A critical vulnerability impacting Orkes Conductor is being actively exploited in the wild, according to Fortinet. The ...

Security researchers have disclosed BragJack, a new attack technique that allows a malicious browser extension to seize ...

A Brevo supply-chain attack used compromised Cloudflare access to inject malware into websites, potentially affecting over 100,000 sites.

Brevo ClickFix attack used a stolen Cloudflare key to alter pages and embedded scripts for 5.5 hours; Brevo says application data was not affected.

By exploiting how AI coding agents retrieve and verify plugins, researchers were able to execute malicious code even when the agent was told to use a trusted, approved version.

Hackers used a malicious worker to inject scripts into more than 100,000 websites via the Brevo supply chain attack.

CrowdStrike says PhantomRaven was likely LLM-generated and spread through malicious npm packages that collect developer credentials and CI/CD secrets.

Brevo supply-chain attack injected malicious JavaScript into 100,000+ sites, targeting WordPress admins and visitors with ClickFix prompts.

Threat actors are exploiting CVE-2026-58138, a critical-severity remote code execution vulnerability in Orkes Conductor.

Researchers find attackers now infect widely used package at runtime, sidestepping recent lifecycle-script restrictions entirely. chaeckmarx ## A New Evasion Technique Emerges ...

The campaign reportedly targeted visitors through Brevo’s embedded tracker, chat widget, hosted forms, and unsubscribe pages.