🔐 Security flaws and vulnerabilities

CERT-FR (Government Center for Monitoring, Alerting and Response to Computer Attacks)

Exploit Database (Offensive Security)

🛡️ Ongoing attacks and active campaigns

The Hacker News

  • IronWorm and New Miasma Worm Variant Hit npm in Supply Chain Attacks
    Multiple software supply chain attacks have hit the npm ecosystem, with threat actors using both malicious and poisoned versions of over 50 legitimate packages to distribute a Rust-based information stealer and a self-spreading worm, respectively. According to JFrog, the information stealer "scrapes every secret it can find on a developer's machine, hides behind an eBPF […]
  • Android Spyware Asin Targets Arabic Users via Fake News, PDF and War Map Apps
    Arabic-speaking users have emerged as the target of a new Android spyware codenamed Asin, according to findings from ESET. The Slovakian cybersecurity company said it first detected the malware spread via multiple campaigns in early 2025, with each attack wave making use of distinct websites mimicking utilities, war-related updates, and a government news source: govlens[.]net, […]
  • New Threat Cluster OP-512 Targets Microsoft IIS Servers with Custom Web Shell Framework
    Cybersecurity researchers have discovered a previously unreported threat cluster dubbed OP-512 (where "OP" stands for "opponent") that has been observed targeting Microsoft Internet Information Services (IIS) servers to deploy a bespoke web shell framework. ReliaQuest has assessed with moderate to high confidence that the espionage-focused activity is linked to China. "OP-512 was highly
  • Only 10% of SOCs Say They’re Getting Excellent Value From AI. Here’s What the Second Wave Has to Deliver
    Eighteen months ago, the AI SOC was a marketing line. Today it's a budget item. The category has crossed over from interesting to inevitable, with billions of dollars now flowing into AI-powered security operations platforms, agentic SOC tools, and AI co-pilots built into every layer of the security stack. The data shows SOCs are buying, […]
  • Hackers Exploit Critical Everest Forms Pro WordPress Plugin Flaw to Take Over Sites
    Threat actors are actively exploiting a critical security flaw in Everest Forms Pro, a WordPress plugin with about 4,000 active installations, to execute arbitrary code, leading to a complete site compromise. The vulnerability in question is CVE-2026-3300 (CVSS score: 9.8), a remote code execution bug impacting all versions of the plugin up to, and including, […]
🛠️ Microsoft Security Update Guide (Patch Tuesday & other updates)

This feed lists security bulletins (CVE, monthly patches) released by Microsoft. It is the official source for Windows, Office, Azure security updates, etc.