Brevo confirmed that attackers stole a Cloudflare API key and used it to inject malicious ClickFix scripts into its websites ...

Threat actors are exploiting CVE-2026-58138, a critical-severity remote code execution vulnerability in Orkes Conductor.

Hackers used a malicious worker to inject scripts into more than 100,000 websites via the Brevo supply chain attack.

A hack at Brevo, an online marketing vendor, created a pathway to place a ClickFix-style attack across numerous websites on ...

CrowdStrike says PhantomRaven was likely LLM-generated and spread through malicious npm packages that collect developer credentials and CI/CD secrets.

Malicious JavaScript campaigns on e-commerce storefronts evaded VirusTotal in 7 of 8 cases, exposing a structural gap in signature-based scanning. Cloudflare's graph neural network caught all eight ...

Both Google and Uncle Sam warned that attackers have exploited a zero-day improper authorization bug in Pixel phones' ...

Sentire uncovers the GhostCode phishing kit abusing Microsoft OAuth to steal tokens, register attacker devices and access ...

UTA0560 exploited a Chrome-Windows zero-day chain against NGOs to deploy GRIMWEDGE; APT31 used the same chain to install LONGTALE.

A range of AI trust, guardrail, and red-teaming platforms is emerging to help control and secure the LLMs and agents deployed across your enterprise. Here’s an overview of the most promising tools ...

The campaign reportedly targeted visitors through Brevo’s embedded tracker, chat widget, hosted forms, and unsubscribe pages.

CrowdStrike links PhantomRaven malware to a bug bounty hunter, finding LLM-generated code, malicious npm packages and ...