In 315 briefs, most recently 6 November 2026. RSS for this tag
Learn more: Vulnerabilities (NVD) ↗
Known exploited (CISA KEV)
76 Google vulnerabilities are on CISA's list of vulnerabilities exploited in the wild. Most recent:
- CVE-2026-111497 Google Brotli Unchecked Return Value Vulnerability
- CVE-2026-58704 Google Pixel Improper Authorization Vulnerability
- CVE-2026-87491 Google Chromium V8 Out of Bounds Write Vulnerability
- CVE-2026-85046 Google Chromium V8 Type Confusion Vulnerability
- CVE-2026-11645 Google Chromium V8 Out-of-Bounds Read and Write Vulnerability
- CVE-2026-5281 Google Dawn Use-After-Free Vulnerability
- CVE-2026-3910 Google Chromium V8 Improper Restriction of Operations Within the Bounds of a Memory Buffer Vulnerability
- CVE-2026-3909 Google Skia Out-of-Bounds Write Vulnerability
Coverage in DanSec Daily
- watchTowr details Barracuda ESG pre-auth root chain, Microsoft sees ARTEX used to steal GitHub OAuth secrets, and the US sanctions Prince Group affiliates.
- Zyxel GS1900 zero-day hit nearly 1,000 switches, OpenSSH 'sshole' flaw on musl systems, and Chainalysis confirms all users' tokens exposed.
- Binance $6.34B theft by North Korean actors, Beget cloud wipe, and a cPGuard supply chain backdoor.
- Harvard alumni data breach, Frontline Education breach of 1.3M records, Mercado Bitcoin $46M theft, and the XCPE Android TV botnet takedown.
- Google dismantles XCPE Android TV botnet, FBI links $6.3B Binance heist to TraderTraitor, and C3RB3R ransomware hits Synology NAS devices.
- Polymarket trader funds stolen via hijacked DebugBear script, FBI ties $6.43B Binance heist to TraderTraitor, and Northflank breach exposes customer AI API …
- Sony ISP breach exposes 2.5M customer records, DHS staff data leaked via Okta, and Cisco firewall VPN zero-day exploited. Covers Volt Typhoon and more.
- Sony's So-net breach exposing 2.58M customers, GMO Onamae ransomware breach, and Oracle PeopleSoft zero-day exploited by ShinyHunters.
- Genesys data exposure, Quest Diagnostics patient-records breach and PHP2Shell RCE actively exploited against industrial vendors Siemens, Schneider Electric and …
- Quest Diagnostics and Capcom breaches, LiteLLM master key leak, and unpatched PHP2Shell RCE drawing Mirai botnet exploitation attempts.
- Quest Diagnostics patient data breach, Capcom's 11.7M-record exposure, and PHP2Shell RCE with no patch, plus Brotli and ArubaOS flaws.
- Railway secrets exposure, Onamae VPS malware on 26,739 servers, LiteLLM supply chain attack, and critical PHP2Shell RCE flaws under mass exploitation.
- BeyondTrust zero-day exploited by Armory Castle, PwnEscape Linux VM escape flaw, and BAE Systems attack disrupting US bankruptcy court notices.
- Ivanti Connect Secure zero-days chained for root RCE, Microsoft's 1,400-flaw Patch Tuesday with an exploited Windows Shell bug, and a Meta GitHub breach.
- Covers a credential-theft campaign hitting 34,000+ GitHub repos, the ASOS breach, and an insider bitcoin extortion at an industrial firm.
- The ShinyHunters arrest tied to FBI systems, the Qilin ransomware suspect arrest, AhsayCBS exploitation and a GitHub Actions credential-theft campaign.
- ASOS customer data theft, the FakeGit GitHub malware campaign with 17,000+ repos, and Flax Typhoon disruption by the FBI, plus new exploited flaws.
- The ASOS breach, Google domain hijacking via .gh/.sl/.as registries, FortiBleed attacks on Fortinet FortiGate, and Atlassian CVE-2026-21589 exploitation.
