Daily News
Keyv npm Supply Chain Attack Hits 2 Billion Installs
The Keyv npm supply chain attack compromised a single GitHub maintainer account and used it to push a credential-stealing worm into hundreds of widely used caching packages. By August 5, trackers put the count at 868 packages and 1,381 versions, spanning a combined 2 billion-plus monthly installs — the largest software supply-chain incident DIESEC has…
Read MoreRuflo RufRoot CVE-2026-59726: AI Agents Hijacked
Ruflo RufRoot CVE-2026-59726, a maximum-severity CVSS 10.0 flaw disclosed by Noma Security, lets an unauthenticated attacker take full control of an AI agent platform used by an estimated one million people — through a single HTTP request against a management bridge that ships exposed to the network by default. What Happened Ruflo is an open-source…
Read MoreMicrosoft Teams Vishing Ransomware Hits in 17 Hours
A Microsoft Teams vishing ransomware campaign has hit dozens of North American organizations since February 2026, using two-minute fake IT-helpdesk phone calls to gain a foothold that, in the fastest confirmed case, ended in full Chaos ransomware encryption within 17 hours of first contact. What Happened Security vendor Sophos tracked the campaign to a financially…
Read MoreCisco Secure FMC CVE-2026-20316 Exploited
Cisco Secure FMC CVE-2026-20316 is under confirmed active exploitation: a hardcoded, low-privilege account built into every on-premises Secure Firewall Management Center gives an unauthenticated attacker a foothold — and in the same advisory cycle, Cisco quietly reactivated a five-month-old, maximum-severity root-level bypass in the same product, sharing an identical indicator of compromise. CISA added the…
Read MoreCertighost CVE-2026-54121 Active Directory Domain Takeover
Certighost CVE-2026-54121 Active Directory is a certificate-services flaw that turns any ordinary domain-user account into full control of your entire Windows domain — no admin rights, no malware, no phishing required. Microsoft patched it on July 14, 2026, but a full technical writeup and working proof-of-concept went public on July 24. If your Active Directory…
Read More