Know what changed. Know what matters.

A malicious npm package masquerading as a Twilio bug‑bounty tool exfiltrated API keys.

A newly discovered Linux kernel flaw on ARM64 processors allows virtual machines to read and write host memory, enabling hypervisor escape.

A fake LastPass authenticator installer on GitHub uses a Windows kernel driver signed by Microsoft’s hardware‑compatibility program to shut down antivirus software before deploying a password stealer, researchers said on September 17, 2026.[thehackernews.com]

A new remote access trojan called ChainScript lures users via ClickFix‑like updates and uses the Polygon blockchain to rotate its command infrastructure, making takedowns difficult.

New research shows that mapping credential use across cloud services can prevent attackers from exploiting stolen or reused passwords before they even get a foothold.

A Mythos AI webinar revealed how quickly newly disclosed CVEs can become exploitable, exposing gaps in traditional weekly scanning practices.

Hacktron researchers used Claude Opus 5 to chain two vulnerabilities, taking over ChatGPT and Codex accounts of several OpenAI employees and accessing an internal code repository.

A June 2026 breach of a Chinese surveillance database exposed more than four billion records containing WeChat accounts and bank account numbers, raising concerns over state‑driven privacy violations.

A researcher has made public exploit code for four kernel flaws that let local users gain root access.

A new JavaScript stealer called WeaselBiscuit has been distributed through 13 npm packages to harvest data stored in Chrome extensions.

A critical heap overflow in Unbound DNS’s validator lets attackers run arbitrary code via malicious DNS zones.

In June 2025, hackers accessed a TxDOT account and stole almost 300,000 crash reports with personal data.