cyber.hendryadrian.com is a cybersecurity news and threat intelligence aggregation platform. It collects external cybersecurity reporting and turns it into structured information that is easier to search, correlate, and explore.
Aikido and SafeDep report that stolen GitHub credentials were used to plant a CI secret stealer in thousands of repositories. The stealer could collect workflow and cloud credentials; Aikido says credentials were likely collected where it ran.
Huntress observed rogue ScreenConnect clients deployed across at least 288 endpoints in 48 organizations. Researchers detailed SCKit’s components and a reconstructed spread path, but the initial access method and successful lateral spread remain unconfirmed.
Researcher Luke Wilkinson says a fake Quant AI installer promoted by a verified YouTube channel deploys hidden, persistent NetSupport Manager via PowerShell. He analyzed but did not run the payload and saw no live session; affected users are advised to check for the app
N-able released patches for several N-central flaws disclosed with proof-of-concept code. The company says unauthenticated vulnerabilities are fixed, scanning is underway, and it has seen no indications of compromise on hosted servers.
CVE-2026-118383 lets unauthenticated clients send two requests that can trigger a crash when a lagging MongoDB replica-set member wins failover. MongoDB released fixes; researchers did not achieve code execution in their lab.
Red Hat says CVE-2026-123710 can let unauthenticated attackers take over Quay registry token signing, access or overwrite repositories, and persist malicious signing keys. The advisory gives no fixed version.
Analysis of anonymized telemetry from over 1.8 million business computers found widespread outdated and unsupported apps. Of Windows PCs with update data, 22.1% had third-party security updates overdue by 30+ days; most addressed known-exploited flaws.
Recorded Future analyzed 103 AI-enabled incidents from July 2025 to July 2026. The report finds AI mainly accelerates familiar attacks, while fully autonomous operations remain rare; AI developer tools are a prominent target.
Wiz says its Cyber Model Arena v3.9 tested 59 agent configurations across 327 cybersecurity challenges, finding performance varied by task type and model-harness pairing. The post explains its grading approach, isolation measures and limitations.
PrivacyAffairs reports that Humble Bundle’s relaunched site no longer offers a second login step: password, emailed code and Google sign-in are alternatives. The author verified password-only access; Humble has not publicly commented.
Japan approved ¥10 billion ($63 million) for cybersecurity measures, including public-private response teams, stronger investigations and victim support. Reported incidents are rising, but TrendAI has not established a firm link to attackers’ use of AI.
A NetAskari report based on leaked documents says China's Overseas Chinese Affairs Big Data Platform scrapes public data to map diaspora networks and identify people for influence efforts, including figures in Taiwan's semiconductor industry. The documents date to 2021.
Maersk confirmed data was extracted from an isolated IT system inherited through an acquisition. WhiteArmor claims it stole sensitive data and demands $5 million, but its involvement and claims remain unverified.
An actor using the handle Chimera claims to have leaked a dataset associated with ARTE[.]TV containing 673,760 records. The listing’s contents, figures, source and availability remain unverified.
Vanderbilt is restoring systems after a cyberattack claimed by BYOD. The group alleges it stole sensitive data, but the university has not confirmed what data, if any, was accessed; some systems remain restricted.
