A weekly look at exploited flaws, exposed systems, supply-chain attacks, browser abuse, malware campaigns, and the security risks that mattered most.

Spread the loveIf you’ve spent any time in the world of infrastructure as code (IaC), you’ve almost certainly encountered ...

Spread the loveIf you’ve spent any time in the world of API development, you know that a great API is only as good as its ...

JavaScript Explicit Resource Management lands in Safari Technology Preview 250, completing cross-browser support across V8, ...

Google began offering third-party app store downloads in the Play Store earlier this week, but US District Judge James Donato says the company isn’t doing enough. After reviewing the process for ...

The Jewelbug hacker group has been carrying out espionage operations targeting governments and militaries while also engaging in cryptocurrency fraud. Although the threat actor has targeted government ...

A CVSS 10.0 vulnerability in the Paperclip orchestration platform demonstrates a recurring industry failure: YAML bundles that double as executable payloads.

Gone are the days when you had to write code to automate your browser using tools like Playwright. Microsoft has now completely changed the game with its new tool called Scout. It is an always-on AI ...

WPForms Lite WordPress plugin accused of adding a backdoor to new installations. I installed it and what happened was ...

BdThemes' compromised JSON feed exploits XSS in seven WordPress plugins, creating rogue admins and installing a PHP web shell without plugin updates.