Malware | Breaking Cybersecurity News | The Hacker News

Cybersecurity researchers have discovered a NuGet typosquat that's unlike the typical information-stealing malware distributed via package registries: usual info-stealers: it's designed to rig live game results on Digitain. The package, named " Newtonsoftt.Json.Net ," masquerades as the Newtonsoft.Json library and is a trojanized fork. Seven versions of the package have been published to the NuGet repository: 11.0.4, 11.0.5, 11.0.7, 11.0.8, 11.0.9, 11.0.10, and 11.0.11. The package has been downloaded about 1,200 times to date. The package has been unlisted by its owner MagicalPuff96, meaning it will not be surfaced via a search on NuGet. However, the artifacts are still available for download from the registry. "The trojan rigs Digitain, an online betting platform, and in later generations, exfiltrates rigged round results to an attacker-controlled server, utilizing the header X-Seq-ApiKey: theperfectheist2025," according to JFrog . What's not...

A third SharePoint Server flaw patched by Microsoft as part of its Patch Tuesday update for July 2026 has come under active exploitation, per watchTowr . The vulnerability in question is CVE-2026-50522 (CVSS score: 9.8), a critical deserialization of untrusted data in Microsoft Office SharePoint that could allow an unauthorized attacker to execute code over a network. Microsoft credited DEVCORE researcher "splitline" with discovering and reporting the flaw. "In a network-based attack, an attacker authenticated as at least a Site Owner, could write arbitrary code to inject and execute code remotely on the SharePoint Server," Redmond said in an advisory released last week. "The attack vector is Network (AV:N) because this vulnerability is remotely exploitable and can be exploited from the internet. The attack complexity is Low (AC:L) because an attacker does not require significant prior knowledge of the system and can achieve repeatable success with the ...

Attackers have begun to exploit two critical vulnerabilities in WordPress that, when combined together, enable unauthenticated remote code execution (RCE) and complete compromise of vulnerable websites. The two security flaws, tracked as CVE-2026-63030 and CVE-2026-60137 , have been codenamed wp2shell . "By the early hours of Saturday morning (UTC), successful exploitation was already well underway, initially using public exploit code to exfiltrate hashed credentials, with remote code execution following once additional details were made public," Jake Knott, principal security researcher at watchTowr, told The Hacker News in a statement. "From our vantage point across a global client base, we are seeing widespread impact of this vulnerability across organizations of every size and every vertical." Telemetry data captured by KEVIntel shows that 13 unique IP addresses from Switzerland, Germany, the U.K., Indonesia, Lithuania, the Netherlands, and Singapore h...

Researchers at Sysdig have linked a second attack on the same Langflow server to JADEPUFFER , the AI-agent-driven operator it first documented earlier this month. The same operator has now been spotted deploying ENCFORGE , a new compiled Go ransomware designed to encrypt model weights, vector indexes, training datasets, and other AI infrastructure files across the host filesystem. The entry point did not change. Langflow versions before 1.3.0 expose the /api/v1/validate/code endpoint without authentication, allowing any remote attacker to execute arbitrary Python on the server. The flaw, CVE-2025-3248 , carries a CVSS score of 9.8 and has been in CISA's Known Exploited Vulnerabilities catalog since May 5, 2025. As The Hacker News reported earlier this month, the prior operation used throwaway Python code and MySQL's AES_ENCRYPT() function to encrypt and destroy data in Nacos (Alibaba's configuration server) and production databases. The new ENCFORGE payload re...

Cybersecurity researchers have discovered nearly 7,600 malicious GitHub repositories, out of which more than 800 pose as artificial intelligence (AI) skills or Model Context Protocol (MCP) servers to deliver a malware family known as SmartLoader as part of an ongoing campaign codenamed FakeGit . "FakeGit uses copied projects, lookalike developer profiles, convincing READMEs, and malicious ZIP files to deliver SmartLoader malware," Oleg Zaytsev, lead security researcher at Island, said in a report shared with The Hacker News. The end goal of these attacks is to leverage the access afforded by SmartLoader to establish persistence and push secondary payloads, such as StealC, an information stealer capable of harvesting a wide range of data from compromised systems. It's worth mentioning here that the use of trojanized MCP servers to distribute SmartLoader and StealC was flagged earlier this year by Straiker AI and subsequently by Derp.ca . But a concerning aspect ...