Do Son A new report reveals how malicious AI extensions use browser data exfiltration tactics to steal private conversations from ChatGPT and Claude.
Data Leak
A serious Instagram account recovery flaw has been exposed. Read this Meta incident notification detailing how AI-assisted bugs bypass security.
GitHub confirms a perimeter breach by TeamPCP. An administrative VS Code extension supply-chain worm exfiltrated 3,800 proprietary core source repositories.
Grafana Labs confirms a targeted cyberattack and source code theft after a missed token from the Mini Shai-Hulud npm worm left a repository exposed.
16GB Rocket database leak exposes The Gentlemen ransomware cartel. Check Point Research unmasks their RaaS tactics, AI tools, and active exploits.
OpenAI rotates code signing certificates following the TanStack npm breach. macOS users must update ChatGPT and Codex manually before June 12, 2026.
Playground Games accidentally leaked Forza Horizon 6 without DRM. Now, Microsoft is issuing "permanent" hardware bans for early access. Is your PC blacklisted?
Google Chrome is under fire for surreptitiously downloading a 4GB "weights.bin" file to run Gemini Nano. Discover the GDPR and environmental risks involved.
Hunt Intelligence uncovers a massive Iranian-nexus breach targeting the Omani Ministry of Justice. 26k records leaked via an unprotected UAE staging server.
Cursor AI editor found storing API keys and tokens in an unprotected SQLite database, allowing extensions to steal credentials silently. CVSS 8.2. No patch yet.
Vimeo metadata and customer emails were exposed via a breach at third-party vendor Anodot. Internal systems remain secure. Learn how to manage vendor risk.
ClickUp discloses a configuration flaw exposing 893 emails and a live API token via Split.io feature flags. Learn how client-side SDKs became a public leak.
LayerX unmasks 12 TikTok downloader extensions tracking 130,000+ users. Even "Featured" tools can be traps. Learn how this resilient malware ecosystem works.
Atlassian’s new AI policy arrives Aug 17, 2026. Learn which tiers face mandatory data collection and how to protect your Jira and Confluence content.
Privacy expert Alexander Hanff warns that Claude Desktop installs a "native messaging bridge" without consent, potentially bypassing browser security sandboxes.
Vercel investigates a major breach by ShinyHunters. With Next.js source code and tokens at risk, developers must rotate secrets immediately. Stay updated.
Fiverr fails to fix a critical flaw exposing 30,000+ private PDFs, including taxpayer info, to Google Search. Learn how public Cloudinary URLs caused the leak.
Panther uncovers "OtterCookie," a North Korean npm campaign hiding malware in benign wrappers. It steals crypto wallets and installs SSH backdoors. Audit now!
Booking.com confirms a data breach exposing names, emails, and itineraries. Learn how to verify official alerts and protect yourself from new phone scams.
Hackers target Rockstar Games via Snowflake. While Rockstar calls the data "non-substantial," could internal budgets and future launch dates be at risk?
New research reveals massive security gaps in AI API aggregators. From stolen crypto to leaked tokens, learn why your API hub might be a Man-in-the-Middle trap.
Google settles for $135M over claims it used Android cellular data without consent. Check your eligibility and learn how to claim your share of the payout.