Instagram API Breach Exposes 17.5M Users via Scraping Attack
A hacker published data from 17.5 million Instagram users on the dark web last week, exposing usernames, email addresses, phone numbers, and partial ...
React2Shell: 85,000 Next.js Apps Still Exposed to CVSS 10.0 Flaw
A critical vulnerability in React Server Components is being actively exploited by state-sponsored actors and ...
Flock Safety Hardcoded 53 Passwords in Police Cameras
Security researcher Ben Jordan discovered this week that Flock Safety—whose 90,000 surveillance cameras track 20 ...
Vietnam Bans Rooted Phones From Banking – Why This Fails
Vietnam's rooted phone banking ban takes effect March 2026. Why this security theater will fail ...
IBM Bob AI Agent Tricked into Running Malware via Prompt Injection
IBM’s AI Coding Agent Tricked into Running Malware IBM’s AI coding agent “Bob” can be ...
Tailscale Disables TPM Encryption: Security-by-Default Fails
Tailscale disabled TPM state file encryption by default Jan 7, 2026 after firmware updates broke clients. When security-by-default backfires in production.
NPM Staged Publishing: $50M Attack Forces Security Shift
npm announced staged publishing in January 2026, requiring review periods before packages go live. The ...
VS Code Fork Vulnerability: 500 Devs Hit by Supply Chain Attack
The Hidden Vulnerability Your AI-powered coding assistant may have just recommended malware. Security researchers at ...
IBM API Connect 9.8 CVSS Auth Bypass Hits 1,000+ Firms
A critical authentication bypass vulnerability in IBM API Connect allows remote attackers to gain unauthorized ...
38 State Tech Laws Hit Jan 1, 2026: AI Transparency Clash
On January 1, 2026, developers woke up to a new reality: 38 state tech laws ...