The Malicious npm Release Had Valid Provenance Because the Build System Worked
Provenance answered where the package was built. It could not answer whether the source reaching the trusted workflow was honest.
Data Became an Instruction
An alert should outlast a failed interruption.
Copied Websites Hid a Chrome-to-Windows Exploit Chain
The pages borrowed real content from trusted organisations while a hidden frame delivered the already shared exploit chain.
This Linux Backdoor Hides Its Commands in Ordinary MQTT Traffic
MQTT is normal in many connected environments. That makes the protocol useful cover, but the implant still leaves distinctive topic, process and file-transfer behaviour.
A Valid Red Hat Key ID Could Still Deliver a Forged OpenShift Release
The signature check could trust the right key identity before it had proved that the signature covered the complete release body.
An Endpoint Login Can Gain Machine Control
Verify installed builds.
Freed Memory Stayed Accessible
Verify isolation.
TASK#STOMP Turns New Business Documents Into a Collection Target
Removing the first script is not enough. Four scheduled tasks and a Startup launcher support a backdoor that watches new documents and maintains two command channels.
Inspected Fragments Became Dangerous
Verify builds.
NTDS.dit Theft Turns a Windows Foothold Into a Domain Identity Crisis
This was a controlled simulation, not a newly disclosed victim breach. Its value is showing where defenders can still break the chain before domain credentials leave.
AI Agents Ran 105 Retail Attack Projects in Six Days
The operator supplied short instructions. The agents did the patient probing, exploitation and persistence at a pace most defenders were not built to match.
CISA’s Federal Zyxel Deadline Passed. The Intrusion Review Still Matters.
The flaw is reachable from the local network, not necessarily the public internet. That makes internal exposure and earlier compromise the questions that matter.