Portabilis i‑Diário 安全漏洞

Portabilis i-Diário is an open source school academic calendar and teacher interaction management system from Portabilis, Brazil. A security vulnerability exists in Portabilis i-Diário 1.5.0 and earlier versions, which stems from a difference in response time of the component Password Recovery...

Huawei HarmonyOS devicemanager bind authentication bypass vulnerability

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. A bind authentication bypass vulnerability exists in Huawei HarmonyOS devicemanager, which can be exploited by an attacker to compromise confidentiality...

Threat Actor Claims to Sell 15.8 Million Plain-Text PayPal Credentials

A seller named ChuckyBF is offering 15.8M PayPal logins with emails, passwords, and URLs. The data may come…...

Tenda AC20 安全漏洞

Tenda AC20 is a home router from Tenda. The Tenda AC20 suffers from a hard-coded credentials vulnerability that originates from the presence of hard-coded credentials in the file /etcro/shadow. An attacker can exploit the vulnerability to cause confidentiality to be compromised...

Buttercup 安全漏洞

Buttercup is a password manager. A security vulnerability exists in Buttercup 0.14.2 and earlier versions that stems from improper access control...

Italian hotels breached for tens of thousands of scanned IDs

The Computer Emergency Response Team CERT for Italy's "Agenzia per l’Italia Digitale" AGID issued a warning that cybercriminals are selling stolen identity documents from hotels operating in Italy. This summer, a criminal hacker group named “mydocs” infiltrated the booking systems of at least ten...

National Public Data returns after massive Social Security Number leak

Remember that data broker nobody had ever heard of, but managed to leak a database which contained the data of some 2.9 billion people? It's back, and this time with a search function. National Public Data suffered an alleged breach in 2024 against a data base that, it turned out, carried 272...

Drupal AI SEO Link Advisor 安全漏洞

Drupal AI SEO Link Advisor is an AI model calling plugin for the Drupal community. A security vulnerability exists in Drupal AI SEO Link Advisor versions prior to 1.0.6 that stems from the presence of a server-side request forgery vulnerability...

Malicious code in testmbox1 (npm)

The package testmbox1 was found to contain malicious code...

Malicious code in xuexing-yuxingzuo-volo (npm)

The package xuexing-yuxingzuo-volo was found to contain malicious code...

Malicious code in kiwi-honeydew-znpi (npm)

The package kiwi-honeydew-znpi was found to contain malicious code...

Malicious code in okta-gandul53-breki (npm)

The package okta-gandul53-breki was found to contain malicious code...

Malicious code in js-shc3 (npm)

The package js-shc3 was found to contain malicious code...

MAL-2025-29444 Malicious code in pmg (npm)

The package pmg was found to contain malicious code...

Malicious code in brook-aspen-jdw189-project (npm)

The package brook-aspen-jdw189-project was found to contain malicious code...

Malicious code in @malware-test-abear-aglet-solan-sangs/test-mlw3-abear-aglet-solan-sangs (npm)

The package @malware-test-abear-aglet-solan-sangs/test-mlw3-abear-aglet-solan-sangs was found to contain malicious code...

Malicious code in biomimicry-supercluster-apollo-mutation (npm)

The package biomimicry-supercluster-apollo-mutation was found to contain malicious code...

LLM Coding Integrity Breach

Here's an interesting story about a failure being introduced by LLM-written code. Specifically, the LLM was doing some code refactoring, and when it moved a chunk of code from one file to another it changed a "break" to a "continue." That turned an error logging statement into an infinite loop,...

IBM 2025 Cost of a Data Breach Report: Lessons for API and AI Security

IBM’s 2025 Cost of a Data Breach Report offers one of the clearest and most comprehensive views yet of how AI adoption is shaping the security landscape. While breach numbers are relatively low – only 13% of organizations reported breaches involving AI models or applications – the report reveals ...

The First Federal Cybersecurity Disaster of Trump 2.0 Has Arrived

The breach of the US Courts records system came to light more than a month after the attack was discovered. Details about what was exposed—and who’s responsible—remain unclear...