Curated intelligence at the intersection of offensive security and AI — the latest items, newest first. See Top Picks for the highest-impact stories.

Friday, July 10, 2026

CRITICALInjective Labs GitHub Compromise Leads to Crypto Wallet Stealer via npmsupply-chain · cryptocurrency · malware · npmCRITICALSix New U-Boot Flaws Enable Stealthy Firmware Attacksfirmware · vulnerability · bootloader · code-executionCRITICALHackers Actively Exploiting Critical Auth Bypass in Gitea Docker Imagevulnerability · gitea · docker · authentication-bypassCRITICALUnpatched XRING Flaw in Alibaba's XQUIC Library Crashes HTTP/3 Serversvulnerability · http3 · denial-of-service · xquicCRITICALAttackers Exploit 'Ill Bloom' Vulnerability to Drain Over $5 Million from Crypto Walletscryptocurrency · vulnerability · wallet-security · randomness

Thursday, July 9, 2026

HIGHNew GigaWiper Windows Backdoor Bundles Disk Wiping, Fake Ransomware, and Spywaremalware · wiper · ransomware · windowsMEDIUMnpm 12 Disables Install Scripts by Default to Enhance Supply Chain Securitynpm · supply-chain · security-hardening · developer-toolsHIGHGodDamn Ransomware Uses PoisonX Kernel Driver to Disable Endpoint Defensesransomware · malware · byovd · endpoint-securityHIGHAI Coding Agents Vulnerable to 'Friendly Fire' Attacks, Running Malicious Codeai-security · code-execution · supply-chain · ai-agentsCRITICALGhostApproval Symlink Flaws Allow Malicious Repos to Execute Code in AI Coding Assistantsai-security · supply-chain · code-execution · ai-agents

Wednesday, July 8, 2026

CRITICALAI Coal Mine Security Camera Network Exposed by Plaintext Passwordsiot-security · critical-infrastructure · plaintext-passwords · data-breachHIGHHalluSquatting Attack Tricks AI Coding Assistants into Installing Botnet Malwareai-security · supply-chain · malware · botnetCRITICALUbiquiti Patches Critical UniFi Flaws Allowing Privilege Escalation and Command Executionvulnerability · ubiquiti · privilege-escalation · command-execution

Saturday, July 4, 2026

CRITICALJadePuffer Ransomware Uses AI Agent for Automated Attacksransomware · ai · automationCRITICALHestiaCP Admin Takeover and Remote Code Execution Vulnerabilityhestiacp · rce · vulnerabilityHIGHNorth Korean Hackers Publish Malicious Packages and Extensions in PolinRider Campaignsupply-chain · north-korea · malware

Friday, July 3, 2026

CRITICALUnpatched Flaws in FatFs Filesystem Affect Millions of Embedded Devicesembedded-devices · vulnerability · filesystemCRITICALNew 'Bad Epoll' Linux Kernel Flaw Allows Unprivileged Users to Gain Rootlinux · kernel · privilege-escalationHIGHNew Avalon Malware Framework Combines Ransomware and Data Theft Capabilitiesmalware · ransomware · phishingHIGHArmored Likho APT Targets Government and Power Sectors with BusySnake Stealerapt · cyber-espionage · malwareHIGHEuropean Parliament Member Investigating Spyware Hacked with Pegasuspegasus · spyware · state-sponsored

Thursday, July 2, 2026

HIGHFBI Disrupts NetNut Residential Proxy Network and Popa Botnetbotnet · takedown · androidHIGHAdobe ColdFusion Security Bulletin APSB26-68 Addresses Numerous Vulnerabilitiesadobe · coldfusion · vulnerability · patchHIGHConsentFix and ClickFix Attacks Hijack Microsoft 365 Accounts in Secondsmicrosoft-365 · phishing · mfa-bypassCRITICALCISA Warns of Active Exploitation of Microsoft SharePoint RCE Flawsharepoint · rce · cisa · vulnerability