CyberNews

A malicious npm package has been discovered posing as a Twilio bug-bounty probe, allowing attackers to exfiltrate sensitive credentials from unsuspecting developers. This latest threat highlights the ongoing risks of supply chain attacks and underscores the importance of exercising caution when installing third-party libraries. The compromised package, which we’ll refer to as “Twilio-Proxy,” was masquerading … Read more

Critical WordPress Flaw Patched, but What Does it Mean for Your Site’s Security? A critical vulnerability in the popular content management system (CMS) WordPress has been patched by its developers. The flaw, identified as CVE-2026-1234, could have enabled malicious actors to execute arbitrary code on vulnerable servers, potentially leading to data breaches and other security … Read more

A Zero-Day Exploit in Check Point’s Management Servers Compromises High-Security Networks A targeted attack on high-security networks has been uncovered, exploiting a previously unknown vulnerability in Check Point’s management servers. The severity of this incident lies not only in the fact that it represents a zero-day exploit but also in its potential to compromise even … Read more

A Critical Flaw in Bifrost AI Gateway Exposes Organizations to Privilege Escalation Attacks A severe vulnerability has been discovered in the Bifrost AI gateway, a critical component of many organizations’ security infrastructure. The flaw allows attackers to bypass authentication and run arbitrary commands on the system, effectively granting them administrative privileges. This critical weakness puts … Read more

Microsoft has dealt a significant blow to cybercrime by taking down EvilTokens, a notorious device-code phishing service that compromised over 12,000 email inboxes. This operation was not only a major victory for the tech giant but also a stark reminder of the ongoing threat posed by sophisticated phishing tactics. EvilTokens worked by exploiting vulnerabilities in … Read more

**Malicious npm Package Tricks Developers into Exposing Credentials** A malicious package on the popular Node.js package manager npm has been discovered posing as a bug-bounty probe from Twilio, a leading cloud communication platform. The package, which was available for download until recently, can secretly exfiltrate sensitive credentials from unsuspecting developers’ systems, potentially leading to a … Read more

WordPress Issues Patch for Critical Flaw That Can Enable Code Execution on Some Servers A critical security vulnerability has been discovered in WordPress, allowing attackers to execute malicious code on affected servers. The issue, identified as a “cross-domain privilege escalation” flaw, affects users who have enabled cross-site scripting (XSS) protection in their web application firewall … Read more

A Zero-Day Vulnerability in Check Point’s Management Servers Exposes Organizations to Targeted Attacks Check Point, a leading cybersecurity vendor, has issued a warning about a previously unknown vulnerability in its management server software. The zero-day exploit, which allows attackers to gain unauthorized access to sensitive systems, has already been used in targeted attacks against several … Read more

D-Link Warns of Maximum-Security Flaw in DIR-822A Routers, Exposing Millions to Remote Attacks D-Link has issued a critical warning about a maximum-severity vulnerability affecting its legacy DIR-822A dual-band Wi-Fi routers. The security flaw, identified as CVE-2026-86296, can be exploited without authentication or user interaction, allowing attackers to potentially crash the device’s DHCP daemon or execute … Read more

Google Workspace Breaches Reveal a Sobering Truth: Trust and Authorization Can Be Exploited with Ease Tomorrow, CyberNews.work will host a live webinar that sheds light on real-world Google Workspace breaches, exposing the vulnerabilities that allowed attackers to gain access to sensitive data. What’s surprising is not the sophistication of the attacks, but rather how easily … Read more