HACKING 2026 2024 2023 2022 2021 2020
H AI APT Attack BigBrothers BotNet Congress Cryptocurrency Cyber CyberCrime Exploit Hack ICS Incindent IoT IT Mobil OS Phishing Ransom Safety Security Social Spam Virus Vulnerebility
| DATE | NAME | INFO | CATEGORIE | WEB | |
|
12.10.26 |
 |
Never Deleted, Only Re-Pointed: Inside the 17,600-Repo FakeGit Fleet That Re-Arms Overnight | Around 06:30 UTC on October 4, a script started editing READMEs across FakeGit, the network of fake GitHub repos that delivers the SmartLoader malware loader. Over the next thirty-four hours, more than thirteen thousand GitHub repositories were pushed in coordinated bursts, at up to 2,999 an hour. | Hack | APIIRO |
|
26.9.26 |
|
Protection Highlight: The Image That Isn't — Stopping SVG-Borne Attacks | Multiple attackers have moved their first stage into image files. One format of choice is SVG, which email policy treats as harmless on its extension alone. But SVG is made up of XML, not pixels, making the browser parse and execute it. A single file can carry <script>, paint a convincing full-screen login page, and pass filters written for executables and archives. That combination has put SVG among the top three most common malicious attachment types. | Hack | BROADCOM |
|
26.9.26 |
|
One URL, Three Different Tricks | Yesterday, we received a phishing email with an interesting link. At first sight, it looks like garbage, but every piece of it has been carefully crafted to confuse basic security controls. Here is the defanged link: | Hack | SANS |
|
22.9.26 |
|
Cloud Threat Emulation on Autopilot: Context is Everything |
Cloud threat emulation is more than detonation. A plan-first methodology for cloud detection engineering: scope, victim model, telemetry, coverage, cleanup. Learn how to properly leverage AI to automate your emulations. Cloud threat emulation needs more than detonation |
Hack | ELASTIC |
| 26.8.26 |
|
Obfuscating IP Addresses as Hostnames | It is pretty obvious that hostnames can replace IP addresses. Pretty much any software accepting an IP address will also accept a hostname as an argument. Last week, I wrote about scans for the cloud metadata service listening at 169.254.169.254. These scans attempted to exploit Server Side Request Forgery (SSRF) vulnerability. One way to prevent these types of exploits is to filter requests that contain the string "169.254.169.254" or to add this IP to a blocklist of URLs that should not be accessed. | Hack | SANS |
| 6.8.26 |
|
22 Seconds to Compromise: How Automated SSH Actors Move From Login to Persistence Before You Can Blink | On May 23, 2026, a threat actor successfully authenticated to my Cowrie SSH honeypot using compromised credentials and, within 22 seconds, injected a backdoor SSH key, changed the root password, attempted to clear host-based access restrictions, and performed automated system reconnaissance. The speed and consistency of the behavior left no room for doubt: this was not a human attacker manually working through a system. | Hack | SANS |
| 6.8.26 |
|
Don't Revoke That Token Yet: Inside the keyv/cacheable npm Worm |
When you learn that a compromised package executed on one of your build hosts, muscle memory takes over: revoke the npm token, rotate the GitHub PAT, cycle the cloud keys. That reflex has been correct in almost every supply-chain incident I have worked. In the keyv/cacheable compromise that has been unfolding since yesterday, it is the one thing you should not do first — because revoking the stolen token is exactly what arms the payload. | Hack | SANS |
| 31.7.2026 |
|
zipdump.py: Metadata Encoding | I was asked for help with a problem similar to the following. | Hack | SANS |