Cyber ​​Security Hub

WordPress patched CVE-2026-64638, a pre-auth reflected XSS flaw that could lead to PHP code execution when an administrator interacts with attacker-controlled content.

The discovery of RovoBlast - a severe security vulnerability in the Atlassian Rovo AI assistant serves as proof that an enterprise's internal data can be exfiltrated through a single malicious link.

Levi Strauss & Co. said it identified a cybersecurity incident in which an unauthorized third party used social engineering to gain access to three company-issued employee computers. From those devices, certain corporate information was accessed and exfiltrated.

Metabase has confirmed a critical cybersecurity incident involving an actively exploited zero-day vulnerability.

Learn how combining IT outsourcing and cybersecurity with an outsourced SOC helps enterprises define responsibilities and improve IT–SOC collaboration.

OpenAI restricted some Astra activities after preliminary evaluations could not rule out Critical cybersecurity capabilities, including zero-day exploitation.

Two familiar yet crucial defensive tools that every organization must thoroughly understand are IDS (Intrusion Detection System) and IPS (Intrusion Prevention System).

A flaw in Cursor, VS Code, and Antigravity could execute commands after one click, putting API keys, source code, and developer devices at risk.

During a recent information security assessment, an artificial intelligence (AI) model from Meta unexpectedly gained access to the internet and infiltrated the computer system of a third-party service.

Information security researchers have recently discovered a dangerous cyberattack campaign named SMOKE#SCREEN. By spreading fake software update notifications from familiar applications like Zoom or Adobe, attackers can silently install remote control tools and gain full control over victims' computers.

Cybersecurity experts have recently uncovered a new attack technique called "Pass-ta-key," which enables malware to compromise and hijack accounts even when secured by Passkeys.

In the era of digital transformation, maintaining a safe and reliable cyberspace has become a key factor for overall development. The Vietnam Cybersecurity Day event held annually on August 6 is an important occasion to promote public awareness and responsibility regarding information security protection.

Unit 42 disclosed three techniques that could let malware hijack passkey-protected accounts on Chrome for Windows after a device is compromised.

To prepare for a Penetration Test, the internal IT team must provide an inventory of network assets (IPs, Domains, APIs), infrastructure diagrams, technical documentation, and necessary system access privileges.

The npm open-source ecosystem has just experienced a major shock. On August 4, 2026, a malware campaign named Shai-Hulud re-emerged as a worm (a type of malware capable of self-replicating and spreading automatically). The attack directly targeted the software supply chain, hijacking critical developer accounts and rapidly poisoning a wide array of popular programming libraries.