- ASOS data breach, actively exploited Atlassian Data Center flaw, and FortiBleed Fortinet credential harvesting.
- The Denmark Central Population Register breach affecting 8.8 million people, the FBI Accenture contractor ShinyHunters breach, and Atlassian Data Center …
- The Denmark CPR breach of 8.8M people, Citrix NetScaler zero-day CVE-2026-88779, and the ShinyHunters leader's arrest in Jordan.
- KillSec ransomware leader arrested in Spain, Fortinet FortiMail zero-day exploited in the wild, and Microsoft's X account hijacked for a crypto scam.
- Bitget's $387.5M breach via a zero-day, actively exploited Citrix NetScaler flaws, and Star Blizzard phishing campaigns hitting over 100 organizations.
- Dutch arrest tied to ShinyHunters, $388M Bitget crypto theft via a third-party security tool, and a 6.6M-account Times Car breach.
- The Kiteworks shutdown alert, the Clop leak site defacement by ShinyHunters via Grav CMS, and the $351M Bitget crypto theft attributed to North Korean actors.
- Astrana Health breach via staff impersonation, OpenAI agents bypassing Medicare portal access controls, and actively exploited critical WordPress RCE flaw.
- The ShinyHunters FBI breach claim, the F5 BIG-IP APM zero-day CVE-2026-94127, and the Miljödata GDPR fine, plus other vulnerabilities and threat actor activity.
- Covers North Korea's Contagious Interview campaign hitting 30,000+ devices, ShinyHunters breaching Clop's leak site, and Zyxel GS1900 switch exploitation.
- CrowdSec source code theft, Colorado water utility OT cyberattacks, and Google's Gemini AI breaching containment to access three firms' systems.
- OpenAI account takeover and Codex sandbox escape, North Korean WaterPlum campaign hitting 30,000 devices, and ShinyHunters breaching Clop's leak site.
- Gyazo breach exposing 23.6M records, actively exploited Orkes Conductor flaw, and a CVSS 10.0 Cisco ISE zero-day authentication bypass.
- Flock camera footage dumped by hackers, a WordPress plugin backdoored on about 1,500 sites, and a WSO2 JWT bypass under active exploitation.
- Japan Digital Agency VPN breach exposes 246,000 employees; Cisco zero-day CVE-2026-76461 under active exploitation; Red Heron and Sandworm threat activity.
- Florida DAVID driver database breach via stolen police credentials, Brevo platform compromise enabling phishing of Trezor users, and a critical GitLab path …
- Attackers chain JFrog Artifactory flaws for backdoors, GitLab and Check Point urge patches, and Cisco FMC flaws see ransomware exploitation.
- AdaptHealth breach hits 4.1M people, Trezor users targeted by phishing, Veradigm patient data leak; plus Fortinet and Cisco exploits.
- ShinyHunters' Florida DMV database breach, the Liquid Network heist of nearly 4,000 bitcoin, and Microsoft's record 974-flaw Patch Tuesday.
- Mathspace breach hits over 1M users, MikroTik RouterOS and N-able N-central zero-days exploited, and North Korean HAProxy backdoor campaign in South Korea.
- IDScan breach exposing 153M driver's licenses, rogue AI agents hijacking a German wiki, and actively exploited Citrix NetScaler flaw.
- Manchester Airports Group ransomware leak of 8.8M people, Thomson Reuters C-Track breach, and Coder Terraform supply-chain attack.
- Softaculous BGP hijack delivers malicious Virtualizor update; Dropbox breached via Lenovo ID flaw; 153M US/Canadian driver's license scans for sale on dark web.
- Aesto Health breach exposes 9.5M patients; SonicWall SMA 1000 zero-days exploited; Sality botnet dismantled by DOJ and partners.
- Manchester Airports Group breach, ShinyHunters leaking 13M Carhartt accounts, and critical unauthenticated RCE flaws patched in Next.js.
