Attackers are increasingly abusing Microsoft’s decades-old MSHTA utility to stealthily deliver stealers, loaders, and persistent malware through phishing, fake software downloads, and LOLBIN-based attack chains.

The post Legacy Windows Tool MSHTA Fuels Surge in Silent Malware Attacks appeared first on SecurityWeek.

The security defect can be exploited remotely, without authentication, to execute arbitrary code and leak sensitive information.

The post Unpatched ChromaDB Vulnerability Can Lead to Server Takeover appeared first on SecurityWeek.

The stolen credit card data was released as a free download, allegedly in response to seller misconduct.

The post B1ack’s Stash Marketplace Gives Away 4.6 Million Stolen Credit Cards appeared first on SecurityWeek.

The organizations best prepared to face disruption are those that align security, continuity and risk management around what the business cannot afford to lose.

The post Cyber Resilience is the New Business Continuity Plan appeared first on SecurityWeek.

The 13-country effort, named Operation Ramz, targeted cyber threats in the Middle East and North Africa region.

The post 201 Arrested in Crackdown on Cybercrime in Middle East, North Africa appeared first on SecurityWeek.

Patched in April, the underlying vulnerability allows local attackers to elevate their privileges to root.

The post PoC Released for DirtyDecrypt Linux Kernel Vulnerability appeared first on SecurityWeek.

The vulnerability, CVE-2026-8153, affects Universal Robots PolyScope 5 and it can be exploited for OS command injection. 

The post Critical Vulnerability Exposes Industrial Robot Fleets to Hacking appeared first on SecurityWeek.

Several healthcare data breaches impacting hundreds of thousands and even millions were added to the HHS tracker.

The post Millions Impacted Across Several US Healthcare Data Breaches appeared first on SecurityWeek.

Four vulnerabilities in OpenClaw can be chained together to steal credentials, escape the sandbox, and plant persistent backdoors.

The post ‘Claw Chain’ OpenClaw Flaws Allow Sandbox Escape, Backdoor Delivery appeared first on SecurityWeek.

The hackers claimed to have stolen more than 600,000 Salesforce records, including personal information and corporate data. 

The post 7-Eleven Data Breach Confirmed After ShinyHunters Ransom Demand appeared first on SecurityWeek.

The researcher dropped the MiniPlasma exploit that uses the original proof-of-concept (PoC) code targeting the bug.

The post Researcher Drops MiniPlasma Windows Exploit for Unpatched 2020 CVE appeared first on SecurityWeek.

At least one threat actor has adopted the recently released malware source code in attacks against NPM developers.

The post First Shai-Hulud Worm Clones Emerge appeared first on SecurityWeek.

Grafana appears to have been targeted by Coinbase Cartel, a cybercrime group linked to ShinyHunters, Scattered Spider, and Lapsus$.

The post Grafana Confirms Breach After Hackers Claim They Stole Data appeared first on SecurityWeek.

The flaw leads to denial-of-service on default configurations and to remote code execution if ASLR is disabled.

The post Exploitation of Critical NGINX Vulnerability Begins appeared first on SecurityWeek.

Participants demonstrated exploits for Windows, Linux, VMware, Nvidia, and AI products.

The post Hackers Earn $1.3 Million at Pwn2Own Berlin 2026  appeared first on SecurityWeek.

Introduced in 2008, the critical-severity security defect was patched this week in NGINX Plus and NGINX open source.

The post PoC Code Published for Critical NGINX Vulnerability appeared first on SecurityWeek.