A previously undocumented APT group named GopherWhisper has been running a targeted espionage campaign against Mongolian government ministries, energy infrastructure operators, and diplomatic institutions using custom Go-based implants and sophisticated OPSEC.
Threat actors uploaded thousands of malicious container images to Docker Hub mimicking official Node.js, Python, and Nginx images. The campaign accumulated over two million pulls before detection, harvesting credentials from containerized production environments.
A critical server-side request forgery flaw (CVE-2026-33626, CVSS 9.1) in LMDeploy allows unauthenticated attackers to make arbitrary internal network requests through AI inference servers. Upgrade to version 0.7.3 immediately.
CISA added eight newly confirmed exploited vulnerabilities to its KEV catalog on April 22, 2026, covering enterprise VPN appliances, web frameworks, industrial control systems, and security products being actively weaponized in the wild.
Microsoft has embedded Anthropic’s Claude Mythos Preview into its Security Development Lifecycle. The AI has already found thousands of zero-day vulnerabilities including a 27-year-old OpenBSD flaw.
Anthropic Claude Mythos Preview found 271 security vulnerabilities in Mozilla Firefox in a single evaluation pass. All bugs are patched in Firefox 150. Here is the full breakdown.
Vercel confirmed a security breach on April 19, 2026 involving unauthorized access to internal systems via a compromised third-party AI tool OAuth app. ShinyHunters claims responsibility and is demanding $2M ransom. Here’s everything developers need to know and do right now.
The definitive roadmap to becoming an ethical hacker in 2026 — from zero to professional, including certifications, tools, and learning platforms.
A major password manager has disclosed a breach affecting 29 million users with encrypted vaults stolen.