Blocking install scripts closes one route for malicious npm packages. The malicious indexed-btree package shows why ...

Latrodectus is a Windows loader that downloads other malware, seen in phishing and ClickFix attacks. See what it does, how to ...

In October 2026, a critical vulnerability related to Node.js became a hot topic under the names "HTTP2Shell" and "Node2Shell".The identification number is "CVE-2026-111497".In short, the issue lies in ...

A planted AGENTS.md file tricked OpenAI’s Codex into installing malware, exposing a risk for AI coding agents that act on ...

Over the past few months, we’ve used an unreleased, internal research model to find critical vulnerabilities in some of the ...

ClearFake hides on hacked websites and shows fake browser updates or fake CAPTCHA checks that install stealers. See how it ...

The Node.js I thought I had updated was actually still running an old version. The cause was that there were three versions ...

A PDF that arrives from outside the building is, as far as the parser is concerned, a program some stranger wrote. Inside ...

Kaspersky's GReAT team has detailed Operation FlashHole, a Lazarus espionage campaign active since at least July 2025 that ...

Security researchers have published the first public proof-of-concept for CVE-2026-86950 , an Apple CoreGraphics flaw Apple says may have been used in attacks against specific targeted individuals.

North Korean hackers linked to the Lazarus Group abused banking security software to deploy a layered malware toolkit against ...

Researchers found a malicious AGENTS markdown instruction file in a customer's Downloads folder that tricked an AI coding ...