Malicious PyPI packages delivered ZiChatBot malware via Zulip APIs, Kaspersky says
Kaspersky says malicious PyPI wheel packages dropped ZiChatBot on Windows/Linux and used Zulip REST APIs for C2.
News desk
Cybersecurity News & Analysis
Security incidents, exploited vulnerabilities, breach reports, and urgent patch notes, arranged for fast scanning like a daily cyber newspaper.
July 12, 2026
Latest reports
Instructure Canvas Breach: Data Exposure, Login Defacement, and What Users Should Do
Instructure says Canvas is back online after a security incident involving names, emails, student IDs, and messages. Here is what is confirmed and what...
Apache HTTP Server 2.4.67 Fixes CVE-2026-23918 HTTP/2 RCE Risk
Apache HTTP Server 2.4.67 fixes CVE-2026-23918, an HTTP/2 double-free in 2.4.66 that can crash workers and may allow RCE in specific conditions.
DAEMON Tools Installers Carried a Backdoor Since April 8
Official DAEMON Tools installers reportedly carried a backdoor from April 8, 2026. Users who installed it recently should remove it, scan Windows, and wait...
Grok Wallet Drained After Bankr Prompt Injection Moves 3B DRB
A reported Bankr/Grok prompt-injection incident moved 3B DRB tokens from a labeled Grok wallet on Base after a gifted NFT and a crafted Morse-code...
Weaver E-cology CVE-2026-22679 RCE Is Being Exploited
CVE-2026-22679 is an unauthenticated RCE in Weaver E-cology 10.0 builds before 20260312. Patch exposed systems and check for post-exploitation activity.
30,000 Facebook Accounts Hacked in Google AppSheet Phishing Campaign
A Google AppSheet phishing wave dubbed AccountDumpling hijacked roughly 30,000 Facebook accounts, many tied to business pages and ad access.
Poisoned Ruby Gems and Go Modules Used to Steal CI Secrets
A BufferZoneCorp package cluster in RubyGems and Go targeted developer machines and CI pipelines, stealing secrets, tampering with GitHub Actions, and planting SSH persistence.
Gemini CLI CVSS 10 Flaw Could Put CI/CD Workflows at Risk
Google and security researchers disclosed a CVSS 10.0 flaw in Gemini CLI this week, with public details landing on April 28, 2026 and wider...
