Hackers compromise Rust crate arrayref to inject malware
The attack involved injecting a dependency on a malicious package, proc-macro1, which impersonated the popular proc-macro2 crate.
SC Media
20 articles
Rejoice In The Nostalgia - PSW #940
Agentic IAM: How to secure and manage AI agent identities
Explore how Agentic Identity and Access Management (IAM) helps organizations securely manage AI agents as governed non-human identities. Learn how identity, ...
Unspecified actors making AI-assisted attacks on critical infrastructure
Feds warn that critical infrastructure organizations to treat attacks with the utmost urgency.
Unsecured database exposes millions of facial biometrics
The database, belonging to U.S.
Inside the fourth wave of the Shai-Hulud npm worm
The signed packages were authentic – but that’s precisely the problem: the provenance lied.
ICE reminds employees to leave Meta smart glasses at home
The memo emphasized that these devices, which can covertly record video and audio, could potentially compromise privacy and legal protections.
Army establishes new task force to explore AI in cyber command
Task Force Lexington is developing AI agents to mimic human cyber work roles, including developers, data engineers, and analysts.
Sakura Internet reports potential compromise of over 1.3 million customer accounts
Sakura Internet, a key provider of digital infrastructure services in Japan and a domestic partner for the Government Cloud program, discovered the breach on...
Researchers demonstrate faster remote Spectre attack against Cloudflare Workers
The researchers developed an end-to-end experiment using an attacker Worker and a victim Worker within the same production environment.
Operation CameraSwarm compromises over 14,500 Dahua devices
The campaign, primarily impacting devices in Ukraine and Russia, leveraged CVE-2021-33044 and CVE-2021-33045, two authentication-bypass flaws rated 9.8 CVSS ...
Password spraying attacks surge 155x, exploiting legacy authentication flaws
The campaign, originating from an IPv6 range provided by LSHIY LLC, leveraged reused credentials and the legacy Resource Owner Password Credentials (ROPC) OA...
Kriminal AI service bypasses guardrails by renting legitimate AI models
Kriminal operates on the clearnet, offering various subscription tiers and pay-per-message options.
New malware campaign combines social engineering with defense evasion
The campaign, observed in late July 2026, begins with compromised WordPress websites injected with obfuscated ErrTraffic JavaScript.
Harness launches AI agents to find and fix software vulnerabilities
The AI SAST agent identifies vulnerabilities, including logic flaws missed by traditional tools, and reduces false positives.
Brazil's data authority orders halt to facial recognition in Paraná schools
The ANPD cited a failure by the Paraná State Department of Education to demonstrate an adequate legal basis for processing sensitive biometric data, nor suff...
T-Mobile cybersecurity staff cut cable to expel Chinese hackers
The hacking group, identified as Salt Typhoon, compromised hundreds of companies, including major players like AT&T, Verizon, Viasat, Charter, and Windst...
Microsoft Defender bug causing crashes resolved
The bug caused Windows Defender quick or full scans to fail, sometimes requiring the service to be restarted.
Grandoreiro banking trojan resurfaces with new campaign targeting Latin America
The latest campaign, observed in May 2026, utilizes DLL sideloading to execute the banking trojan.
Black Hat/DEF CON attendees targeted in malware scheme with Google Doc lure
A malicious Google Apps Script sidebar leads to payloads for both macOS and Windows.