A compromised maintainer account was used to publish malicious package versions across the @antv namespace.

The post Over 320 NPM Packages Hit by Fresh Mini Shai-Hulud Supply Chain Attack appeared first on SecurityWeek.

Attackers are increasingly abusing Microsoft’s decades-old MSHTA utility to stealthily deliver stealers, loaders, and persistent malware through phishing, fake software downloads, and LOLBIN-based attack chains.

The post Legacy Windows Tool MSHTA Fuels Surge in Silent Malware Attacks appeared first on SecurityWeek.

Patched in April, the underlying vulnerability allows local attackers to elevate their privileges to root.

The post PoC Released for DirtyDecrypt Linux Kernel Vulnerability appeared first on SecurityWeek.

Rather than scanning code alone, Build Application Firewalls inspect runtime behavior inside the software build pipeline.

The post Build Application Firewalls Aim to Stop the Next Supply Chain Attack appeared first on SecurityWeek.

A malicious version of the plugin was published to the Jenkins Marketplace late last week.

The post Checkmarx Jenkins AST Plugin Compromised in Supply Chain Attack appeared first on SecurityWeek.

Also called Copy Fail 2 and tracked as CVE-2026-43284 and CVE-2026-43500, the exploit was disclosed before a patch was released.

The post New ‘Dirty Frag’ Linux Vulnerability Possibly Exploited in Attacks appeared first on SecurityWeek.

CrowdStrike has fixed a critical LogScale vulnerability, while Tenable addressed a high-severity Nessus flaw.

The post Vulnerabilities Patched in CrowdStrike, Tenable Products appeared first on SecurityWeek.

Tied to a fresh Checkmarx supply chain attack claimed by TeamPCP, the incident references the Shai-Hulud worm.

The post Bitwarden NPM Package Hit in Supply Chain Attack appeared first on SecurityWeek.

New analysis from Abnormal AI reveals how attackers have abandoned technical exploits to weaponize routine workflows and internal trust.

The post The Behavioral Shift: Why Trusted Relationships Are the Newest Attack Surface appeared first on SecurityWeek.

Google has completed its $32 billion acquisition of the cloud security giant, which will maintain its brand.

The post Wiz Joins Google Cloud as Landmark Acquisition Closes appeared first on SecurityWeek.

OpenClaw faces security vulnerabilities and misconfiguration risks despite rapid patches and its transition to an OpenAI-backed foundation.

The post OpenClaw Security Issues Continue as SecureClaw Open Source Tool Debuts appeared first on SecurityWeek.

The Series A funding round, led by Bain Capital, brings the total raised by Cogent to $53 million.

The post Cogent Security Raises $42 Million for AI-Driven Vulnerability Management appeared first on SecurityWeek.

The latest Android version continues to improve security and privacy, according to its developers.

The post Android 17 Beta Strengthens Secure-by-Default Design for Privacy and App Security appeared first on SecurityWeek.

The company will use the investment to scale operations and deepen intelligence and automation.

The post Nucleus Raises $20 Million for Exposure Management appeared first on SecurityWeek.

The startup relies on AI agents to identify software vulnerabilities and validate them before reporting.

The post Zast.AI Raises $6 Million for AI-Powered Code Security appeared first on SecurityWeek.

After a decade and a half of service, the current certificates will expire, and new ones will be rolled out.

The post Microsoft to Refresh Windows Secure Boot Certificates in June 2026 appeared first on SecurityWeek.

More than two dozen advisories have been published by the chip giants for vulnerabilities found recently in their products.

The post Chipmaker Patch Tuesday: Over 80 Vulnerabilities Addressed by Intel and AMD appeared first on SecurityWeek.

Dozens of vulnerabilities, bugs, and potential improvements have been identified by the tech giants’ security teams.

The post Google-Intel Security Audit Reveals Severe TDX Vulnerability Allowing Full Compromise appeared first on SecurityWeek.

Edge devices that are no longer supported have been targeted in attacks by state-sponsored hackers, the US says.

The post Organizations Urged to Replace Discontinued Edge Devices appeared first on SecurityWeek.

VS Code-integrated configuration files are automatically executed in Codespaces when the user opens a repository or pull request.

The post VS Code Configs Expose GitHub Codespaces to Attacks appeared first on SecurityWeek.