DragonForce’s Backdoor.Turn routes ransomware C2 through Microsoft Teams TURN relays using anonymous visitor tokens — LOTI, living off trusted infrastructure. Why network detection dies and what still works.
Discover how AI is revolutionizing ransomware attacks in 2026 — from automated RaaS platforms to deepfake-powered extortion and actionable defense strategies.
Over 400 AUR packages hijacked via maintainer account takeover: poisoned PKGBUILDs ran a Rust credential harvester, with an eBPF rootkit where builds ran as root. Full breakdown and response steps.
Device code phishing surged 37x in 2026. How attackers exploit OAuth 2.0 device authorization grants to turn victims’ own MFA against them — plus detection strategies and defense hardening.
Three versions of node-ipc (10.1.1-10.1.3) shipped a stealer backdoor - CVE-2026-44338 - harvesting SSH keys, AWS credentials and .npmrc from 1.2M-weekly-download installs via DNS tunneling and HTTPS C2. Technical breakdown and hardening guide.
CVE-2026-41940 let unauthenticated attackers bypass cPanel/WHM/Webmail logins entirely — exploits hit before the patch existed. Ports 2082-2096 went dark industry-wide within the hour. Patched versions, response timeline, and audit steps inside.
One week in April 2026 delivered a CVSS 9.8 AI-agent flaw, an unauthenticated SGLang RCE, MCP memory poisoning, and a 766-host credential harvest. Here's the full analysis and your patching order.