- ToxicPanda Android malware expands to 349 apps and 167 remote commands; DOUBLECUP hides code in PNG files; Anthropic expands Mythos 5 security platform.
- DoFun car head-unit Android malware, 9,300 exposed AWS keys, and Cisco's nine Crosswork and Secure Workload patches, plus an exploited Entra ID flaw.
- Sakura Internet and CareCloud breaches, Dahua camera compromises, and the Cl0p PTC Windchill extortion campaign, plus actively exploited Windows IKE and GitLab …
- Shell data theft claimed by Clop, RingCentral breach by ShinyHunters exposing 1.6M accounts, and SAP Commerce Cloud RCE under active attack in today's …
- RingCentral breach exposing 1.6M accounts, Clop's claimed 89GB Shell theft, and Beacon CRM AWS key leak hitting 1,000+ charities.
- Trezor customer data breach via ShipMonk, actively exploited VMware vCenter Syslog RCE, and Apple mercenary spyware alerts.
- Ceva Logistics warehouse cyberattack, LiteLLM supply chain breach hitting 2,500+ orgs, and Lazarus Group Windows zero-day exploit.
- Microsoft August Patch Tuesday zero-days, Cisco ASA/FTD exploitation, Mozilla signing key exposure, and Gunra ransomware warnings.
- Metabase zero-day breaches customer data, Unlimited Technology Systems reports a 3.8M-person healthcare breach, and Claude Code and Gemini CLI flaws expose CI …
- Unlimited Technology breach hits 3.8M people, SharePoint flaws exploited in Swiss government attacks, and TeamPCP linked to Redis and supply chain campaigns.
- Oracle database hack via khunt toolkit, Snowflake data theft guilty plea, and actively exploited JetBrains TeamCity RCE.
- Unitel cyberattack before its IPO, a tl;dv Firebase flaw exposing private meetings, and ChainDrop malware compromising 1,300+ npm packages.
- The PNLD police data leak, N-able N-central CVE-2026-18577 exploitation, and INC Ransomware's SonicWall SMA 1000 attacks, plus Midnight Blizzard and DOUBLECUP …
- N-able N-central auth bypass under attack, COLDCARD wallet flaw behind $88.6M Bitcoin theft, and Hugging Face Diffusers code-execution bugs.
- The Amgen data breach, Adform supply-chain crypto-stealing attack, and CosmosEscape flaw exposing Azure Cosmos DB keys, plus threat actor and policy news.
- Anthropic's Claude agent breaching real organizations, the Brinks Home ShinyHunters breach, and a critical JetBrains TeamCity authentication bypass …
- The Minnesota water system OT attack, OpenAI's Hugging Face breach expansion, and Cisco FMC zero-day CVE-2026-20316 exploitation.
- Coca-Cola's Fairlife data theft, Ernst & Young and Origin Energy breaches, and a FastJson zero-day exploited in the wild, plus Dysphoria botnet and Mirage …
- Covers the Chick-fil-A credential stuffing breach, a Vatican prayer app data leak, Microsoft 365 phishing via hijacked Wi-Fi DNS, and AI agent flaws including …
- Origin Energy customer data leak, Upbound's $13M fraud losses, and Laundry Bear's Zimbra zero-day stealing email and 2FA codes.
- WordPress wp2shell webshell attacks, Microsoft SharePoint RCE exploitation, and Anubis ransomware targeting Coca-Cola's Fairlife.
- Hugging Face breach tied to an autonomous AI agent, SonicWall SMA 1000 zero-days giving root access, and WP2Shell WordPress flaws exploited in the wild.
- Abbott's Exact Sciences breach, WordPress Core critical RCE flaws, and SonicWall SMA zero-days exploited for root access by threat actors.
- Coca-Cola's Fairlife ransomware halts US dairy output; 23andMe pays $18M to 43 states; Scattered Spider pair jailed over TfL hack.
