Rogue external MFA providers can steal passwords during logins
Varonis Threat Labs demonstrated TrustSink, a post-compromise technique in which an attacker controlling a highly privileged Microsoft Entra account registers a rogue external MFA…
Bleeping Computer
6 articles
Sweden fines Miljödata $183,000 over breach affecting 2.2 million
Sweden’s privacy regulator IMY fined IT systems provider Miljödata SEK 1.8 million ($183,000) after finding inadequate security measures contributed to an August 2025 cyberattack…
BigCommerce alerts merchants of data breach linked to Ribon apps
BigCommerce disclosed that compromised credentials for the third-party Ribon and Ribon 1.5 applications were used to inject malicious scripts into a small number of merchant store…
CISA alerts of active exploitation of three Linux kernel flaws
CISA warned that three Linux kernel vulnerabilities are being actively exploited, including CVE-2025-39964, which is rated critical and existed in the kernel for 14 years. Federal…
Malicious npm packages evade install-script defenses at runtime
Checkmarx identified an ongoing npm supply-chain malware campaign centered on the malicious "indexed-btree" package, which impersonates "sorted-btree" and evades install-script pr…
Researchers escape OpenAI Codex sandbox to run commands on host
Researchers reported two sandbox-escape flaws in OpenAI Codex that could allow untrusted repository content or agent actions to execute commands outside Codex's sandbox. Accomplis…