Blog & Resources
Security awareness tips, phishing prevention guides, and best practices.
Malicious B-tree NPM Package Accumulates Millions of Downloads
Posing as the legitimate sorted-btree package, indexed-btree hides a malware trigger in its prototype method.
WordPress Comment2Shell Flaw Can Turn Anonymous Comment XSS Into RCE via Admin Session
A new flaw in WordPress core let an anonymous visitor leave a comment that planted a hidden script on the page. If a logged-in administrator later opened that page, the script could run code on the site's server. WordPress fixed the flaw, tracked as CVE-2026-93485 and dubbed "Comment2Shel
unidentified ransomware Extension .1sl7EEcfl (Lockbit 3.0 Black)
unidentified ransomware Extension .1sl7EEcfl (Lockbit 3.0 Black) - posted in Ransomware Help & Tech Support: Hi BleepingComputer Malware Analysts, I am requesting assistance in identifying and analyzing a potential new/custom ransomware variant that encrypte
Unidentified Ransomware Extension .1sl7EEcfl - Header Encrypted Sample Analysis
Hi BleepingComputer Malware Analysts, I am requesting assistance in identifying and analyzing a potential new/custom ransomware variant that encrypted files on two Windows machines. Neither ID Ranso
Don’t be fooled by this summer of AI hype
It’s been a busy few months for AI hype. At the end of April, Anthropic claimed that its model Claude Mythos is better at finding software vulnerabilities than most security experts. Then we had the OpenAI–Hugging Face hacking incident, after which Anthropic
GPT-6 Astra Breaks an Old Enigma Message
This is pretty amazing: However, the most astonishing thing about this break is that the GPT6 Astra did it entirely on its own. Carter Leffer only directed GPT6 Astra to see if it could break any of the unbroken Enigma messages published on the Crypto Cellar Research web page. After analysing the
Zyxel and Veeam Flaws Under Active Exploitation With Command and SYSTEM Access
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a now-patched security flaw impacting Zyxel GS1900 series switches to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerability, tracked as CVE-2026-7273 (CVSS score:
Exclusive: CoreWeave launches Remote Key Encryption to keep customer keys off its cloud
Artificial intelligence cloud provider CoreWeave Inc. today unveiled Remote Key Encryption, a service that encrypts customer data sitting on its infrastructure with keys the company itself never holds. The service takes aim at the key-custody problem that kee
AI Sovereignty: Bargaining with Big Tech and the Promise of Full Stack Open Source AI
The early rapid expansion of AI capabilities that focused on frontier models was largely ushered into the world by a few powerful, US-based AI labs. Open-weight models released from labs in China, early on from DeepSeek, and later from Moonshot, Z.ai, and oth
EvilTokens PhaaS disrupted after compromising 12,000 Microsoft accounts
The EvilTokens platform that compromised more than 12,000 Microsoft accounts at over 10,000 organizations has been disrupted in an effort led by Microsoft's Digital Crimes Unit (DCU).
Googlebooks will live or die on the loyalty of a billion Android users
Good morning. Today I’m bumping to Carly Rae Jepsen’s new double album (it’s great!), wishing I had more kidneys so I could afford the new M5 Ultra Mac Studio, marveling at Astra’s ability to decrypt 100-year-old WWI cyphers, and counting down the days until
Meta’s Muse AI assistant has a zero-day that can turn it into a Mac backdoor
Mac security researcher Patrick Wardle says its trivial to turn Muse into the ultimate backdoor. Increasingly, AI assistants are changing from tools that simply answer questions into agents that can