15, 2025Ravie LakshmananVulnerability / Threat Intelligence U.S. cybersecurity company F5 on Wednesday disclosed that unidentified threat actors broke into its systems and stole files containing some of BIG-IP’s source code and information related to undisclosed vulnerabilities in the product.… Read More "F5 Breach Exposes BIG-IP Source Code — Nation-State Hackers Behind Massive Intrusion"
MCPTotal, a comprehensive secure Model Context Protocol (MCP) platform, today announced its flagship platform to help businesses adopt and secure MCP servers. MCP has become the standard interface for connecting AI models with enterprise systems, external data sources, and third-party… Read More "MCPTotal Launches to Power Secure Enterprise MCP Workflows"
A security vulnerability affecting millions of WordPress websites has been uncovered in the widely used Slider Revolution plugin. The flaw, tracked as CVE-2025-9217, could allow users with contributor-level permissions or higher to read sensitive files stored on a site’s server.… Read More "Flaw in Slider Revolution Plugin Exposed 4m WordPress Sites"
On June 4, Asana identified a bug in its Model Context Protocol (MCP) server and took the server offline to investigate. While the incident was not the result of an external attack, the bug could have exposed data belonging to… Read More "Asana Discloses Data Exposure Bug in MCP Server"
New research has uncovered that publishers of over 100 Visual Studio Code (VS Code) extensions leaked access tokens that could be exploited by bad actors to update the extensions, posing a critical software supply chain risk. “A leaked VSCode Marketplace… Read More "Over 100 VS Code Extensions Exposed Developers to Hidden Supply Chain Risks"
Artificial Intelligence (AI) is advancing at a pace that outstrips traditional security frameworks. Generative AI has already changed how financial institutions analyze data, create insights and engage with customers. The next frontier, agentic AI, is even more transformative. These systems… Read More "Introducing MAESTRO: A framework for securing generative and agentic AI"
The phishing platform “Whisper 2FA” has rapidly become one of the most active tools used in large-scale credential theft campaigns, according to new research from Barracuda. Since July 2025, the platform has been responsible for nearly one million phishing attacks… Read More "Whisper 2FA Behind One Million Phishing Attempts Since July"
