Over Security

ChromaDB FastAPI vulnerability CVE-2026-45829 (ChromaToast) enables pre-auth RCE via HuggingFace models; affects v1.0.0–1.5.8; high exposure risk now.

GitHub has confirmed that roughly 3,800 internal repositories were breached after one of its employees installed a malicious VS Code extension.

Microsoft has shared mitigations for YellowKey, a recently disclosed Windows BitLocker zero-day vulnerability that grants access to protected drives.

The Chanhassen Dinner Theatres cyberattack and illness outbreak forced “Guys and Dolls” cancellations and disrupted operations.

Dal classico furto di dati all’uso improprio dell’IA: i dati di Arctic Wolf mostrano perché la sicurezza non è solo una questione tecnologica, ma culturale. C'è una marcata disconnessione tra percezione e realtà del rischio

An increasing number of data brokers active in Chinese-speaking dark web forums and Telegram channels are advertising large volumes of purportedly stolen data from organizations worldwide. But are they credible?

The telecom sector launches a private ISAC to strengthen cyber intelligence sharing against AI-powered cyberattacks and espionage.

Non-consensual intimate images are under scrutiny as Ofcom pushes tougher rules to curb deepfake abuse and force faster content removal online.

Dubai Police noted that travel booking fraud incidents typically rise during summer vacations and festive travel periods.

GitHub is investigating a breach of its internal repositories after the TeamPCP hacker group claimed to have accessed approximately 4,000 repositories containing private code.

A max-severity vulnerability in the latest Python FastAPI version of the ChromaDB project allows unauthenticated attackers to run arbitrary code on exposed servers.

Microsoft says it has disrupted a malware-signing-as-a-service (MSaaS) operation that abused the company's Artifact Signing service to generate fraudulent code-signing certificates used by ransomware gangs and other cybercriminals.

The monthly AI Threat Report examines how threat actors are using artificial intelligence in real-world illicit environments, drawing on Flashpoint's primary source intelligence.

Discord announced that all voice and video calls through the communication platform are now protected by default with end-to-end encryption (E2EE).

La tragedia dell’11 settembre 2001 ha insegnato al mondo IT una lezione fondamentale sulla posizione dei dati: la distanza geografica deve essere reale, non apparente. Ecco come implementare strategie di backup e di business continuity che proteggano realmente l'organizzazione

The FBI says Americans have lost over $388 million last year to scams using cryptocurrency kiosks, also known as crypto ATMs or Bitcoin ATMs.

A threat actor targeting Microsoft 365 and Azure production environments is stealing data in attacks that abuse legitimate applications and administration features.

A major software supply chain attack has compromised hundreds of widely used npm packages tied to the AntV ecosystem, exposing developers and organizations to

Microsoft plans to raise the quality bar of Windows 11 drivers, as drivers "sit at the heart of every Windows experience" and connect the OS to the "silicon, components, and peripherals."

The attacks are part of a wider campaign known as Mini Shai-Hulud, which has already compromised several open source projects and, in turn, developers and companies that use them.

Andrej Karpathy has joined Anthropic to work on pre-training. He previously co-founded and worked at OpenAI and led computer vision and AI at Tesla.

Microsoft has confirmed user reports that the Teams team collaboration app is displaying non-dismissible location prompts on some macOS systems.

Cisco Talos’ Vulnerability Discovery & Research team recently disclosed eight vulnerabilities in TP-Link, and one each in Adobe Photoshop, OpenVPN, and Gen Digital's Norton VPN. The vulnerabilities mentioned in this blog post have been patched by their respective vendors, in adherence to Cisco’s third-party vulnerability disclosure policy, except the Norton VPN vulnerability, which was discovered in-use before a patch was available.  For Snort coverage that can detect the exploitation of these

È stata identificata una nuova campagna malware che sta prendendo di mira sia utenti macOS sia utenti Windows con il trojan JobStealer nascosto in piattaforme fraudolente che imitano servizi professionali utilizzati per colloqui di lavoro da remoto. L’obiettivo è rubare dati personali. Tutti i dettagli

Microsoft ha annunciato il takedown di Fox Tempest, gruppo di cyber criminali che offriva un servizio malware signing as a service capace di fare apparire come legittimi dei software malevoli

Threat actors earlier today published more than 600 malicious packages to the Node Package Manager (npm) index as part of a new Shai-Hulud supply-chain campaign.

Microsoft's total vulnerability count stayed steady in 2025, but critical flaws surged year over year. BeyondTrust breaks down why attackers are increasingly focused on privilege escalation and identity abuse.