Cyber Crime Archive

Two vulnerabilities rated CVSS 4.0 at 9.2 could expose PHP-powered websites and servers to remote code execution. Patchstack reports active exploitation, while administrators await an emergency security release scheduled for 14:00 UTC today. The PHP ecosystem is facing an urgent security incident following the disclosure of two

A major security incident involving Denmark’s Central Person Register (CPR) has resulted in unauthorized access to personal information belonging to approximately 8.8 million registered citizens. According to the Danish CPR administration, the incident occurred after unauthorized individuals exploited a legitimate access channel held by a Danish company

A large dataset containing information on more than 7.3 million Chess.com users is being shared for free on two data leak forums. The 15.5 GB dataset contains 7,337,395 user records. It includes email addresses, usernames, names, countries, chess ratings, subscription information and internal advertising audience tags. The

A newly disclosed security vulnerability affecting multiple Tenda router firmware versions has revealed the presence of a hidden authentication backdoor capable of granting attackers full administrative access without requiring legitimate login credentials. The issue, tracked as CVE-2026-11405, was published by the CERT Coordination Center (CERT/CC) under Vulnerability

The backdoor wasn’t a smash-and-grab. It wasn’t noisy, and it wasn’t rushed. It was planted quietly and left to sit for eight months before anyone flipped the switch. I traced the plugin’s history through 939 quicksave snapshots. The code tells a very specific story if you’re willing

A highly sophisticated supply chain attack has struck one of the most widely used JavaScript libraries in the world. Two malicious versions of the popular HTTP client axios—1.14.1 and 0.30.4—were published to npm after a maintainer account was hijacked, introducing a stealthy remote access trojan (RAT) affecting

In a sobering reminder that even widely trusted open-source projects can become collateral damage in geopolitical cyber conflict, the Notepad++ project has confirmed a prolonged and highly targeted supply-chain attack that compromised its update delivery infrastructure. The incident, which unfolded quietly over several months in 2025, did

The React Team has disclosed a critical security vulnerability affecting React Server Components that can allow unauthenticated remote code execution on affected servers. The issue is tracked as CVE-2025-55182 and carries a cvss score of 10.0, the highest possible severity rating. Developers using React Server Components are

The notorious Shai-Hulud malware has resurfaced in one of the most aggressive software supply-chain attacks seen in the open-source ecosystem, compromising more than 1,000 npm packages and triggering a wave of over 27,000 malicious GitHub repositories in mere hours. The campaign abuses a fake Bun JavaScript runtime

Discord has confirmed a data breach that may have exposed sensitive information from about 70,000 users. The incident resulted from a security compromise at a third-party service provider that handles the platform’s age verification appeals. When Discord suspects a user might be underage or when local laws