Nearly 300 GitHub repos pose as legit software to push malware

A threat actor has published hundreds of fake GitHub repositories impersonating legitimate software and security projects to ...
Hindustan Times

Coempt gave CBSE cyber certificates that were expired, tied to other client

The cybersecurity certificates the Central Board of Secondary Education accepted as proof that its controversial on-screen marking (OSM) platform was safe to process close to 10 million student answer ...
Security Boulevard

Benchmarking AI Pentesting Tools: A Practical Comparison

The post Benchmarking AI Pentesting Tools: A Practical Comparison appeared first on Escape – Application Security & Offensive Security Blog. Agentic pentesting isn't just another flavor of scanner.
GitHub

CVE-2026-37749 — CodeAstro Simple Attendance Management System 1.0 - SQL Injection

A SQL Injection vulnerability exists in CodeAstro Simple Attendance Management System v1.0 in the login form of index.php. The username POST parameter is concatenated directly into a MySQL query ...
VentureBeat

Microsoft patched a Copilot Studio prompt injection. The data exfiltrated anyway

Microsoft assigned CVE-2026-21520, a CVSS 7.5 indirect prompt injection vulnerability, to Copilot Studio. Capsule Security discovered the flaw, coordinated disclosure with Microsoft, and the patch was ...
TechRepublic

Security Flaw in WordPress Plugin Puts 400,000 Websites at Risk

A security flaw in the Ally WordPress plugin used on more than 400,000 sites could allow attackers to extract sensitive data without logging in. A vulnerability in a widely used WordPress ...
Bleeping Computer

SQLi flaw in Elementor Ally plugin impacts 250k+ WordPress sites

An SQL injection vulnerability in Ally, a WordPress plugin from Elementor for web accessibility and usability with more than 400,000 installations, could be exploited to steal sensitive data without ...
IEEE

Automated Vulnerability Scanning and Bug Detection for Secure Web Applications

Abstract: Automated vulnerability identification is essential for protecting digital systems since web applications are increasingly vulnerable to cybersecurity threats. This paper introduces a web ...
Computerworld

For January, Patch Tuesday starts off with a bang

The latest update from Microsoft deals with 112 flaws, including eight the company rated critical — and three zero-day exploits. Ninety-five of the vulnerabilities affect Windows. The first Patch ...
Ars Technica

ChatGPT falls to new data-pilfering attack as a vicious cycle in AI continues

There’s a well-worn pattern in the development of AI chatbots. Researchers discover a vulnerability and exploit it to do something bad. The platform introduces a guardrail that stops the attack from ...
Hacker

5 Ways Your AI Agent Will Get Hacked (And How to Stop Each One)

Last month, a friend called me in a panic. His company had deployed an AI agent that helped customers query their account data. Worked great in demos. Passed QA. Everyone was happy. Then someone typed ...