A new malicious campaign dubbed DOUBLECUP exploits the ClickFix technique and cached PNGs to distribute two malware families: CountLoader and DeviceManager RAT. Anatomy of a two-stage attack.
3 h ago 24 3
An internal leaked memo reveals that the next Xbox (codename Helix) aims for full backward compatibility—original Xbox, Xbox 360, Xbox One, including discs. And this week, an Xbox outage made legitimately purchased physical games unreadable.
3 h ago 23 3
Andrew Healey injects the `defer` keyword—pillar of Go code—directly into the TypeScript compiler, now written in Go. A textbook case for understanding parser, checker, and emitter.
yesterday 7 2
Nozomi Networks Labs documents Tengu, a multi-architecture Linux botnet that abuses the kernel watchdog and rewrites reboot binaries to survive cleanup attempts - all controlled via ChaCha20/Poly1305.
Jul 28, 2026 9 2
Under the hood of `go vet`, `staticcheck`, and friends: the Go team maintains an official framework that allows you to write a linter in a few dozen lines.
Jul 26, 2026 3 1
After Claude Code's migration to Bun (with Rust core) last week, a member of the Zig community announces Buz: a fork of Bun rewritten with recent versions of Zig, promising sub-second incremental builds. 224 points on Hacker News.
Jul 25, 2026 4 2
The North Korean group BlueNoroff (Lazarus) has been operating a Zoom/Teams phishing kit since May 2026 that compromises legitimate Telegram accounts, invites targets to a fake meeting, captures their webcam, overlays an AI deepfake (ChatGPT), profiles installed crypto wallets, and then pushes malware via ClickFix. Five versions of the kit documented by JUMPSEC.
Jul 24, 2026 8 2
CVE-2026-32194 and CVE-2026-32191, both CVSS 9.8. Two command injections in the Bing image search pipeline: a simple SVG whose image attribute starts with " | " is enough for ImageMagick to launch server-side shell commands from Microsoft. Discovered by the autonomous startup XBOW, patched in March 2026, published today.
Jul 24, 2026 4 2
Socket.dev documented a campaign where 583 GitHub Actions workflows slipped into 10 PHP packages scan the Internet for cPanel/WHM instances vulnerable to the CVE-2026-41940 authentication bypass - to steal almost all available credentials. Approximately 6,100 workflows bear the campaign's signature on GitHub.
Jul 23, 2026 18 3
Zenity Labs publicly disclosed on July 23, 2026 a vulnerability in the ChatGPT agent builder that allowed the silent installation of a malicious agent inheriting all of the victim's connectors (Outlook, Slack, Drive...). Fixed on June 9 - but the vulnerability class remains to be monitored.
Jul 23, 2026 7 2
A flaw in the Azure DevOps MCP (Model Context Protocol) integration allows an invisible comment in a pull request to hijack an LLM agent tasked with reviewing it.
Jul 23, 2026 7 2
A simple comment hidden in an Azure DevOps pull request can turn the code reviewer's AI agent against them - and send it siphoning projects that the attacker normally wouldn't have access to. The vulnerability lies in Microsoft's official MCP server.
Jul 22, 2026 8 2