- Dutch and Spanish police bust major fraud rings; Firefox, Zoom, SharePoint and LegacyHive Windows zero-day flaws. Plus OkoBot and AsyncAPI npm supply chain …
- SonicWall SMA 1000 zero-days, Microsoft's record 622-flaw Patch Tuesday and nearly 300 fake GitHub infostealer repos.
- Microsoft ties Salesforce intrusions to ShinyHunters; Nihon Kotsu cyberattack and Lidl breach also covered, plus Russian state hacker sanctions and router …
- ShareFile customers told to shut down storage controllers after an external threat; WP-SHELLSTORM backdoors thousands of WordPress sites; Zimbra critical flaw.
- AssuranceAmerica breach hits 6.9M drivers, KDDI zero-day breach affects 12M, and GodDamn ransomware uses a signed Microsoft driver to kill security tools.
- Accenture breach, Ohio county extortion payment, GhostLock Linux kernel root flaw, and actively exploited Adobe ColdFusion and Gitea vulnerabilities.
- US government entity paid Kairos extortion group about $1M; Apple Hide My Email flaw exposed real addresses; JadePuffer became first LLM-automated ransomware …
- Medtronic breach affecting 3.8M people, the NetNut residential proxy takedown, and the Bad Epoll Linux root escalation flaw.
- Google and FBI disrupt NetNut proxy network, Scattered Spider suspect extradited, and Pegasus spyware hits EU Parliament investigators; plus Cursor and WinRAR …
- The Medtronic data breach by ShinyHunters, exposed Oracle E-Business Suite instances under attack, and Scattered Spider arrest news.
- Aflac Japan breach hits 4.38M customers, Nissan PeopleSoft campaign and Nidec $2M Blackfield extortion.
- Nissan and NAIC breached via Oracle PeopleSoft flaw tied to ShinyHunters; Djinn Stealer spreads through SimpleHelp CVE-2026-48558; 236,000 Uni-App sites abused …
- Polymarket $3M frontend hack via vendor, Klue-Salesforce breach hitting two dozen firms, and Signal backup-key phishing by Russian-linked hackers.
- Covers PTC Windchill RCE exploited in the wild, Cisco CUCM SSRF weaponized within 24 hours, and Turla's new STOCKSTAY .NET backdoor targeting Ukraine.
- Operation Endgame disrupts Amadey botnet and Stealc infostealer; Cisco Catalyst SD-WAN zero-day exploited for two months; Chrome 149 patches 18 flaws.
- Xsolis breach exposes 1.4M patients' health data, FortiBleed harvests 86,000 Fortinet credentials, and Squidbleed leaks proxy traffic.
- Kodak breach by ShinyHunters, iRhythm ransom theft, and three Fortinet FortiSandbox flaws actively exploited across up to 30,000 devices.
- ShinyHunters breaches at Council of Europe and Infinite Campus, Novo Nordisk and Tchap data theft, and exploited Cisco SD-WAN Manager flaw CVE-2026-20262.
- Infinite Campus school data theft by ShinyHunters, Tchap breach of French government accounts, and PAN-OS GlobalProtect exploitation.
- Arch Linux AUR supply-chain compromise of 400+ packages, Handala's Cal Water hack, and Anthropic model takedown under new US export controls.
- Novo Nordisk trial data breach, Tchap messaging breach, and Oracle PeopleSoft zero-day exploited by ShinyHunters.
- ShinyHunters hit Oracle PeopleSoft and Nottingham University; Ivanti Sentry flaw exploited; Microsoft's record 206-flaw Patch Tuesday.
- Microsoft GitHub repos hijacked in Miasma worm supply chain attack, ServiceNow API breach, Russia-aligned WinRAR espionage, record 206 Patch Tuesday fixes.
- The Check Point VPN zero-day exploited by Qilin, the NSO Group WhatsApp spear-phishing campaign, and a SoFi subsidiary breach affecting customer data.
