Latest headlines from security outlets
Collected every two hours from specialised publications — each link leads to the original article.
Significant Security Update for Rocky Linux Kernel Addresses Multiple CVEs
An important kernel update for Rocky Linux SIG Cloud 9 addresses multiple security vulnerabilities and includes bug fixes and enhancements, improving system pe…
Installed Is Not Remediated: How to Verify Linux Security Patches in Production
There are several reasons why Linux has such a good reputation and has become such a good standard across the world. It is the power behind most internet serve…
Chaos Ransomware’s msaRAT Hides Its C2 Inside Your Own Browser
Cisco Talos has detailed msaRAT, a Rust-based RAT used by the Chaos ransomware crew that drives a headless Chrome or Edge session over CDP to smuggle C2 traffi…
Kubernetes Storage Flaws Expose a Dangerous Security Blind Spot
Two newly fixed storage bugs in Kubernetes showed more than just a problem with path traversal. They found a common security flaw in the cloud: powerful parts …
Ubuntu 26.04 LTS Kernel Critical Privilege Escalation Issues USN-8593-1
Ubuntu 26.04 LTS addresses multiple vulnerabilities in the Linux kernel affecting IBM and Oracle Cloud systems, requiring users to update and possibly recompil…
Cursor Flaw Lets Malicious Cloned Repositories Trigger Windows Code Execution
Open a repository in Cursor on Windows and, if a file named git.exe is sitting in the project root, Cursor runs it. No click, no approval dialog, no warning th…
GhostApproval Symlink Flaws Could Let Malicious Repos Run Code in AI Coding Agents
Researchers at Wiz found that a flaw in six popular AI coding assistants lets a booby-trapped code project quietly take control of a developer's computer. The …
Inside Android’s New Lockscreen Rate-Limiting Rules
Google has replaced Android's 1,800-guess lockscreen limit with a 20-attempt hard cap. Here is how the new rate limiter works and what it means for anyone test…
North Korean Hackers Publish 108 Malicious Packages and Extensions in PolinRider Campaign
The North Korean threat actors linked to the Contagious Interview campaign have been observed publishing 108 unique packages and web browser extensions spannin…
Malicious Perplexity Chrome Extension Intercepted Searches and Address Bar Input
Microsoft has found a malicious Chrome extension that posed as the AI search engine Perplexity and quietly logged what people searched for. It routed every que…
Linux Foundation Launches Akrites to Strengthen Software Supply Chain Security
The Linux Foundation has officially launched Akrites, a coordinated industry initiative designed to improve how critical open source vulnerabilities are valida…
Amazon Q Developer Flaw Could Let Malicious Repos Run Code via MCP Configs
A high-severity flaw in Amazon Q Developer let a malicious repository run commands and steal a developer's cloud credentials. The path was short: a developer o…
Europe’s Open Source Strategy Takes Aim at Software Security’s Maintenance Problem
Some of the software the world depends on most is maintained by people most users will never know by name. The project might be sitting inside Linux distributi…
New Rokarolla Android Malware Steals PINs, SMS Codes, and Crypto Wallet Funds
Security researchers at Zimperium's zLabs have documented a new Android banking trojan, Rokarolla, that targets 217 banking and cryptocurrency apps and packs 1…
Ivanti, Fortinet, and SAP Release Patches for Multiple Critical Vulnerabilities
Fortinet, Ivanti, and SAP have released security updates to address multiple critical security vulnerabilities that could result in arbitrary code execution an…
Actively Exploited Chromium V8 Zero-Day: What Linux Admins Need to Know
CISA added CVE-2026-11645 to its Known Exploited Vulnerabilities catalog after Google confirmed active exploitation of the flaw. The bug sits in V8, the JavaSc…
Miasma Supply Chain Attack Compromises Red Hat npm Packages with Credential-Stealing Worm
A new Mini Shai-Hulud supply chain attack campaign, codenamed Miasma, has compromised @redhat-cloud-services packages to steal credentials and secrets from dev…
GlassWorm Malware Takedown Disrupts Developer Supply Chain Attack Infrastructure
CrowdStrike, in partnership with Google and the Shadowserver Foundation, has announced the simultaneous disruption of all command-and-control (C2) channels ass…
When Identity is the Attack Path
Consider a cached access key on a single Windows machine. It got there the way most cached credentials do - a user logged in, and the key stored itself automat…
Why Runtime Monitoring Is Replacing Traditional Linux Logging
The problem is not necessarily a lack of security tools. Modern Linux infrastructure changes so quickly that maintaining consistent visibility has become one o…
Why Linux Servers Get Hacked More Often Than People Think
Linux runs a massive part of the internet. Cloud platforms, databases, containers, web hosting, APIs, and internal business infrastructure all depend heavily o…
Linux Attackers Abuse Admin Tools For Stealthy Intrusions
A lot of Linux attacks now look like normal admin activity. Attackers use SSH , cron , curl , systemd , cloud scripts, and other trusted tools that defenders a…
The Back Door Attackers Know About — and Most Security Teams Still Haven’t Closed
Every AI tool, workflow automation, and productivity app your employees connected to Google or Microsoft this year left something behind: a persistent OAuth to…
SAP-Related npm Packages Compromised in Credential-Stealing Supply Chain Attack
Cybersecurity researchers are sounding the alarm about a new supply chain attack campaign targeting SAP-related npm Packages with credential-stealing malware.A…