cybersecurity

A breach at gig-work platform Paidwork exposed names, bank details, and bcrypt-hashed passwords for over 23 million users, per Have I Been Pwned.

A 16-year-old use-after-free bug in Linux's KVM hypervisor, dubbed Januscape and rated CVSS 8.8, lets malicious VMs escape to the host on both Intel and AMD systems; OVHcloud patched roughly a million VMs across its fleet in an 11-day campaign.

GitHub is halving public bug bounty payouts starting July 27, reserving its largest rewards for a new invite-only VIP tier as it fights a flood of low-quality, AI-generated reports.

The Linux Foundation and roughly 20 companies including AWS, Anthropic, Google, IBM and major banks launched Akrites, a coordinated incident-response alliance for open source software, after finding fewer than 5% of recently surfaced vulnerabilities have been patched.

Hugging Face disclosed that an autonomous AI agent system breached its data-processing pipeline over a weekend, harvesting credentials before defenders turned to a self-hosted open-weight model to analyze the attack.

WordPress shipped 7.0.2 and 6.9.5 on July 17 and enabled forced auto-updates to fix wp2shell, a two-CVE chain allowing unauthenticated remote code execution in core, as public proof-of-concept exploits circulate.

Kaspersky's GReAT team found a new Go-language RAT and toolkit hitting government and diplomatic targets in Southeast Asia, with a possible link to the TetrisPhantom espionage actor.

JetBrains disclosed six vulnerabilities across IntelliJ IDEA, TeamCity, and YouTrack on July 16, led by a critical 9.8 CVSS path-traversal flaw in IntelliJ IDEA.

IBM and Red Hat launched commercial Lightwell offerings on July 8, building on their $5 billion pledge to secure open source software supply chains.

Accenture confirmed a security incident after a hacker known as "888" listed 35GB of alleged source code, RSA/SSH keys, and Azure access tokens for sale on a cybercrime forum.

AssuranceAmerica is notifying 6.99 million people that hackers stole driver's license numbers and insurance records after a March cyberattack on an employee account.

Coinspect says a weak-randomness flaw in recovery-phrase generation, dubbed Ill Bloom, has let attackers drain at least $5 million from crypto wallets since May 27.