Information Security Magazine

A new version of the Shai-Hulud worm has infected hundreds of npm packages and caused disruption to global CI/CD workflows

Critical flaws in Fluent Bit threaten telemetry across platforms according to an advisory published by Oligo Security researchers

Morphisec has observed a new operation embedding StealC V2 malware in Blender project files, targeting users via 3D assets and launching a multi-stage infection chain

The US cybersecurity agency has added the critical flaw to its Known Exploited Vulnerabilities list

Spanish airline Iberia has begun emailing its customers about a supplier data breach

The International Defence Esports Games (IDEG) will help sharpen cyber and battlefield skills for allied soldiers

Researchers at BlackFrog have uncovered Matrix Push C2, a malicious command-and-control system that abuses web browser push notifications to deliver malware

Salesforce believes there has been unauthorized access to its customers’ data through the Gainsight app’s connection to its platform

A multi-year ATM fraud campaign by UNC2891 targeted two Indonesian banks, cloning cards, recruiting money mules and coordinating cash withdrawals

CISA launches guide to combat cybercrime via bulletproof hosting, recommending measures for ISPs

Despite a growing maturity of third-party risk management programs, supply chain attacks impacted more organizations in 2025 than in previous years

Gartner predicts that two-fifths of organizations will suffer security and compliance incidents due to shadow AI by 2030

Allies sanction bulletproof hoster Media Land and four executives

Europe-wide Cyber-Patrol Week targeted IP violations, flagging 69 sites and disrupting $55m in crypto services

Trustwave SpiderLabs has observed new banking Trojan Eternidade Stealer targeting Brazil using WhatsApp for propagation and data theft

The cyber espionage group uses a previously undocumented network implant to drop two downloaders, LittleDaemon and DaemonLogistics, which deliver a backdoor

SecurityScorecard has revealed a new Chinese campaign targeting thousands of ASUS routers globally

Beazley Security data finds the top cause of initial access for ransomware in Q3 was compromised VPN credentials

One US cybersecurity leader described the short-term extension of the Cybersecurity Information Sharing Act as a “temporary patch” and called for a long-term solution

A new malware campaign has been observed built on seven npm packages and using cloaking techniques and fake CAPTCHAs, operated by threat actor dino_reborn