Chrome zero-day attacks, router hijacks, Coder’s supply chain breach, image-free QR phishing, and more security news.

JSCeal can steal browser credentials, replay Google sessions using stolen cookies, and modify traffic for cryptocurrency ...

ScreenConnect abuse shows worm-like propagation of a four-stage VBScript chain; ConnectWise advises disabling file transfers ...

PEEP is described as a post-compromise framework as it lacks an initial access vector itself, meaning it requires the ...

TantoSec's Telerik UI PoC demonstrates unauthenticated RCE under specific non-default conditions; fixes shipped in July.

N-able patches a critical N-central flaw that could allow unauthenticated remote code execution, but its exploitation ...

AI-native SIEM can cut attacker dwell time by connecting signals, prioritizing alerts, and speeding investigations and containment.

Intruder analyzed 3,000 organizations, finding exposed services in 76% of AWS accounts versus 8% on Google Cloud.

Four persistent programs linked to REVSTEALER can steal wallet data, proxy attacker traffic, and mine cryptocurrency.

Bitdefender says 55.2% of breached IT and security professionals were asked to keep reportable incidents confidential.

Identity sprawl, privilege creep, and shadow admin rights expand attack surfaces across Active Directory and Entra ID.

Attackers exploited CVE-2026-63077 to breach JetBrains Cadence, accessing a 2024 backup containing credentials and user data.