Balbooa Forms Joomla Flaw Lets Hackers Hijack Sites With a Single Upload
A critical Balbooa Forms Joomla vulnerability let anyone upload a file and take full control of a site, and attackers found it before the vendor did.
Secure.com News
Stay updated with the latest cybersecurity news, threat intelligence, and industry updates from secure.com.
Browse by Category
Progress Orders ShareFile Storage Zone Controller Shutdown Over Credible Threat
Progress ordered every ShareFile Storage Zone Controller shutdown after finding a credible external threat, with no patch and no explanation offered yet.
Microsoft Uncovers GigaWiper, a Backdoor That Waits, Watches, Then Destroys
Microsoft says the GigaWiper backdoor lets attackers spy quietly for months, then destroy a machine with a single numbered command.
Microsoft Signed the Driver. GodDamn Ransomware Used It to Blind Endpoint Security.
GodDamn ransomware is using a Microsoft signed kernel driver to shut off endpoint security before it locks a single file.
Accenture Confirms Breach as Hacker Puts 35GB of Source Code Up for Sale
Dateline: July 9, 2026 Source Code Was the Headline. The Azure Keys Are the Story. Somebody screenshotted themselves cloning an Accenture Azure DevOps repository and posted...
A Fake CAPTCHA, a Pasted Command, and a Live Operator Watching Your Bank Session
SCMBANKER malware is turning fake CAPTCHA pages into live banking fraud across Mexico's financial sector.
One Hacker, 72 Hours, and an Extorted AWS Environment
A single hacker pulled off an AI-assisted cloud attack on a global enterprise, breaking into AWS and extorting the company in about three days.
GitLost: A Fake GitHub Issue Can Trick AI Agents Into Leaking Your Private Code
The GitLost GitHub vulnerability lets attackers steal private repository data with nothing but a fake issue and a few lines of plain English.
A 15-Year-Old Linux Bug Just Handed Attackers the Keys to Root
A newly disclosed GhostLock Linux kernel vulnerability lets any logged-in user become root, and the exploit code is already public.
One Rented VM. Sixteen Years. And a Clean Path to the Whole Server.
A newly disclosed KVM flaw VM escape bug lets one rented cloud instance break out and hijack the entire host server.
86% of WordPress Sites Are Running Old Code. Attackers Already Noticed.
New research shows the vast majority of outdated WordPress sites are running old code that attackers scan for daily.
A Hidden Windows ID Helped the FBI Catch a Scattered Spider Suspect
A single Windows device ID drove the Scattered Spider arrest, showing how attackers get traced long after the attack.