N-able Takes N-central Offline After 33 Zero-Days Published

N-able pulled hosted N-central offline after a researcher published 33 alleged zero-days with proof-of-concept exploits.

youtube.com

Fake Ruby Gem Steals Secrets and Backdoors AI Coding Tools

A fake Ruby gem drops a credential-stealing worm and backdoors your AI coding tool settings.

youtube.com

AI Agent Steals OpenAI and DeepSeek API Keys From Exposed Servers

An AI agent uses 1,438 fake FOFA accounts to find and validate OpenAI and DeepSeek API keys on exposed servers.

youtube.com

GhostAction Attack Hijacks GitHub Repos to Steal Secrets

GhostAction pushed a secret-stealing GitHub Actions workflow into tens of thousands of repos through 500+ compromised accounts.

youtube.com

2.2 Million Sega Customer Emails Leaked in Vendor Breach

Attackers breached Sega's newsletter provider, exposed 2.2 million customer emails and sent over seven million phishing emails.

youtube.com

Millions of Sega Emails Leaked, GitHub Repos Hijacked, AI Agents Stealing API Keys

2.2M Sega customer emails leaked, GhostAction hits 500+ GitHub accounts, and an AI agent is stealing OpenAI and DeepSeek API keys from exposed servers.

youtube.com

Hackers Used ARTEX AI to Breach WorkOS Customer Data

An attacker used the ARTEX AI framework to automate recon against WorkOS, exposing customer contact records.

youtube.com

Hijacked npm Packages Hide Malware Behind the Ethereum Blockchain

Hijacked npm packages hide loaders that look up an Ethereum wallet to fetch and run malicious JavaScript.

youtube.com

WordPress Upgrade Race Condition Opens the Door to RCE

A race condition in WordPress core upgrades exposes versions 4.7 through 7.1.3 to RCE, with more than 240,000 exploit attempts.

youtube.com

Fake GitHub Security Tools Infected 2,000 Machines

Fake security tools on GitHub have infected more than 2,000 machines with backdoors and info stealers through booby-trapped Visual Studio projects.

youtube.com

Hackers Hijack Plex Servers on QNAP NAS to Mine Monero

Attackers are chaining four Plex Media Server flaws to drop Monero miners and proxies on QNAP devices. Update to Plex 1.43.3.

youtube.com

A Long Password Bypasses OpenSSH Login on musl Linux

Any 257 to 1024 character password can bypass OpenSSH login on musl Linux with PAM off, and attacks have started. Update to 10.6p2.

youtube.com

Fake GitHub Tools Infect 2,000 PCs, npm Packages Hijacked, OpenSSH Auth Bypass Under Attack

Fake GitHub security tools hit 2,000+ machines, hijacked npm packages fetch malware via Ethereum, and a long password bypasses OpenSSH on musl Linux.

youtube.com

https://www.youtube.com/shorts/Sw4QoVgpZjI

Microsoft identified Needy Mantis, a modular post-compromise malware framework built for long-term access.

youtube.com

https://www.youtube.com/shorts/TM6aEDahgiA

One operator's AI agents stole 190,000 gaming credentials and 300 Apple certificates from 10 certificate signing shops.

youtube.com

https://www.youtube.com/shorts/vbVK1NyaFjE

A CVSS 9.3 Barracuda Email Security Gateway flaw lets an unauthenticated attacker take over the appliance. Version 9.4.0.030 fixes it.

youtube.com

https://www.youtube.com/shorts/AWprrVi-qVQ

An October intrusion exposed usernames, password hashes and live tokens for every Chainalysis customer.

youtube.com

https://www.youtube.com/shorts/Akt6GUlj9Gw

A Windows Paint zero-click flaw could let one crafted network packet run code on a PC with no logon and no user interaction.

youtube.com

https://www.youtube.com/shorts/NbCCEGUk8b4

A long password can bypass OpenSSH authentication on musl-based Linux like Alpine when PAM is off. Update to OpenSSH 10.6p2.

youtube.com

Windows Paint Zero-Click, OpenSSH Auth Bypass, AI Agents Target Credentials

An OpenSSH bypass lets long passwords skip login, every Chainalysis customer's live tokens were exposed, and a Windows Paint zero-click flaw needs one packet.

youtube.com

Hackers Steal iPhone Cookies and Hit Android Chrome 139-145

Exploits stole cookies from iOS 16.7 phones and hit Android phones on Chrome 139 through 145, except 143.

youtube.com

DreamHost Hacked Through a File Manager Flaw, Logins Stolen

Hackers stole DreamHost customer login details through a flaw in third-party file manager software, possibly since mid-August.

youtube.com

DigiCert Exposed Customer ID Documents After a Migration Mistake

A migration misconfiguration exposed DigiCert's archived customer contact details and ID documents. Certificates were not affected.

youtube.com

Hackers Pushed French Blood Storage Rooms to 110°C

Temperature controls were altered at three French blood service sites. EFS says monitoring caught it and no blood was lost.

youtube.com

Debian and Ubuntu APT Bug Lets Attackers Run Code as Root

An APT flaw lets an on-path attacker swap a package after verification and run code as root on Debian and Ubuntu. Update APT now.

youtube.com

Linux APT Bug Exposes Root, Zyxel Zero-Day Leaks Credentials, French Blood Sites Hacked

An APT flaw lets attackers run code as root on Debian and Ubuntu, a Zyxel zero-day hit 996 switches, and an attack pushed French blood storage rooms to 110°C.

youtube.com

Skywalker Takes Over Accounts Without Stealing Passwords

The Skywalker kit abuses Microsoft device code sign-in to take over corporate accounts without stealing a single password.

youtube.com

France Blood Service Hacked, Binance $6.3B Crypto Theft, Servers Under Siege

North Korean attackers took $6.3B from Binance, fake CP Guard updates backdoored ~2,950 servers, and a hack pushed France's blood storage rooms to 110°C.

youtube.com