Daily Cyber News

Google Disrupts IPIDEA, One of the World’s Largest Residential Proxy Networks

Google has announced the disruption of IPIDEA, widely recognized as one of the largest residential proxy networks in operation. The takedown involved legal actions to seize dozens of domains used to control infected devices and route proxy traffic, rendering IPIDEA’s main website (www.ipidea.io) inaccessible. IPIDEA previously promoted itself as a leading IP proxy provider, claiming […]

Google Disrupts IPIDEA, One of the World’s Largest Residential Proxy Networks Read More »

Fake Moltbot AI Coding Assistant on VS Code Marketplace Distributes Malware

Cybersecurity researchers have uncovered a malicious Visual Studio Code extension that impersonated Moltbot, previously known as Clawdbot, and secretly installed malware on developer systems. The fake extension was distributed through Microsoft’s official VS Code Marketplace and falsely advertised itself as a free AI powered coding assistant. The extension, listed as “ClawdBot Agent, AI Coding Assistant” with the

Fake Moltbot AI Coding Assistant on VS Code Marketplace Distributes Malware Read More »

Critical vm2 Node.js Vulnerability Allows Sandbox Escape and Arbitrary Code Execution

A critical security vulnerability has been disclosed in the widely used vm2 Node.js library, exposing systems to sandbox escape and arbitrary code execution risks. If exploited successfully, attackers could execute malicious code directly on the host operating system, completely bypassing vm2’s intended isolation mechanisms. The flaw is tracked as CVE-2026-22709 and carries a CVSS score of 9.8, placing it among the

Critical vm2 Node.js Vulnerability Allows Sandbox Escape and Arbitrary Code Execution Read More »

Two High Severity n8n Vulnerabilities Allow Authenticated Remote Code Execution

Cybersecurity researchers have disclosed two serious security flaws in the n8n workflow automation platform that could allow authenticated attackers to achieve remote code execution (RCE) and potentially take full control of affected environments. The vulnerabilities were discovered by the JFrog Security Research team and impact n8n’s sandboxing mechanisms for both JavaScript and Python execution. Given n8n’s deep integration across enterprise automation

Two High Severity n8n Vulnerabilities Allow Authenticated Remote Code Execution Read More »

Fake Python Spellchecker Packages on PyPI Deliver Hidden Remote Access Trojan

Cybersecurity researchers have uncovered two malicious Python packages on the Python Package Index (PyPI) that posed as legitimate spellchecking tools while secretly delivering a remote access trojan (RAT). The packages, spellcheckerpy and spellcheckpy, have since been removed, but not before they were downloaded more than 1,000 times combined. According to Aikido researcher Charlie Eriksen, the malware was concealed

Fake Python Spellchecker Packages on PyPI Deliver Hidden Remote Access Trojan Read More »

Google Warns of Active Exploitation of WinRAR Vulnerability CVE-2025-8088

Google has warned that multiple threat actors are actively exploiting a critical security vulnerability in WinRAR, despite the issue being patched months ago. The attacks involve a mix of nation state groups and financially motivated cybercriminals using the flaw to gain initial system access and deploy malware. According to the Google Threat Intelligence Group (GTIG), the vulnerability

Google Warns of Active Exploitation of WinRAR Vulnerability CVE-2025-8088 Read More »

China Linked Hackers Have Been Using the PeckBirdy JavaScript C2 Framework Since 2023

Cybersecurity analysts have uncovered a JavaScript based command and control framework known as PeckBirdy, which has been actively used by China-aligned advanced persistent threat groups since 2023 to compromise diverse environments. According to research published by Trend Micro, the framework has been deployed in attacks against Chinese online gambling platforms as well as targeted operations aimed

China Linked Hackers Have Been Using the PeckBirdy JavaScript C2 Framework Since 2023 Read More »

Critical Grist Core Vulnerability Enables RCE Attacks Through Spreadsheet Formulas

A severe security vulnerability has been identified in Grist-Core, the open-source self-hosted variant of the Grist relational spreadsheet-database, which could allow remote code execution (RCE). The flaw, cataloged as CVE-2026-24002 with a CVSS score of 9.1, has been dubbed Cellbreak by Cyera Research Labs. “One malicious formula can turn a spreadsheet into a Remote Code Execution (RCE) beachhead,” said security researcher Vladimir Tokarev, who

Critical Grist Core Vulnerability Enables RCE Attacks Through Spreadsheet Formulas Read More »

Microsoft Office Zero-Day CVE-2026-21509 – Emergency Patch Released Amid Active Exploitation

Microsoft has released emergency security updates for a critical Microsoft Office zero-day vulnerability that has been actively exploited by attackers. The flaw, identified as CVE-2026-21509 with a CVSS score of 7.8, is a security feature bypass within Microsoft Office. According to Microsoft, “Reliance on untrusted inputs in a security decision allows unauthorized attackers to bypass

Microsoft Office Zero-Day CVE-2026-21509 – Emergency Patch Released Amid Active Exploitation Read More »

Fortinet Patches CVE-2026-24858 Following Active FortiOS SSO Exploitation

Fortinet has started rolling out security updates to fix a critical vulnerability in FortiOS, which has recently been actively exploited in the wild. The flaw, tracked as CVE-2026-24858 with a CVSS score of 9.4, is an authentication bypass issue linked to FortiOS single sign-on (SSO). This vulnerability also impacts FortiManager and FortiAnalyzer, while Fortinet continues to investigate potential

Fortinet Patches CVE-2026-24858 Following Active FortiOS SSO Exploitation Read More »