Cyber Security News

Hackers Can Abuse Logged-In WordPress Admin Sessions to Secretly Install PHP Backdoors

Hackers exploit logged-in WordPress admins' browser sessions to install hidden PHP backdoors without stealing passwords.

A research team including Stanford University analyzed approximately 10 million websites and revealed API risks!

After examining 10 million sites, a massive number of 'live API keys' were found... The danger of API keys and why they are ...
Help Net Security

AI coding agents fall for malicious instructions planted in the Downloads folder

A planted AGENTS.md file tricked OpenAI’s Codex into installing malware, exposing a risk for AI coding agents that act on ...
SecurityWeek

Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages

Microsoft, Node.js, and Python package maintainers have patched Node2Shell (CVE-2026-111497), a critical Brotli decoder flaw.
InfoWorld

Your npm install was safe. What happens when the package runs?

Blocking install scripts closes one route for malicious npm packages. The malicious indexed-btree package shows why ...