Yoba Fake AI Installers Hide a Miner Behind Signed Apps
Check Point traced Yoba from fake ChatGPT and Claude downloads to signed-app DLL sideloading, a boot task and an XMRig miner. What to check if you ran it.
News desk
Security News
Security incidents, exploited vulnerabilities, breach reports, malware campaigns, and urgent patch notes arranged for fast daily scanning.
October 28, 2026
Latest reports
LiteLLM 1.107.0 Stole Secrets at Python Startup
A leaked key led to LiteLLM 1.107.0’s poisoned release. See how Python startup triggered credential theft and why checking with pip can be unsafe.
BlackX Bootkit Found a Trust Gap on Patched Windows PCs
BlackX reached patched Windows PCs that still trusted old boot components. The reported campaign shows why Secure Boot revocation and recovery planning matter.
Aokigahara Stealer Targets AI Sessions and Developer Keys
Aokigahara collects local AI sessions, Git and cloud credentials. What the October 23 research proves, and what to revoke after a Windows infection.
Meta’s $25B Privacy Penalty Exposes Facebook’s Broken Promises
A New Mexico judgment details Facebook’s app-access exceptions, limited data audits and deletion promises. What the $25 billion penalty actually means.
Tracebit Context Bombs Send AI Attackers Into Dead Ends
Tracebit tested deceptive documents and fake services against AI attackers. The AWS experiment shows how wasted work differs from preventing a real breach.
BUGSTER Used AI to Steal Thousands of University Records
Unit 42 links BUGSTER to a university database theft. The evidence separates confirmed stolen records from AI-generated attack plans and unfinished VoIP fraud.
FlashHole: Lazarus Turned Security Software Into a Way In
Lazarus used tailored portfolio sites, CrossWeb EX and in-memory malware in FlashHole. What the investigation establishes—and what remains unknown.
PHP2Shell Attacks: Update the Runtime Behind Your Website
PHP has patched two critical flaws as Cloudflare observes attack attempts. Check the fixed releases, vendor backports and PHP runtime actually serving your website.