Malicious AGENTS.md in Downloads Folder Targeted AI Coding Agents
A planted instruction file in a developer's Downloads folder attempted to make an AI coding agent install malware-linked npm packages, researchers found.
ThreatsThreat Intelligence Feed
-
-
Node2Shell PoC Achieves RCE on Official Node.js via Brotli Bug
Imperva's Node2Shell proof of concept executes attacker code on an official Node.js 24 build via a Brotli decoder flaw. Patches were released October 21.
Guides -
Microsoft October Windows Server Updates Cause Exchange OWA and Mail Issues
Microsoft confirmed October 2026 Windows Server updates are causing OWA sign-in failures and mail delivery issues on some Exchange Server systems.
VPN & Privacy -
Hackers Abuse Compromised ConnectWise Credential to Access Customer M365 Tenants
A compromised ConnectWise Cloud Backup credential has been used to gain unauthorized access to 173 partner and customer Microsoft 365 tenants.
Guides -
PwnEscape: Critical Linux Kernel Flaw Enables VM-to-Host Memory Leak
CVE-2026-99999, dubbed PwnEscape, lets code inside a VM read host memory. Patches are available for all supported Linux stable branches.
Threats -
The Blind Spots of Agentic Pentesting and How to Close Them
Agentic pentesting is the sharpest edge of offensive security today, but it leaves critical gaps. Here's where those blind spots are and how to address them.
Tools
Analysis & Guides
Tools
What to Do When a Data Breach Notice Tells You Little
Breach notices are revealing less than ever. Here's how to interpret vague notifications and take meaningful action to protect yourself.
Guides
Three Teams Remotely Hack Pixel 10 at Pwn2Own Ireland 2026
Three research teams successfully exploited a fully patched Google Pixel 10 at Pwn2Own Ireland, winning a combined $562,500 in prizes.
Threats
ARTEX AI Pentesting Tool Weaponized Against South Korean Financial Firms
An unknown threat actor used the open-source AI pentesting tool ARTEX to breach South Korean banks. A separate actor, SCARLET LOOP, was found automating account
VPN & Privacy
Low-Cost Android Phones Ship with Firmware-Embedded Residential Proxy Malware
A malware campaign called 'Midnight Mimosa' embeds malicious code in low-cost Android firmware, enabling ad fraud and residential proxy abuse across 150+ countr
Tools
Wazza Phishkit Uses Multi-Stage Routing to Target Banking and Government
The Wazza phishkit targets banking, manufacturing, and government sectors across the US, Europe, and Australia using a multi-stage routing chain to evade detect
Tools
ShinyHunters Leader Detained in Jordan While Extorting Boeing Spinoff
A teenager suspected of leading ShinyHunters was detained in Jordan while extorting a former Boeing subsidiary, and is now cooperating with the FBI.
Tools
Fake AI Chatbot Ad Platform Uses BitB Attacks to Steal Credentials
A phishing platform impersonates AI chatbot ad products to steal credentials and MFA codes via browser-in-the-browser attacks targeting agency ad accounts.
VPN & Privacy
Windows KB5124010 Update Crashes Games and Apps Using AC-3 Audio
Microsoft confirmed KB5124010 crashes apps using AC-3 audio decoding. Legacy games, media players, and productivity apps are most affected.
Threats
OpenAI Disrupts Coordinated AI Reasoning Extraction Campaign Linked to Moonshot AI
OpenAI disrupted a coordinated distillation campaign attempting to illicitly extract protected reasoning from its AI models, attributing core activity to Moonsh