Information Security News

CIA Deputy Director Michael Ellis says the agency will embed generative AI "co-workers" inside every analytic platform within two years. The CIA ran 300 AI projects in 2025 and recently produced its first AI-generated intelligence report. Ellis warned the agency …

A certificate validation bypass in wolfSSL's OpenSSL compatibility layer lets anyone holding a free Let's Encrypt cert forge a TLS chain for any domain. CVE-2026-5501 (CVSS 4.0 score 8.6) affects nginx and haproxy builds linked against wolfSSL. Patched in 5.9.1, …

FBI testimony in the Prairieland federal trial revealed that incoming Signal messages were recovered from an iPhone notification database after the app was deleted. The fix is one in-Signal setting, not what is circulating on Twitter.

WordPress vulnerability digest for April 8–9: 17 new CVEs, with one CVSS 9.8 critical that turns a GDPR compliance helper into an unauthenticated RCE primitive. The DSGVO Google Web Fonts GDPR plugin has no patched version and should be removed …

Bitcoin Depot disclosed in an SEC 8-K that 50.9 BTC worth $3.665 million was stolen from its corporate settlement wallets after credential compromise. Within 24 hours, on-chain investigator ZachXBT placed the actual outflow on March 20, three days before the …

ShinyHunters has publicly disavowed the operators behind every recent BreachForums reboot, calling the aliases N/A and Indra false personas. Resecurity flagged the January user database as likely disinformation. No publicly verified admin identity exists six months after the FBI seizure.

One North Korea-linked threat cluster now publishes malicious packages across npm, PyPI, Go Modules, crates.io, and Packagist in parallel, reusing the same staging infrastructure and loader patterns. Socket has tracked more than 1,700 packages tied to the broader Contagious Interview …

Ten high-impact npm maintainers, including the engineers behind Fastify, Lodash, dotenv, and Express, were approached using the same playbook that compromised Axios. Tay attributes the campaign to UNC1069, the DPRK-nexus group that spent eight years perfecting fake interviews against crypto …

A single false parameter passed to .NET's Response.Redirect() kept the admin panel rendering after a redirect. watchTowr chained it to RCE on 30,000 internet-facing ShareFile servers. Patched March 10, disclosed April 2.

CERT-EU traced the European Commission's cloud breach to a poisoned Trivy build pushed by TeamPCP on March 19. AI startup Mercor confirmed a separate hit via LiteLLM. ShinyHunters and Lapsus$ are now publishing stolen data from both victims.

The quietest day of the month still delivered a pattern worth tracking. MLflow picked up its fourth authentication or input validation flaw in six weeks. pymetasploit3 got a CVSS 9.3 command injection in its core module execution function.

A zero-day in TrueConf's update mechanism let a China-linked actor distribute Havoc C2 implants to dozens of Southeast Asian government agencies through a single compromised server. CVE-2026-3502 (CVSS 7.8) required no signature bypass because there was no signature check. Patched …

A fake token worth a few thousand dollars turned into a $285 million drain on Drift Protocol in 12 minutes. Attackers hijacked governance through durable nonces and social engineering. TRM Labs and Elliptic point to North Korea.

An updated SparkCat variant hides inside App Store and Google Play apps, scanning photo galleries with OCR for crypto wallet seed phrases. Kaspersky found two infected iOS apps and one on Android, primarily targeting Asia. The malware is actively maintained …

165 new CVEs on April 2 include a pre-auth RCE chain in Progress ShareFile with 30,000 exposed instances and a CVSS 10.0 SSRF in FastMCP. TP-Link Tapo camera, Convoy KVM, and WordPress plugin flaws round out the batch.