TechLogHub Blog — Page 21 of 25
Insights, guides, and product strategy for builders and product teams.
Drift loses about $285M after attackers hijack its Solana Security Council multisig
Attackers drained about $285M from Solana's Drift using durable nonces to pre-sign admin transfers on a 2-of-5 multisig with no timelock. The lessons.
GreyNoise: residential proxy IPs rotate too fast for IP reputation to catch
GreyNoise studied 4B edge-attack sessions: 39% of source IPs were residential and 78% of those appeared at most twice. Why IP blocklists fail and what works.
CrystalX RAT: new malware-as-a-service mixes stealer, clipper and prankware
Kaspersky details CrystalX RAT, a Go-based MaaS sold on Telegram with a stealer, crypto clipper, VNC and prank tools. What it targets on developer PCs.
EvilTokens: phishing-as-a-service that abuses Microsoft's OAuth device code flow
EvilTokens sold Microsoft 365 device code phishing on Telegram, stealing OAuth tokens that bypass MFA. How the flow is abused and how to block it in Entra ID.
NoVoice Android rootkit hid in 50+ Google Play apps with 2.3 million downloads
McAfee found the NoVoice rootkit in 50+ Google Play apps (2.3M downloads). It roots devices patched before May 2021, survives factory reset and clones WhatsApp.
Chrome CVE-2026-5281: WebGPU Dawn zero-day is 2026's fourth exploited Chrome bug
Google fixed CVE-2026-5281, an exploited use-after-free in Chrome's WebGPU engine Dawn, in Chrome 146. What Electron, Puppeteer and CI users must update.
Blackpoint 2026 report: ClickFix, SSL VPN logins and RMM tools drove most intrusions
Blackpoint's 2026 report: ClickFix lures in 57.5% of incidents, SSL VPN abuse in 32.8% and RMM abuse in 30.3%. What engineering and IT teams should change.
Citrix NetScaler CVE-2026-3055 memory overread exploited on SAML IdP appliances
CVE-2026-3055 leaks NetScaler memory, including admin session IDs, via /saml/login and /wsfed/passive. Exploited since 27 March 2026. Builds to patch and steps.
F5 reclassifies BIG-IP APM flaw CVE-2025-53521 as RCE after webshell attacks
F5 upgraded CVE-2025-53521 from DoS to critical RCE in March 2026 after attackers planted webshells on BIG-IP APM. Fixed versions, IOCs and what to check.
Microsoft pulls Windows 11 KB5079391 over 0x80073712 errors, ships KB5086672 fix
Microsoft paused Windows 11 preview KB5079391 over 0x80073712 install errors, then shipped out-of-band fix KB5086672 on 31 March. What to check on your PCs.
FortiClient EMS SQL injection CVE-2026-21643 exploited: patch past 7.4.5
Pre-auth SQL injection CVE-2026-21643 in FortiClient EMS 7.4.4 is exploited, and 7.4.5 has its own exploited bug, CVE-2026-35616. How the flaw works.
European Commission breach traced to Trivy supply-chain attack and a stolen AWS key
CERT-EU says a poisoned Trivy release leaked an AWS key that exposed Europa.eu hosting data for up to 71 EU clients. The CI/CD lessons for engineering teams.
FBI confirms Iran-linked Handala hackers leaked Director Kash Patel's personal emails
Iran-linked Handala leaked photos and old emails from FBI Director Kash Patel's personal account. The FBI says no government data was involved. Lessons here.
Smart Slider 3 flaw CVE-2026-3098 lets subscribers read wp-config.php on WordPress sites
CVE-2026-3098 in Smart Slider 3 up to 3.5.1.33 lets any logged-in subscriber read server files like wp-config.php. Update to 3.5.1.34; why nonces aren't authz.
Backdoored Telnyx PyPI releases 4.87.1 and 4.87.2 hid a credential stealer in WAV audio
TeamPCP pushed malicious telnyx 4.87.1 and 4.87.2 to PyPI on 27 March 2026. A plain import ran a stealer pulled from WAV files. How to check and clean up.
Fake VS Code security alerts flood GitHub Discussions to lure developers to malware
Socket found thousands of fake VS Code vulnerability posts in GitHub Discussions linking to Google Drive and a filtering site. How to spot and stop them.
Agentic GRC: a vendor argues the hard part is the mindset, not the technology
An Anecdotes CEO's sponsored piece says GRC teams resist AI agents over identity, not tech. What compliance-as-code means for the engineers who build it.
European Commission confirms data taken from AWS-hosted Europa web platform
The Commission says data was taken from cloud infrastructure hosting Europa sites; an attacker claims 350 GB. AWS says it wasn't breached. Lessons for teams.
ACE shuts down AnimePlay, an Indonesian anime piracy app with 5 million users
ACE says AnimePlay's sole operator handed over 29 GitHub repos, servers and 15 domains, taking down an app with 5M users and 60 TB of pirated anime.
Windows 11 KB5079391 preview lets users toggle Smart App Control without a reinstall
KB5079391 made Smart App Control switchable without a reinstall and fixed display issues, then was pulled for KB5086672. What Windows developers should know.
Showing 20 of 485 articles