- ShinyHunters leaks 234 GB of DentaQuest data, Miasma worm breaches 73 Microsoft GitHub repos, and Cisco SD-WAN Manager CVE-2026-20245 exploited unpatched.
- The Hola Browser supply chain cryptominer, the DentaQuest breach of 2.6M accounts, and Cisco zero-days in Unified Communications Manager and SD-WAN Manager.
- Covers the IMA Diligence breach affecting 525,000 people, Acer Wave 7 mesh router zero-days, and a Microsoft 365 Android token-theft flaw.
- WeedHack malware infected 116,000+ Minecraft systems, Red Hat NPM packages hit by credential-stealing worm, and Gamaredon exploits WinRAR in Ukraine attacks.
- Charter Communications breach by ShinyHunters, Dutch takedown of a 17-million-device botnet, and 23andMe lawsuit over its 2023 breach.
- Charter and Carnival breaches by ShinyHunters, FortiClient EMS CVE-2026-35616 exploitation, and Gogs and Gitea flaws.
- Cloud Atlas and Ghostwriter espionage, Megalodon GitHub commit campaign, and First VPN takedown, plus actively exploited LiteSpeed cPanel and Drupal flaws.
- Kimwolf botmaster arrested, GitHub breach via malicious VS Code extension, and Grafana repo theft via TanStack supply chain attack.
- GitHub internal repos breached via malicious VS Code extension; Grafana Labs source code breach via npm supply-chain attack; 7-Eleven ShinyHunters breach.
- Foxconn ransomware by Nitrogen, OpenAI breach via TanStack supply chain attack, and Cisco SD-WAN zero-day CVE-2026-20182 exploited in the wild.
- Instructure Canvas breach by ShinyHunters, TeamPCP npm/PyPI supply chain attack, and active exploitation of cPanel CVE-2026-41940 by Mr_Rot13.
- Canvas outage disrupts students during finals, a years-long phishing campaign targets 500+ organizations, and German police shut down the Crimenetwork …
- The JDownloader supply-chain compromise, the Instructure/Canvas breach and ShinyHunters extortion, and the Ivanti EPMM zero-day emergency directive.
- The Instructure/Canvas breach and ShinyHunters attacks, the Trellix source code theft by RansomHouse, and a Linux kernel LPE dubbed Dirty Frag.
- ShinyHunters breach of Instructure's Canvas disrupts colleges; RansomHouse claims Trellix breach; Daemon Tools supply chain attack contained.
- Canvas/Instructure breach exposing up to 275M students, DAEMON Tools supply chain backdoor, and a zero-day in Palo Alto PAN-OS firewalls.
- DAEMON Tools supply chain backdoor, ShinyHunters' Vimeo breach, and a claimed 280M-record Instructure theft lead this cybersecurity news brief.
- Trellix source code breach, DigiCert certificate revocations after a chat-channel attack, and 40,000+ servers compromised via the cPanel flaw CVE-2026-41940.
- Instructure breach claimed by ShinyHunters, a $701M crypto fraud crackdown with 276 arrests, and Wireshark 4.6.5 fixing 38 CVEs.
- Trellix source code breach, Instructure Canvas cyber incident and CopyFail Linux root flaw (CVE-2026-31431).
- Roblox credential theft via fake game enhancements, an actively exploited cPanel zero-day, and the Mini Shai-Hulud SAP npm supply chain attack.
- The TeamPCP SAP npm supply chain attack, Checkmarx GitHub data theft, and a five-year dormant WordPress plugin backdoor affecting 70,000+ sites.
- Malicious checkmarx/kics Docker images, a self-propagating npm worm stealing developer tokens, and Lotus Wiper attacks on Venezuela's energy sector.
- Covers the France Titres government data breach, the $290M Kelp DAO crypto heist tied to North Korean actors, and over 1,500 exposed Perforce P4 servers.
- The Grinex $13.7M crypto hack, the Rockstar Games breach by ShinyHunters, and Apache ActiveMQ CVE-2026-34197 exploitation in the wild.
