MUST READ

Daxin: 13-Year-Old China-Linked Malware Found Still Active on Manufacturer's Network

 | 

U.S. CISA adds Fortinet FortiSandbox and Microsoft SharePoint flaws to its Known Exploited Vulnerabilities catalog

 | 

Ernst & Young (EY) Investigates Data Breach Involving Third-Party Support Tickets

 | 

A cyberattack hit Nichirei, one of Japan's largest food companies

 | 

New Russian Campaign Uses Fake Webex and Zoom Installers to Deploy Starland RAT

 | 

U.S. CISA adds KNX Association KNX Protocol Connection Authorization Option 1 and Oracle flaws to its Known Exploited Vulnerabilities catalog

 | 

Two Scattered Spider Members Sentenced to Prison Over £29 Million TfL Cyberattack

 | 

TuxBot v3: The IoT Botnet Built With AI - Bugs, Disclaimers and All

 | 

Claude Code and DeepSeek Powered Chinese Cyber Espionage Campaign

 | 

Zoom Fixes CVE-2026-53412, a Critical Account Takeover Bug

 | 

Chaotic Eclipse Unveils LegacyHive Exploit Affecting Fully Patched Windows Systems

 | 

AsyncAPI npm Supply Chain Attack: Malware Injected Into Packages With 2 Million Weekly Downloads

 | 

U.S. CISA adds SonicWall and Microsoft flaws to its Known Exploited Vulnerabilities catalog

 | 

SonicWall warns of active exploitation of two SMA 1000 zero-days

 | 

Patch Tuesday security updates for July 2026, the largest update ever. 621 CVEs in one month

 | 

U.S. Treasury Sanctions VPN Provider and Cryptor Seller Behind Billions in Ransomware Losses

 | 

Attacker Used AI to Build Custom PowerShell Recon Malware

 | 

Malware Hits Japan's Largest Taxi Company Nihon Kotsu, Services Temporarily Suspended

 | 

CrashStealer: New macOS Infostealer Uses Signed Apps to Evade Gatekeeper

 | 

Lidl Notified Online Shop Customers in Germany, Belgium, and the Netherlands of a Data Breach

 | 

LATEST NEWS

VIEW ALL
Malware
Daxin: 13-Year-Old China-Linked Malware Found Still Active on Manufacturer's Network
Pierluigi Paganini July 18, 2026

Researchers found China's Daxin rootkit and a new Stupig backdoor on a Taiwan firm's network, suggesting a stealthy intrusion dating back to 2013. Symantec's Threat Hunter Team found Daxin running ...

Security
U.S. CISA adds Fortinet FortiSandbox and Microsoft SharePoint flaws to its Known Exploited Vulnerabilities catalog
Pierluigi Paganini July 18, 2026

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Fortinet FortiSandbox and Microsoft SharePoint flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and In ...

Data Breach
Ernst & Young (EY) Investigates Data Breach Involving Third-Party Support Tickets
Pierluigi Paganini July 17, 2026

Ernst & Young (EY) disclosed a data breach after attackers compromised a third-party IT support system containing client documents and tax information. Ernst & Young (EY) is disclosed a da ...

Security
A cyberattack hit Nichirei, one of Japan's largest food companies
Pierluigi Paganini July 17, 2026

A cyberattack hit one of Japan's largest food companies, Nichirei, disrupting logistics and shipments. The company is gradually restoring operations. Nichirei is one of Japan's largest food compan ...

top articles

Hackers access Booking.com user data, company secures systems
April 13, 2026
Inside ZionSiphon: politically driven malware aims at Israeli water systems
April 17, 2026
RAMP Uncovered: Anatomy of Russia’s Ransomware Marketplace
April 23, 2026
Checkmarx supply chain attack impacts Bitwarden npm distribution path
April 24, 2026
Critical CrowdStrike LogScale bug could have allowed file access, but no exploitation was observed
April 26, 2026

newsletter

Subscribe to my email list and stay
up-to-date!

most popular

VIEW ALL
Malware

Daxin: 13-Year-Old China-Linked Malware Found Still Active on Manufacturer's Network

July 18, 2026

Security
U.S. CISA adds Fortinet FortiSandbox and Microsoft SharePoint flaws to its Known Exploited Vulnerabilities catalog

July 18, 2026

Data Breach
Ernst & Young (EY) Investigates Data Breach Involving Third-Party Support Tickets

July 17, 2026

Security
A cyberattack hit Nichirei, one of Japan's largest food companies

July 17, 2026

Malware
New Russian Campaign Uses Fake Webex and Zoom Installers to Deploy Starland RAT

July 17, 2026

recent articles

Malware
Daxin: 13-Year-Old China-Linked Malware Found Still Active on Manufacturer's Network

Researchers found China's Daxin rootkit and a new Stupig backdoor on a Taiwan firm's network, suggesting a stealthy intrusion dating back to 2013. Symantec's Threat Hunter Team found Daxin running ...

Pierluigi Paganini July 18, 2026
Security
U.S. CISA adds Fortinet FortiSandbox and Microsoft SharePoint flaws to its Known Exploited Vulnerabilities catalog

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Fortinet FortiSandbox and Microsoft SharePoint flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and In ...

Pierluigi Paganini July 18, 2026
Data Breach
Ernst & Young (EY) Investigates Data Breach Involving Third-Party Support Tickets

Ernst & Young (EY) disclosed a data breach after attackers compromised a third-party IT support system containing client documents and tax information. Ernst & Young (EY) is disclosed a da ...

