P7 DarkSword iOS Exploit Kit Adds Crypto Wallet Data Theft and Remote Commands
Mobile threat researchers at iVerify have documented P7 DarkSword, a new variant of the DarkSword iOS exploit kit that trades a smaller
SAS CTF 2026 Finals
SAS CTF, the competition run alongside Kaspersky's Security Analyst Summit, moves into its onsite Attack-Defense finals this month in Bali,
CVE-2026-107889
A newly tracked flaw, CVE-2026-107889, hits Keycloak's login theme rendering: the filter meant to sanitize user-supplied text can be
strings: Pulling Readable Text Out of Any Binary
Before reaching for a disassembler, run strings on the file — flags, hardcoded passwords, and library names often sit in plain text inside a binary nobody bothered to hide.
Credential-Stealing GitHub Actions Workflows Planted in Tens of Thousands of Repositories
Researchers have uncovered an active supply-chain attack in which hijacked accounts belonging to prominent open-source maintainers were
FooBar CTF 2026
FooBar CTF 2026 kicks off today as the flagship hacking competition of Team Aavishkar's Aarohan festival, running for 24 hours from October
CVE-2026-87682
A newly disclosed flaw tracked as CVE-2026-87682 affects Brocade Fabric OS versions prior to 10.0.1, where flawed input handling in the
Same-Origin Policy and CORS: Why Browsers Block Your Own Requests
Browsers refuse to let a page read responses from a different origin by default — CORS is the mechanism a server uses to explicitly allow it, and a sloppy CORS config is its own CTF category.
FBI Says China-Linked Hackers Ran Portal Giving Third Parties Access to Stolen Emails
The FBI and security agencies from six other countries say a China-linked firm called Integrity Technology Group ran a portal that let
GaianSpace CTF 2026
GaianSpace is running its debut online CTF starting October 10 at 9:00pm UTC and continuing for a full 96 hours, themed around defending
CVE-2026-106583
A newly tracked flaw, CVE-2026-106583, affects the ssh client in OpenSSH versions before 10.6: a username containing a dollar sign or
Attackers Hijack .gh, .sl, and .as Registries to Obtain Certificates for Google Domains
Google disclosed on October 6 that attackers breached the registries behind three country-code domains — Ghana's .gh, Sierra Leone's .sl