The Hacker News

🚨 The malware arrives in pieces. The victim’s browser puts it together. SourTrade malvertising delivers a legitimate Bun runtime, malicious bytecode, and PE components separately, then uses the browser to build the final Windows executable with a different hash each session. See how the browser-assembled malware chain works: https://thehackernews.com/2026/07/malvertising-sends-malware-in-pieces.h…

🛑 ALERT - A malicious JSON request can become unauthenticated RCE on affected Spring Boot fat-JAR apps running Fastjson 1.x. Fastjson 1.x has no patched release, and ThreatBook and Imperva report attacks targeting the flaw. Learn how it works and who’s exposed: https://thehackernews.com/2026/07/fastjson-1x-rce-vulnerability-targeted.html

🚨 Insurance phishing kits are now hijacking accounts while victims are still logging in. InsureOTP relays stolen credentials and one-time passwords to legitimate insurance portals in real time, letting attackers complete authentication within the same browsing session. Read how the operation works: https://thehackernews.com/2026/07/ctm360-research-reveals-how-insurance.html

🚨 Cl0p-linked attackers are actively exploiting a critical unauthenticated RCE in internet-exposed PTC Windchill and FlexPLM systems. They chain two flaws, drop hex-named JSP webshells, and steal engineering data for double extortion. Manufacturing, automotive, aerospace, and retail firms are the main targets. Full details → https://thehackernews.com/2026/07/cl0p-affiliates-target-internet-expose…

⚠️ DevMan RaaS now runs a full affiliate portal. Experts (tracking it as Funky Mantis) say the platform handles payload builds, victim records, chat, teams, support, and payouts in one place. Affiliates get structured workflows, deadlines, and an 80/20 cut. 184 victims claimed so far. Read: https://thehackernews.com/2026/07/devman-raas-portal-centralizes-payload.html