Daily
The Press Corner
A short résumé of each security publication from the daily scan, with the topic and a link to the original. The scan runs every day at 01:15 UTC. If that run misses, the next hourly pass picks it up. Last scan Oct 23, 2026.
46–60 of 239
Google Attributes Axios npm Supply Chain Attack to North Korean Group UNC1069
Google links Axios npm supply chain attack to UNC1069 after trojanized versions 1.14.1 and 0.30.4 spread WAVESHAPER.V2, impacting multiple OS.
- Source
- The Hacker News
36 Malicious npm Packages Exploited Redis, PostgreSQL to Deploy Persistent Implants
36 npm packages disguised as Strapi plugins exploit Redis and PostgreSQL via postinstall scripts, enabling persistent access and data theft.
- Source
- The Hacker News
Three China-Linked Clusters Target Southeast Asian Government in 2025 Cyber Campaign
Three China-linked clusters targeted a Southeast Asian government in 2025, deploying multiple malware families to secure persistent access.
- Source
- The Hacker News
Hackers Exploit CVE-2025-32975 (CVSS 10.0) to Hijack Unpatched Quest KACE SMA Systems
CVE-2025-32975 exploited since March 2026 on unpatched KACE SMA systems, enabling admin takeover and payload delivery.
- Source
- The Hacker News
FBI Warns Russian Hackers Target Signal, WhatsApp in Mass Phishing Attacks
Russian-linked phishing hits thousands of messaging accounts via fake support tactics, enabling impersonation and data access.
- Source
- The Hacker News
Android 17 Blocks Non-Accessibility Apps from Accessibility API to Prevent Malware Abuse
Android 17 blocks non-accessibility apps from the Accessibility API in Advanced Protection Mode, reducing malware abuse and the attack surface.
- Source
- The Hacker News
Threat Actors Mass-Scan Salesforce Experience Cloud via Modified AuraInspector Tool
Modified AuraInspector scans misconfigured Salesforce Experience Cloud sites, extracting CRM data and enabling targeted vishing campaigns.
- Source
- The Hacker News
Cisco Confirms Active Exploitation of Two Catalyst SD-WAN Manager Vulnerabilities
Cisco warns CVE-2026-20122 and CVE-2026-20128 in Catalyst SD-WAN Manager are actively exploited; patches released across multiple software versions.
- Source
- The Hacker News
Iran-Linked MuddyWater Hackers Target U.S. Networks With New Dindoor Backdoor
Iran-linked MuddyWater hackers breached U.S. networks with new Dindoor malware as regional cyber attacks escalate amid Middle East conflict.
- Source
- The Hacker News
APT28 Tied to CVE-2026-21513 MSHTML 0-Day Exploited Before Feb 2026 Patch Tuesday
APT28 exploited CVE-2026-21513, an MSHTML zero-day (CVSS 8.8), using malicious LNK files to bypass security controls and execute code.
- Source
- The Hacker News
PromptSpy Android Malware Abuses Gemini AI to Automate Recent-Apps Persistence
PromptSpy Android malware abuses Google Gemini to analyze screens, automate persistence, block removal, and enable VNC-based remote device control.
- Source
- The Hacker News
Researchers Observe In-the-Wild Exploitation of BeyondTrust CVSS 9.9 Vulnerability
Active exploitation of BeyondTrust enables unauthenticated RCE as CISA adds Apple, Microsoft, SolarWinds, and Notepad++ flaws to KEV list.
- Source
- The Hacker News
New Chrome Zero-Day (CVE-2026-2441) Under Active Attack — Patch Released
Google fixes actively exploited Chrome zero-day CVE-2026-2441, a high-severity CSS use-after-free flaw enabling sandboxed remote code execution.
- Source
- The Hacker News
Microsoft Discloses DNS-Based ClickFix Attack Using Nslookup for Malware Staging
Microsoft details a new ClickFix variant abusing DNS nslookup commands to stage malware, enabling stealthy payload delivery and RAT deployment.
- Source
- The Hacker News
TeamPCP Worm Exploits Cloud Infrastructure to Build Criminal Infrastructure
Worm-driven TeamPCP campaign exploits Docker, Kubernetes, Redis, Ray, and React2Shell to build proxy infrastructure for data theft and ransomware.
- Source
- The Hacker News