5 casos · pág. 1/1
The Rank Math PRO WordPress SEO plugin was hit by a supply chain attack. Some packages of version 3.0.123 contained malware that could let attackers take over websites once the plugin was activated. Users who downloaded or updated the plugin between October 15, 2026 20:02 UTC and October 16, 2026 07:12 UTC may be infected. Rank Math remov…
OVHcloud disclosed that an attacker used the hijacked GitHub account of one of its developers to overwrite releases of its official CLI tool with a secret-stealing binary on October 19. Versions v0.11.0 through v0.15.0 are listed as compromised, while v0.10.0 and the new v0.16.0 are clean. The malicious files appeared at 14:47 Paris time …
Between April and July 2026, the threat actor UNC7017 tampered with the AOMEI Backupper update infrastructure several times to deliver the CrossRoad downloader and the ShinyRoad modular backdoor. Each tampering window lasted only five to ten minutes before reverting to authentic files. This made the campaign hard to detect and suggests it…
ConnectWise suspended its Cloud Backup (formerly SkyKick), SaaS Security and Cloud Management services on October 17-18 after attackers abused a compromised application credential to access customers' Microsoft 365 tenants. Huntress saw the Cloud Backup identity sign in to 162 M365 tenants between October 15 and 16. By October 17 it had f…
MITRE released version 20 of its ATT&CK framework, expanding coverage of recent adversary tradecraft across the Enterprise, ICS and Mobile domains. Enterprise gains nine techniques and sub-techniques, including two prompt injection techniques (direct and indirect), abuse of an organization's own AI agents for data theft, poisoning of web …
