A security researcher decompiled the White House’s new official app and found some alarming stuff buried in the code, including a hidden GPS tracking pipeline, JavaScript loaded from a random GitHub ...

Simply patching isn’t enough to prevent threat actors from exploiting SSL-VPN MFA Bypass CVE-2024-12802; here’s what you need ...

A large-scale campaign is exploiting a critical SQL injection vulnerability (CVE-2026-26980) in Ghost CMS to inject malicious ...

Hackers exploited a critical zero-day vulnerability in a server running the KnowledgeDeliver learning management system (LMS) to deploy the Godzilla web shell.

CVE-2026-5426, a hardcoded ASP.NET machineKey in KnowledgeDeliver, was exploited as a zero-day in ViewState deserialization ...

CVE-2026-5426 enabled KnowledgeDeliver LMS attacks before February 24, 2026, leading to Cobalt Strike infections.

A dependency confusion campaign leveraged 33 malicious npm packages to collect reconnaissance data from developer and build environments. This report details the attack chain, observed tradecraft, and ...

WICHITA, Kan. (KSNW) — After three decades, he has tendered his resignation. Ask Jeeves, an early giant in the search engine game that later became Ask.com, is no more. It now joins once-favored ...

A production-grade Node.js microservice that automates the full lifecycle of multi-domain (SAN) SSL certificates using the Let's Encrypt ACME protocol (RFC 8555). dns/ ├── src/ │ ├── api/ │ │ ├── ...

The CERT Division is a leader in cybersecurity. We partner with government, industry, law enforcement, and academia to improve the security and resilience of computer systems and networks. We study ...