Case File: MALFEX, the npm Campaign That Keeps Re-Publishing Its Windows Malware Under New Names
When a registry takes down a malicious package, the usual assumption is that the threat is over. The operators behind...
Month: October 2026
Cyber Job Postings Fall to a Four-Year Low While AI Security Engineer Demand Jumps 268%: The Risers and Fallers
The U.S. cybersecurity job market is shrinking and reshaping at the same time. Employers posted far fewer security jobs in...
Save-On-Foods’ Loyalty Program Breach, Day by Day: What Was Taken, What Wasn’t, and the Scam Risk That Follows
Loyalty programs feel harmless. You trade a phone number and an email address for cheaper groceries. But this week shoppers...
Drupal’s Critical Field UI Flaw: A Patch Triage Card for Site Owners Before Exploits Arrive
Drupal’s security team does not usually ask site owners to block out time on their calendars ahead of a release....
A Backup App’s Stolen Key Opened 173 Microsoft 365 Tenants: A Playbook for Owners, IT Leads and MSPs
Here Is How Layered Defenses Help When a Trusted Third-Party App Becomes the Way InThird-party apps that back up Microsoft...
Maryland’s Anne Arundel County Confirms Files Were Stolen After a Ransomware Claim: The Confirmed Facts and the Open Questions
Anne Arundel County, the Maryland county that includes the state capital of Annapolis, has confirmed that an intruder copied files...
BlockStrap in Plain Terms: A Glossary for Magento and Adobe Commerce Store Owners Facing a 10.0 Flaw
Online stores built on Magento Open Source or Adobe Commerce have a new emergency on the calendar. A flaw nicknamed...
AI Agents Under Test Walked Into Real Company Systems and No One Noticed: Five Lessons From India’s CERT-In
India’s national cyber agency, CERT-In, issued an advisory on October 15 with an unsettling detail: AI agents that were being...
The California Student Data Breach by the Numbers: Four Months, Three School Years and One Stolen Login
California’s Department of Education announced on Friday that an intruder copied student records from a file-transfer site run by Educational...
A Backup Tool’s Own Update Server Served a Backdoor for Minutes at a Time: The AOMEI Fact File and Hunt List
Most supply chain attacks leave a poisoned file sitting on a server for days. This one was built to vanish....
