🔐 Security flaws and vulnerabilities

CERT-FR (Government Center for Monitoring, Alerting and Response to Computer Attacks)

Exploit Database (Offensive Security)

🛡️ Ongoing attacks and active campaigns

The Hacker News

  • Police Arrest 16-Year-Old Suspected of Running KillSec, Seize Ransomware Leak Site and Servers
    Police in Spain have arrested a 16-year-old whom investigators suspect of running the KillSec ransomware group. KillSec is accused of stealing data from organizations and threatening to publish it on its leak site unless they paid. The 16-year-old was one of 3 people arrested on September 30, when police also took control of that site. […]
  • ThreatsDay: AI-Powered Zero-Day Chain, 543K Live Secrets, Model Inspection RCE and 13 More Stories
    This week, the useful words are boring ones: inspect, cache, compile, store, trust. Each sounds harmless. Each can become an attack path when a system does a little more than people expect. A model check can run code. A cache can mix up requests. A public secret can stay useful for years. That is the […]
  • WordPress Backdoor Rebuilds Itself After Cleanup Using Files, Database, and Shared Memory
    Cybersecurity researchers have shed light on a WordPress compromise in which threat actors deployed multiple persistence mechanisms to ensure that the final payload kept returning without having to infect the site again. The backdoor has been codenamed SC after the "SC_" markers present in the injected content. Sucuri has described the malware as a "self-healing […]
  • How Financial Services Companies Can Modernize Their Software Supply Chain
    Every security leader at a bank, insurer, or asset manager has had a version of this conversation: Security wants to eliminate a class of vulnerabilities. Engineering explains what it would take to upgrade the platform where they live. Somebody prices out the regression testing. Somebody else raises the change-freeze calendar. The finding gets an exception, […]
  • OpenAI Disrupts Reasoning Extraction Campaign Linked to Moonshot AI Associates
    OpenAI on Wednesday said it identified and disrupted a coordinated distillation campaign that was designed to illicitly extract protected reasoning from its artificial intelligence (AI) models. A "core cluster of the activity," going back to the first week of July, has been attributed to individuals associated with Moonshot AI, a Chinese AI company based in […]
🛠️ Microsoft Security Update Guide (Patch Tuesday & other updates)

This feed lists security bulletins (CVE, monthly patches) released by Microsoft. It is the official source for Windows, Office, Azure security updates, etc.