News that matters, without the noise.

Hackers poison arrayref Rust crate to push infostealer malware

Hackers compromised the maintainer account behind the widely used Rust crate arrayref to introduce malware that executed on

AI-Generated Exploit Scripts Target Siemens S7 PLCs in U.S. Critical Infrastructure

The U.S. government on Wednesday warned of an “active threat” targeting critical infrastructure organizations in the country using

USN-8654-1: Netty vulnerabilities

It was discovered that Netty did not properly handle malformed HTTP/2 control frames. An attacker could use this

RHSA-2026:57580: Important: dracut security update

An update for dracut is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat

DSA-6453-1 libgit2 – security update

https://security-tracker.debian.org/tracker/DSA-6453-1

CRLF-Powered Desync Lets Attackers Poison CDN Cache and Serve XSS to Live Users

A limited CRLF injection flaw can be escalated into a severe HTTP desynchronization attack, poisoning CDN caches and

AWS Shows How to Stop a Hijacked AI Agent From Reading Data the User Cannot Access

Enterprises are racing to deploy AI agents that pull from databases, document repositories, SaaS platforms, and internal knowledge

Microsoft Defender Driver Can Be Weaponized to Disable EDR and AV From Windows Kernel

Microsoft Defender’s legitimate Boot-Time Removal (BTR.sys) driver can be repurposed to perform powerful kernel-level file and registry operations,

Popular Rust Packages With 244M Downloads Compromised to Run Malware

A major supply chain attack targeting the Rust ecosystem, in which two widely used crates, arrayref and append-only-vec,

Stop Expecting AI Perfection ❌

Why AI Still Can’t Replace Your Best Analyst

New Cryptographic Context Injection Attack Could Let Web Pages Steal Grok Chat Data

Adversa AI has disclosed an attack technique that it says can cause xAI’s Grok chatbot to send a