The Hacker News (2 hours ago)
Cybersecurity researchers have disclosed that the official Anthropic Claude Code extension was compromised on the Open VSX registry to install a persistent SSH backdoor on infected hosts.
Read the full story on The Hacker News.
Drupal says a highly critical Commerce Core access bypass is exploited in the wild and urges store owners to audit their orders.
A large database full of personal information was discovered and locked down.
Drupal warned admins to patch a critical access bypass vulnerability in the Commerce Core module that attackers are exploiting in the wild.
Malicious code linked to a website monitoring tool was designed to hijack logged-in Polymarket sessions and siphon user funds.
Tracked as CVE-2026-97229, the bug allows unauthenticated attackers to execute arbitrary code on the server.
Customer says they received fraudulent charges on their card hours before company notified them
Drupal has warned that threat actors are exploiting a “highly critical” security flaw in its Commerce Core component. The vulnerability, tracked as CVE-2026-118539 (CVSS score: N/A), is a case of missing authorization affecting Commerce Core versions from 0.0.0 to 2.41 and from 3.0.0 to 3.3.13.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added two security flaws impacting Cisco and GitLab software to its Known Exploited Vulnerabilities (KEV), citing evidence of active exploitation.
Cryptocurrency giant Binance said on Thursday that a “security incident” on its platform has impacted about $6.3 billion worth of assets. The world’s biggest cryptocurrency exchange said nearly $3 billion of those assets have been frozen on-chain so far.
Some attacks take real skill. Others just need someone to leave a door open. This week has both. Exposed passwords, old bugs still getting exploited, and trusted software doing things it shouldn’t. There’s a strange mix of clever tricks and careless mistakes.
71 active sources
26 Turkish · 45 English
All sources
