WordPress fixed a comment flaw that could lead to server code execution if a logged-in administrator opened the page.

A Claude Code user has reported a severe data-loss incident in which an autonomous coding agent allegedly deleted 48,218 live files from a Windows project tree and destroyed the repository’s Git ...

A new ClickFix malware-as-a-service (MaaS) framework called Exvicy has been built on code lifted from a rival service, ErrTraffic.

TASK#STOMP deploys a PowerShell backdoor that steals documents and Wi-Fi passwords, monitors files, and executes remote commands.

The TASK#STOMP backdoor steals office documents on Windows PCs, grabs new files as they're saved, and can rebuild itself if partly removed.

A malicious npm package reached over 2 million weekly downloads by hiding its payload in a routine library function rather than an install script.

A new npm supply chain campaign is hiding malware inside ordinary JavaScript package code instead of using the usual ...

Clym reports thousands of businesses face lawsuits under California's 1967 privacy law, stemming from cookie banners not matching actual data tracking practices.

Hackers use compromised websites and blockchain-based servers to steal bank logins and 2FA codes through malicious PowerShell ...