Threats, breaches, defenders. Reported by people who can actually read the post-mortems.
Hacker group TeamPCP is offering nearly 450 Mistral AI internal code repositories for $25,000 on a hacker forum, threatening to release the data publicly within a week if no buyer is found. The breach traces back to the Shai-Hulud software supply-chain attack.
Sara Montes de Oca · 73 DAYS AGO
Amnesty International security researcher Donncha Ó Cearbhaill turned a phishing attempt on his own Signal account into an investigation, uncovering a Russian government-linked campaign that had identified more than 13,500 targets.
Sara Montes de Oca · 74 DAYS AGO
A researcher has released proof-of-concept exploits for two unpatched Windows flaws — a BitLocker bypass and a privilege-escalation bug — as Palo Alto Networks warns organizations have a three-to-five-month window before AI-driven cyberattacks become routine.
Jay Goldberg · 75 DAYS AGO
Exaforce has raised $125 million in a Series B round valuing the AI cybersecurity startup at $725 million, bringing its total funding to $200 million as demand for automated threat detection accelerates.
Sara Montes de Oca · 76 DAYS AGO
A rogue version of Checkmarx's Jenkins Application Security Testing plugin was uploaded to the Jenkins Marketplace on May 9, the third supply-chain attack against the firm since late March, carried out by the TeamPCP hacker group.
Jay Goldberg · 76 DAYS AGO
ShinyHunters exploited cross-site scripting flaws in Instructure's Canvas LMS to deface school login portals and demand a ransom, following an initial breach the group claims netted 275 million records from more than 8,800 educational organizations.
Sara Montes de Oca · 77 DAYS AGO
AI-powered voice-cloning tools requiring as little as three seconds of audio are fueling a surge in imposter scams, with cases rising 19% to roughly 1 million complaints in 2025 and losses exceeding $3.5 billion, according to the FTC.
Sara Montes de Oca · 78 DAYS AGO
A fake Hugging Face repository impersonating OpenAI's Privacy Filter project delivered Rust-based infostealer malware to Windows users, reaching 244,000 downloads and the platform's top trending spot before being removed, according to researchers at HiddenLayer.
Sara Montes de Oca · 79 DAYS AGO
A federal judge has ordered Peter Williams, former head of L3Harris's hacking tools division, to pay $10 million in restitution after he pleaded guilty to stealing trade secrets and selling them to a Russian broker, Operation Zero.
Jay Goldberg · 80 DAYS AGO
An overheating incident at an Amazon Web Services data center in northern Virginia disrupted core trading services on Coinbase and FanDuel Thursday night, with AWS warning Friday morning that full recovery could take several more hours.
Jay Goldberg · 80 DAYS AGO
The ShinyHunters extortion gang defaced Canvas login portals at roughly 330 educational institutions on May 7, demanding a ransom by May 12 or threatening to leak 280 million stolen student and staff records.
Jay Goldberg · 80 DAYS AGO
Ivanti has disclosed a high-severity zero-day vulnerability in Endpoint Manager Mobile, tracked as CVE-2026-6973, that allows remote code execution and is already being exploited in active attacks. Patches are available for affected on-premises versions.
Sara Montes de Oca · 81 DAYS AGO
Kaspersky has linked a Chinese-language hacking group to a backdoor planted in Daemon Tools, a popular Windows disc imaging application, in a supply chain attack the firm says is ongoing and has already been used to deliver malware to organizations in Russia, Belarus, and Thailand.
Jay Goldberg · 83 DAYS AGO
Instructure, maker of the Canvas learning management system, has confirmed a data breach exposing user names, email addresses, and private messages. The ShinyHunters extortion gang claims the attack affected 275 million individuals across nearly 9,000 schools worldwide.
Sara Montes de Oca · 84 DAYS AGO
A newly disclosed Linux kernel vulnerability, dubbed "Copy Fail" and tracked as CVE-2026-31431, allows any user with a basic account to gain full administrative control and escape cloud containers — affecting virtually every major Linux distribution released since 2017.
Sara Montes de Oca · 87 DAYS AGO
A new phishing-as-a-service platform called Bluekit combines more than 40 phishing templates with an AI assistant capable of drafting campaign content, underscoring the growing integration of AI tools into cybercriminal infrastructure.
Sara Montes de Oca · 88 DAYS AGO
Cybersecurity investment specialist Option3 is preparing to bring its next-generation platform to market, targeting a summer launch for what it now calls Native 2020.
Sara Montes de Oca · 109 DAYS AGO
The FBI confirmed the breach in a statement, acknowledging that "malicious actors" had targeted Patel's personal email and that the agency had "taken all necessary steps to mitigate potential risks.
Sara Montes de Oca · 122 DAYS AGO
Written for readers who already know the basics — markets, AI, and the policy decisions that shape both.