BIND 9 Software Vulnerabilities Exposes Resolvers and Authoritative Servers to Remote Exploits

New ISC BIND 9 flaws expose DNS servers to DoS, memory corruption, and remote exploitation risks.

OMB Scraps Biden-Era Cyber Logging Rules

The White House issued a new memo replacing SolarWinds-era logging mandates with a narrower framework focused on risk, threat hunting and forensic readiness as

Microsoft Code Editor Flaw Lets Attackers Hijack Developer PCs

Microsoft patched a high-severity flaw in Visual Studio Code after researchers found attackers could hide malicious settings inside MCP server install links, giving

UK Visa Portal exposed thousands of applicants’ passports and selfies — then called the lawyers on us | TechCrunch

The third-party website exposed passports, selfies, and the location data of applicants who submitted their documents as part of the U.K. visa application process. Instead of fixing the issue, the web...

Smart Contracts for C&C: How ClearFake Hid in Plain Sight on BSC Testnet

TrendAI™ Research analyzed an intrusion where threat actors used the EtherHiding technique to route ClearFake payload delivery through smart contracts on the BNB Smart Chain testnet. The attack chain ...

Trojanized Gemini and Claude Installers Target Developers Via SEO Poisoning

Follow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread

The AI Era Is Creating a Bug-Hunting Arms Race

As attackers ramp up their AI exploit development, the search for software vulnerabilities is changing rapidly.

266,000 Affected by Data Breach at Radiology Associates of Richmond

Threat actors stole files containing names and protected health information from the healthcare organization’s systems.

DocketWise Data Breach Impacts 143,000

Hackers accessed names, addresses, Social Security numbers, financial information, and medical data from third-party partner repositories.

Ghost CMS CVE-2026-26980 Exploited to Hijack 700+ Sites for ClickFix Attacks

Ghost CMS flaw CVE-2026-26980 enabled attacks on 700+ sites, injecting ClickFix malware through fake CAPTCHA pages.

TrapDoor Supply Chain Attack Spreads Credential-Stealing Malware via npm, PyPI, and CratesIO

TrapDoor spread 34 malicious packages across npm, PyPI, and Crates.io, stealing developer credentials and enabling persistence.

Laravel-Lang Packages Poisoned for Malware Delivery

Published within a 15-minute window, the malicious tags introduced backdoors to exfiltrate CI secrets.

‘Underminr’ Vulnerability Lets Attackers Hide Malicious Connections Behind Trusted Domains

The stealthy vulnerability impacts roughly 88 million domains and can be exploited to bypass DNS filtering and hide command-and-control traffic.

CISA Adds Exploited Langflow and Trend Micro Apex One Vulnerabilities to KEV

CISA added two exploited bugs to KEV, forcing federal agencies to patch Langflow and Apex One flaws by June 4, 2026.

Claude Mythos AI Finds 10,000 High-Severity Flaws in Widely Used Software

Anthropic uncovered 10,000 vulnerabilities through Project Glasswing, driving urgent patching efforts and stronger cyber defenses.

5,561 GitHub Repositories Hit by Megalodon Supply Chain Attack in Six Hours

Follow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread