GitHub and PyPI Add Time-Based Defenses Against Supply Chain Attacks
GitHub has added a 72-hour Dependabot cooldown, while PyPI now blocks new files added to releases older than 14 days.
Threats
CTM360: Insurance Phishing Kits Now Hijack Accounts in Real Time
CTM360 research exposes a phishing kit targeting insurance portals with real-time OTP interception and live session hijacking across multiple regions.
Flock License Plate Cameras: Misidentification, Tracking, and Abuse
A viral incident exposes how Flock's camera network wrongly tracked a writer using partial plate matching, while police use the system to surveil people, not ju
North Korean PolinRider Campaign Publishes 108 Malicious Packages Across Registries
North Korea's Contagious Interview campaign has published 108 malicious packages across npm, Packagist, Go, and Chrome in an active supply chain operation calle
AI Liability: Why Companies Must Own Their Agents' Actions
A German court ruled Google liable for AI search summaries, reigniting the carrier-vs-publisher debate and raising urgent questions about corporate accountabili
Tata Electronics Confirms Cyberattack as World Leaks Group Publishes Data
Tata Electronics confirmed a cyberattack on parts of its IT infrastructure. The World Leaks group leaked alleged Apple manufacturing data stolen in the incident
Cybercriminals Are the Auditors You Never Hired
Normalcy bias leads organisations to mistake silence for safety. Cybercriminals exploit that gap between perceived and actual security posture.
UNC5221 Spent 18 Months Undetected Before Deploying Three Backdoors
Chinese APT group UNC5221 used Brickstorm, Plenet, and AgentPSD to maintain access across a victim network and its MSP for over 18 months.
Your Smart TV's Idle Hours Are Selling Your Bandwidth
Free apps embed Bright Data's SDK to route web-scraping traffic through home IPs, including always-on smart TVs, with consent screens that don't match actual da
SolarWinds Serv-U Crash Flaw Now Under Active Exploitation
CISA added CVE-2026-28318, a DoS flaw in SolarWinds Serv-U, to its KEV catalog with a federal patch deadline of June 19, 2026.
AI Found 21 FFmpeg Zero-Days for $1,000. Chrome Patched 429 in One Shot.
An AI agent found 21 FFmpeg zero-days for ~$1,000. That same week, Chrome 149 patched a record 429 bugs.
900 Gas Station Gauges Are Online and Undefended
Over 900 ATG systems in the US sit exposed on the open internet, vulnerable to command execution attacks that could disable fuel leak detection.