Pierluigi Paganini July 17, 2026
Security
A cyberattack hit Nichirei, one of Japan's largest food companies

A cyberattack hit one of Japan's largest food companies, Nichirei, disrupting logistics and shipments. The company is gradually restoring operations. Nichirei is one of Japan's largest food compan ...

Pierluigi Paganini July 17, 2026
Malware
New Russian Campaign Uses Fake Webex and Zoom Installers to Deploy Starland RAT

Russian-speaking UAT-11795 spreads trojanized Zoom, Webex, and MobaXterm installers to deliver Starland RAT and the WLDR memory-only implant. Cisco Talos researchers published a detailed technical ...

Pierluigi Paganini July 17, 2026
Security
U.S. CISA adds KNX Association KNX Protocol Connection Authorization Option 1 and Oracle flaws to its Known Exploited Vulnerabilities catalog

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds KNX Association KNX Protocol Connection Authorization Option 1 and Oracle flaws to its Known Exploited Vulnerabilities catalog. Th ...

Pierluigi Paganini July 17, 2026
Cyber Crime
Two Scattered Spider Members Sentenced to Prison Over £29 Million TfL Cyberattack

Two members of the Scattered Spider cybercrime group received jail sentences in the UK for the 2024 cyberattack on Transport for London. A UK court sentenced two Scattered Spider members, Thalha J ...

Pierluigi Paganini July 16, 2026
Artificial Intelligence
TuxBot v3: The IoT Botnet Built With AI - Bugs, Disclaimers and All

TuxBot v3, an AI-built IoT botnet for 17 architectures, shipped with LLM bugs and safety disclaimers the developer never removed. Palo Alto Networks' Unit 42 identified a previously undocumented m ...

Pierluigi Paganini July 16, 2026
Artificial Intelligence
Claude Code and DeepSeek Powered Chinese Cyber Espionage Campaign

Chinese actors used Claude Code and DeepSeek to automate attacks that breached government systems and targeted financial firms. Hunt.io researchers stumbled onto an active intrusion campaign in Ju ...

Pierluigi Paganini July 16, 2026
Security
Zoom Fixes CVE-2026-53412, a Critical Account Takeover Bug

Zoom warns of a critical Windows flaw, tracked as CVE-2026-53412, that could let attackers take over accounts without authentication. Zoom has fixed a critical Windows vulnerability, tracked as CV ...

Pierluigi Paganini July 16, 2026
Hacking
Chaotic Eclipse Unveils LegacyHive Exploit Affecting Fully Patched Windows Systems

LegacyHive PoC exposes a Windows Privilege Escalation flaw affecting fully patched Windows desktop and server systems. Just hours after Microsoft's July 2026 Patch Tuesday, security researcher Nig ...

Pierluigi Paganini July 15, 2026
Security
AsyncAPI npm Supply Chain Attack: Malware Injected Into Packages With 2 Million Weekly Downloads

AsyncAPI npm packages with 2M weekly downloads were compromised, spreading malware with info-stealing, crypto-theft and RAT capabilities. OX Security researchers disclosed on July 14 that the Asyn ...

Pierluigi Paganini July 15, 2026
Security
U.S. CISA adds SonicWall and Microsoft flaws to its Known Exploited Vulnerabilities catalog

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds SonicWall and Microsoft flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security A ...

Pierluigi Paganini July 15, 2026
Hacking
SonicWall warns of active exploitation of two SMA 1000 zero-days

SonicWall warns of active attacks exploiting two SMA 1000 zero-days, including a flaw enabling arbitrary command execution. SonicWall confirmed the active exploitation of two zero-day vulnerabilit ...

Pierluigi Paganini July 15, 2026
Security
Patch Tuesday security updates for July 2026, the largest update ever. 621 CVEs in one month

Patch Tuesday: Microsoft fixes a record 621 CVEs, including 2 exploited zero-days and critical flaws affecting SharePoint, RDP, Hyper-V, and AD FS. Microsoft's July 2026 Patch Tuesday is, by a sig ...

Pierluigi Paganini July 14, 2026
Security
U.S. Treasury Sanctions VPN Provider and Cryptor Seller Behind Billions in Ransomware Losses

U.S. sanctions hit VPN provider 1VPNS and a cryptor seller for enabling ransomware gangs behind billions in losses to critical infrastructure. The U.S. Treasury's Office of Foreign Assets Control ...

Pierluigi Paganini July 14, 2026
Hacking
Attacker Used AI to Build Custom PowerShell Recon Malware

Huntress found an AI-generated PowerShell script used for AD reconnaissance, showing attackers are using AI to create custom, evasive tools. During an incident response investigation on June 3, 20 ...

Pierluigi Paganini July 14, 2026
Cyber Crime
Malware Hits Japan's Largest Taxi Company Nihon Kotsu, Services Temporarily Suspended

Japan's largest taxi operator Nihon Kotsu shut down systems after a malware attack, disrupting dispatch and bookings. Nihon Kotsu, Japan's largest taxi company, disclosed on July 13, 2026 that it ...

Pierluigi Paganini July 14, 2026
Malware
CrashStealer: New macOS Infostealer Uses Signed Apps to Evade Gatekeeper

New macOS infostealer CrashStealer uses a signed app to bypass Gatekeeper, steals credentials and wallets, then AES-encrypts stolen data. Jamf Threat Labs first spotted CrashStealer in early May 2 ...

Pierluigi Paganini July 14, 2026
Data Breach
Lidl Notified Online Shop Customers in Germany, Belgium, and the Netherlands of a Data Breach

Lidl disclosed a third-party data breach affecting online shop customers in Germany, Belgium, and the Netherlands. Payment data was not exposed. Lidl contacted customers of its online shop in Germ ...

Pierluigi Paganini July 13, 2026