TechLogHub Blog — Page 16 of 25
Insights, guides, and product strategy for builders and product teams.
Checkmarx confirms LAPSUS$ hackers leaked its stolen GitHub data
Checkmarx confirms LAPSUS$ leaked data from its private GitHub repository after a March 23 supply-chain attack tied to the Trivy incident; attackers used stolen credentials to publish malicious artifacts, including Docker images and VSCode/Open VSX extensions for Checkmarx’s KICS scanner. A 96 GB data pack was poste…
Microsoft to Deprecate Legacy TLS in Exchange Online Starting July 2026
Microsoft will begin blocking legacy TLS for POP and IMAP in Exchange Online starting July 2026. After deprecation, POP3/IMAP4 connections must use TLS 1.2 or newer, and any connections using TLS 1.0 or 1.1 will fail. Most users are unaffected since TLS 1.2+ is already standard, but those using legacy endpoints or c…
Inside an OPSEC Playbook: How Threat Actors Evade Detection
Flare researchers examine a cybercrime forum post in which a threat actor outlines a three-tier OPSEC framework for high-volume carding aimed at staying undetected over time. The Public Layer uses clean devices and rotated residential IPs; the Operational Layer is strictly isolated with encrypted containers and hard…
Microsoft: New Remote Desktop warnings may display incorrectly
Microsoft confirms a new issue where security warnings for Remote Desktop (.rdp) files display incorrectly after the April 2026 updates, affecting Windows 11, Windows 10, and Windows Server. The problem is especially prevalent on systems with multiple monitors using different display scaling, causing unreadable text…
Microsoft asks iPhone users to reauthenticate after Outlook outage
Microsoft has resolved a global Outlook.com outage that affected users worldwide and now requires iPhone users to re-authenticate their accounts in the iOS Mail app to regain access. The company cited a recently introduced change as the cause but did not disclose specifics or the scope, with service returning to nor…
Robinhood Account Creation Flaw Abused to Send Phishing Emails
Robinhood’s account-creation process was abused to inject HTML into onboarding emails, allowing phishers to embed a convincing “Unrecognized Device” message and direct users to a phishing site. Attackers used known customer email lists from prior breaches and Gmail dot aliasing to send emails from a legitimate norep…
GlassWorm malware attacks return via 73 OpenVSX "sleeper" extensions
GlassWorm malware returns to OpenVSX with 73 “sleeper” extensions that look benign until they update, delivering a malicious payload. Six extensions are active so far; the rest appear dormant or suspicious. The extensions clone legitimate listings and function as loaders, fetching the payload from GitHub, loading pl…
Canada arrests three for operating “SMS blaster” device in Toronto
Canadian authorities have arrested three men in Toronto for operating an "SMS blaster" that mimics a cellular tower to send phishing texts. The rogue base stations, which can move across the Greater Toronto Area, allegedly entrapged about 13 million mobile users and could disconnect devices from legitimate networks,…
Alleged Silk Typhoon/HAFNIUM hacker Xu Zewei extradited from Italy to the U.S.
Italy extradited Xu Zewei, 34, accused of HAFNIUM intrusions and Exchange Server exploitation for China's MSS; he appeared in Houston on 27 April 2026.
PyPI package with 1.1M monthly downloads hacked to push infostealer
Attackers pushed a poisoned PyPI release of the elementary-data package (0.23.3) and a related Docker image to steal sensitive data and cryptocurrency wallets. The compromise exploited a GitHub Actions script-injection flaw in a pull request, exposing the workflow’s GITHUB_TOKEN and allowing a forged commit and tag …
Microsoft rolls out revamped Windows Insider Program
Microsoft is revamping the Windows Insider Program to two channels—Experimental (replacing Dev/Canary) and Beta—to simplify testing and address Windows 11 reliability concerns. Beta will deliver features immediately while Experimental uses feature flags you can toggle in Settings; the rollout will happen in phases w…
UNC6692 Uses Microsoft Teams to Deploy Snow Malware
UNC6692 has deployed a new malware suite called Snow via Microsoft Teams, using social engineering and email bombing to entice victims. The Snow family consists of SnowBelt (a Chrome extension for persistence), SnowBasin (a backdoor), and SnowGlaze (a tunneler/C2 conduit). After compromising a network, the group per…
ADT confirms data breach after ShinyHunters leak threat
ADT confirms a data breach after a ShinyHunters extortion threat, detecting unauthorized access on April 20, 2026 and concluding personal data was stolen. The exposed information includes names, phone numbers, and addresses, with a small percentage containing dates of birth and the last four digits of Social Securit…
New ‘Pack2TheRoot’ flaw gives hackers root Linux access
Researchers have disclosed Pack2TheRoot, a local privilege escalation vulnerability (CVE-2026-41651) in the PackageKit daemon that could let an unprivileged Linux user install or remove system packages and gain root. The flaw has persisted since 2014 in PackageKit 1.0.2 through 1.3.4 and is being mitigated by Packag…
DORA and operational resilience: Credential management as a financial risk control
EU’s Digital Operational Resilience Act (DORA) Article 9 makes credential security a binding financial risk control for banks and financial institutions, emphasizing that stolen credentials are the top initial access vector and can enable months of unseen operational disruption. The post breaks down Article 9 requir…
Over 10,000 Zimbra servers vulnerable to ongoing XSS attacks
More than 10,000 Zimbra Collaboration Suite installations exposed online remain vulnerable to an ongoing XSS flaw (CVE-2025-48700), risking unauthenticated data exposure via JavaScript in user sessions. Affected versions include ZCS 8.8.15, 9.0, 10.0, and 10.1; patches were released by Synacor in June 2025. CISA has…
Microsoft now lets admins uninstall Copilot on enterprise devices
Microsoft has introduced a new policy, Remove Microsoft Copilot App, that lets IT admins uninstall the Copilot assistant from managed Windows devices. The policy, available as a Policy CSP and via Group Policy after the April 2026 Patch Tuesday, targets Windows 11 25H2 devices where the Microsoft 365 Copilot and Cop…
Trigona Ransomware Attacks Use Custom Exfiltration Tool to Steal Data
Trigona ransomware operators are now using a custom command-line exfiltration tool, uploader_client.exe, to steal data more quickly from compromised networks. The tool connects to a hardcoded server, supports up to five parallel uploads per file, rotates TCP connections after 2GB of traffic, and can selectively exfi…
New Checkmarx supply-chain breach affects KICS analysis tool
Security researchers have disclosed a supply-chain breach affecting Checkmarx KICS, compromising official Docker images and VS Code/Open VSX extensions to harvest secrets from developer environments. The attack uses a hidden MCP addon to steal GitHub tokens, cloud credentials, npm tokens, SSH keys, and environment v…
Kyber ransomware gang toys with post-quantum encryption on Windows
Rapid7 reveals a new Kyber ransomware operation targeting Windows and VMware ESXi, with one variant claiming post-quantum Kyber1024 encryption. Two variants were observed in March 2026 using the same campaign ID and Tor-based infrastructure: a Windows Rust-based encryptor that uses Kyber1024 (and X25519) to protect …
Showing 20 of 485 articles