Latest security news

Researched & explained in plain language

What website owners should know right now

SANDCLOCK: LiteLLM Supply Chain Attack Siphons CI/CD Secrets

Compromised LiteLLM PyPI versions 1.82.7/1.82.8 steal cloud keys and tokens. Over 2,500 organizations affected.

Akira Ransomware Bypasses EDR via Safe Mode After SonicWall VPN Attack

An Akira attacker used a SonicWall VPN without MFA, exfiltrated data, and booted hosts in safe mode to disable EDR and Defender.

VMware vCenter Flaw Actively Exploited: 55 IPs in Germany Hit

China-linked group exploits CVE-2026-59310 in vCenter: backdoors, web shells and Babuk ransomware on ESXi. What you need to do now.

Cl0p Claims Data Theft at Philips, Shell and Around 50 Firms

The extortion group Cl0p lists nearly 50 victims, including Philips and Shell. Flaws in PTC Windchill and FlexPLM are seen as the entry point.

CVE-2026-20349: Cisco Firewall Flaw Actively Exploited for DoS

Cisco confirms active attacks on ASA and FTD: A crafted HTTP request reboots VPN appliances without login. Hotfixes are now available.

Stored XSS in Embed Google Photos album threatens WordPress up to 2.2.1

Contributors can inject JavaScript into posts via shortcode – executed for every visitor, including admins. A fix is still missing.

OpenSSL QUIC Flaw CVE-2026-14456: DoS via Memory Exhaustion

A vulnerability in OpenSSL's QUIC server lets attackers exhaust memory with Initial packets and take down listeners.

Critical vCenter Flaw CVE-2026-59310 Actively Exploited

Attackers exploit vCenter flaw CVE-2026-59310 (CVSS 9.8) – over 360 victims worldwide, Germany heavily affected.

Beacon CRM Data Breach: AWS Key Exposes 1,000+ Organizations

A compromised AWS access key led to a data leak at CRM provider Beacon — over 1,000 organizations may be affected.

Compromised axios Releases 1.14.1 and 0.30.4 Threaten npm Builds

Two tampered axios versions injected malicious code via a postinstall hook. Here's how to detect and fix the risk in your builds.

ChainDrop Worm: Self-Spreading Malware Infects 400+ npm Packages

The ChainDrop worm uses preinstall hooks and stolen npm tokens to spread itself and harvest cloud and Vault access credentials.

ICO Reprimands ACRO: Compromised CMS Endangers 10,920 People

The ICO reprimands ACRO for poor patch management and ignored warnings. An attacker had access to the website and CMS for months.