Category: SecurityWeek

A compromised maintainer account was used to publish malicious package versions across the @antv namespace.

The post Over 320 NPM Packages Hit by Fresh Mini Shai-Hulud Supply Chain Attack appeared first on SecurityWeek.

As enterprises rush AI projects into production, security teams are increasingly being forced into reactive mode.

The post Caught Off Guard: Securing AI After It Hits Production appeared first on SecurityWeek.

SecurityWeek spoke with several ICS security experts and companies about their most memorable experiences in the field.

The post Real-World ICS Security Tales From the Trenches appeared first on SecurityWeek.

The speed and sophistication of cyberattacks have outpaced traditional defense methods. Please join us online today from 11AM -4PM ET for the Threat Detection & Incident Response Summit. Don’t miss this virtual event as we explore how to cut through alert fatigue, leverage AI and unified platforms to accelerate investigations, and apply actionable threat intelligence to […]

The post Virtual Event Today: Threat Detection & Incident Response Summit appeared first on SecurityWeek.

The TeamPCP hacking group accessed the repositories after a GitHub employee installed a poisoned VS Code extension.

The post GitHub Confirms Hack Impacting 3,800 Internal Repositories appeared first on SecurityWeek.

Verizon’s 2026 DBIR finds vulnerability exploitation has overtaken credential abuse as the leading breach vector, as AI accelerates attacks, patching delays worsen, and ransomware and third-party compromises continue to surge.

The post Verizon DBIR 2026: Vulnerability Exploitation Overtakes Credential Theft as Top Breach Vector appeared first on SecurityWeek.

Drupal says attackers may develop an exploit for the vulnerability within hours or days.

The post Drupal to Patch Highly Critical Vulnerability at Risk of Quick Exploitation appeared first on SecurityWeek.

 Fox Tempest provides a service that cybercriminals use to distribute ransomware and other malware disguised as legitimate software.

The post Microsoft Disrupts Malware-Signing Service Run by ‘Fox Tempest’  appeared first on SecurityWeek.

Attackers are increasingly abusing Microsoft’s decades-old MSHTA utility to stealthily deliver stealers, loaders, and persistent malware through phishing, fake software downloads, and LOLBIN-based attack chains.

The post Legacy Windows Tool MSHTA Fuels Surge in Silent Malware Attacks appeared first on SecurityWeek.

The security defect can be exploited remotely, without authentication, to execute arbitrary code and leak sensitive information.

The post Unpatched ChromaDB Vulnerability Can Lead to Server Takeover appeared first on SecurityWeek.