13 casos · pág. 1/1
Dropbox confirmed that roughly 5,000 customer accounts were accessed between 4 and 21 August after attackers abused a legacy login integration between Dropbox and Lenovo ID, Lenovo's identity system. Lenovo ID did not verify that a person registering an account actually controlled the email address used. Because Dropbox implicitly trusted…
GhostAction has returned with an expanded credential-theft operation. By October 9, 2026, attackers had injected malicious GitHub Actions workflows into 790 repositories, according to OpenSourceMalware's validated total. The campaign was first documented by GitGuardian in 2025 (817 repositories, 3,325 stolen secrets). It relies on comprom…
Researchers at Hacktron disclosed a vulnerability chain in OpenAI's ChatGPT Atlas Chromium-based AI browser that lets an attacker monitor all open tabs and capture OAuth authorization codes for any site, effectively breaking the same-origin policy. Atlas exposes Mojo IPC bindings to all .chatgpt.com and .openai.com origins, so a single XS…
Episode 487 of the Smashing Security podcast covers the hijacking of Microsoft's official X (Twitter) account, which has 13 million followers. The attackers used a Clippy theme to promote a dubious crypto coin, and a corporate apology that circulated was not from Microsoft either. There was no ransomware or data theft. The episode also co…
On July 25, 2026, Hacktron researchers chained a heap buffer overflow in libheif (reached through ImageMagick in Discourse's image-upload pipeline) with an OpenAI SSO weakness. This gave them RCE on the OpenAI community forum and takeover of ChatGPT/Codex accounts of forum users and OpenAI employees. To prove impact without reading sensit…
On August 20, 2026, a compromised release of the Rust crate arrayref (0.3.10, about 245 million all-time downloads) appeared on crates.io. It added a dependency on the typosquatted crate proc-macro1 1.0.107, whose build script downloads and runs a remote binary at compile time. The maintainer account droundy appears to have been compromis…
Aikido Security published a best-practices guide for defending against software supply chain attacks. It cites Aikido Intel data: about 7.5 million package versions analyzed in Q2 2026, with 19,500 malicious packages confirmed. The guide uses recent incidents to show which controls would have worked: the axios compromise, tj-actions/chang…
A malicious version 0.7.4 of the mrmustard photonic quantum computing library (Xanadu) was published to PyPI on July 23, 2026, after the account of the project's lead maintainer (ziofil, Filippo Miatto) was compromised. Importing the package reads SSH private keys, AWS credentials and the Kubernetes config, then sends them to an attacker-…
On 19 October 2026 an attacker used a hijacked GitHub account of an OVHcloud contributor to overwrite the download archives of five existing OVHcloud CLI releases (v0.11.0 to v0.15.0) with a build designed to steal secrets from the disk of any machine that ran it (thehackernews.com, bleepingcomputer.com). The files were live for about 94 …
This SentinelOne weekly roundup (Week 41, 2026) covers law enforcement actions, a phishing campaign and an actively exploited vulnerability. The most urgent item is CVE-2026-21589, a critical (CVSS 9.3) unauthenticated arbitrary file access flaw in Atlassian Data Center products. Exploitation attempts began about two hours after a public …
Huntress published an explainer on business email compromise (BEC), a targeted form of phishing in which attackers impersonate or take over trusted email accounts to redirect payments or steal credentials. The article cites roughly $55 billion in worldwide losses and a Huntress survey of 500+ US IT professionals, in which 36% of organizat…
F5 Labs' 2025 Advanced Persistent Bots Report analyzes more than 200 billion web and mobile API transactions from F5 Bot Defense customers between November 2023 and September 2024. It finds that 10.2% (21.22 billion) of requests were bots or automation. Of these, 4.8% were unwanted bots mitigated by F5, 3.5% were flagged automation and 2.…
ConnectWise suspended Cloud Backup (formerly SkyKick), SaaS Security and Cloud Management after unknown actors gained unauthorized access to its application identities and used them to sign in to customers' Microsoft 365 tenants. ConnectWise says it identified the incident on October 14, 2026 (thehackernews.com) and began mitigations on O…
