Latest security news

Researched & explained in plain language

What website owners should know right now

CVE-2026-42897: Laundry Bear Installs OWAReaper in Exchange OWA

Russian APT exploits XSS flaw in Outlook Web Access for OWAReaper backdoor that survives password resets. Patch available.

Cyberattack on Liechtenstein: 31,000 Records Stolen from Registry

Unknown attackers stole data of 31,000 people from Liechtenstein's register of beneficial owners. A crisis team was convened.

TrueBooker Plugin: Critical Flaw Enables Admin Takeover (CVE-2026-14545)

A critical vulnerability in the TrueBooker plugin (CVSS 9.8) lets unauthenticated attackers reset arbitrary passwords. No patch available.

npm-Katastrophe: keyv und 444 Pakete mit Shai-Hulud-Wurm infiziert

Ein selbst-propagierender Wurm kompromittierte 444 npm-Pakete mit über 2 Mrd. Installationen und stiehlt AWS-, GitHub- und npm-Credentials.

Apache Tomcat CVE-2026-34486: AI-Powered Attacks from China

CISA warns: Chinese attackers autonomously exploit CVE-2026-34486 in Apache Tomcat. Patch available – here's how to protect your servers now.

CVE-2026-34486: Encryption Bypass in Apache Tomcat Actively Exploited

CISA adds Tomcat flaw to KEV catalog: EncryptInterceptor bypassable, cluster session data at risk. Patch now to stay protected!

Backup Migration Plugin: Data Leak Threatens WordPress Sites (CVE-2023-54346)

Critical flaw in Backup Migration Plugin allows unauthenticated access to sensitive data. Patchstack warns of mass exploits—update now!

WP with Spritz: Unauthenticated LFI Flaw (CVE-2018-25329) Threatens Servers

The WordPress plugin WP with Spritz lets attackers read local files without login. No patch available – here's how to protect yourself.

SP Page Builder: Critical RCE Flaw (CVE-2026-48908) Actively Exploited

Unauthenticated file upload in Joomla SP Page Builder enables PHP execution. CISA KEV-listed, deadline overdue, exploits active in the wild.

Data Breach in Liechtenstein: 31,000 Transparency Register Entries Copied

Unknown actors copied 31,000 beneficial ownership records from Liechtenstein's VwbP register – DACH firms with foundations also affected.

Austrian Post: €13M GDPR Fine for Political Profiling Data

Austria's Supreme Court confirms Post's GDPR breaches: 2.2 million political affinity profiles sold without consent. A case spanning seven years.

Shai-Hulud: npm Worm Infects keyv and Over 430 Packages

A compromised maintainer account slipped a credential stealer into keyv & Co. – 430+ packages with 2 billion downloads affected.