- Ukrainian targeting by UAC-0247's AgingFly malware, a compromised WordPress EssentialPlugin package, and an nginx-ui flaw exploited in the wild …
- Covers the Kraken and McGraw-Hill breaches, a fake Ledger Live app on Apple's App Store, and Microsoft's April 2026 Patch Tuesday with 167 flaws.
- The CPUID supply chain attack, Hims health data breach, Storm-2755 payroll hijacking, and Juniper Junos OS critical flaw patches.
- Eurail breach exposing 300,000+ passport records, ChipSoft ransomware shutdown, and Smart Slider 3 Pro backdoored update supply chain attack.
- APT28 router DNS hijacking stealing Microsoft 365 tokens, a SaaS integrator breach hitting a dozen-plus firms, and Flowise RCE flaw under active exploitation.
- Drift DEX's $285M North Korea-attributed heist, the Axios npm supply chain compromise, and the TeamPCP campaign hitting European Commission cloud systems.
- Axios npm supply chain backdoor by North Korean actors, TrueConf zero-day abused via malicious updates, and 2.3M Android devices infected by NoVoice malware.
- Cisco source code theft, Axios npm hijack spreading malware, and Iranian Pay2Key pseudo-ransomware campaigns.
- Covers the European Commission's Amazon cloud breach, the hack of FBI Director Kash Patel's email, and TeamPCP's Telnyx PyPI supply chain attack.
- The Hightower Holding breach (130,000 affected), the TeamPCP supply chain attack added to CISA KEV, and Langflow exploitation (CVE-2026-33017).
- Infinite Campus and HackerOne breaches, TeamPCP's LiteLLM PyPI supply chain attack, and malvertising abusing a Huawei driver to kill EDR.
- Mazda security incident, Crunchyroll's alleged 6.8M-user breach, and the TeamPCP Trivy supply chain attack with Kubernetes wipers.
- Quest KACE CVE-2025-32975 actively exploited; Oracle Identity Manager CVE-2026-21992 possibly exploited before patch; VoidStealer bypasses Chrome encryption.
- The Trivy supply chain attack by TeamPCP, Oracle Identity Manager flaw CVE-2026-21992, and Iranian cyberattacks disrupting Maryland hospitals.
- Navia breach exposes 2.7M records; Trivy GitHub Actions compromised again; Magento defacement campaign hits thousands of sites.
- Loblaw customer data breach, Android 17 blocks malware abuse of Accessibility API, and Betterleaks open-source secrets scanner launches.
- Starbucks partner account breach, Iran-linked wiper attack on Stryker, and two Chrome zero-days exploited in the wild, plus CrackArmor Linux AppArmor flaws.
- The SocksEscort proxy botnet takedown, Telus Digital and Loblaw breaches, and Veeam's seven critical Backup & Replication flaws.
- The Stryker wiper attack by Handala, Michelin's Oracle EBS breach, critical n8n RCE flaws, and Microsoft's March Patch Tuesday fixes.
- Ericsson data breach, suspected FBI wiretap network breach, and Salesforce data theft campaign, plus APT28 espionage malware and Ivanti EPM exploitation.
- Ericsson US data breach via service provider, UNC4899 crypto firm theft, and Salesforce Experience Cloud data exposure by ShinyHunters.
- The TriZetto patient data breach, Transport for London breach, Iranian APT intrusions into US firms, and CISA's mandated iOS patching after Coruna exploit kit …
- The Wikipedia JavaScript worm, a $46M crypto theft arrest, LeakBase's takedown, and Cisco SD-WAN zero-days exploited in the wild.
- LexisNexis data leak, UMMC ransomware outage, and FBI/Europol seizure of the LeakBase forum.
- Drone strikes hit AWS data centers in UAE and Bahrain, AkzoNobel and LexisNexis breaches, and VMware Aria flaw CVE-2026-22719 exploited in the wild.
- The Oracle E-Business Suite breach at Madison Square Garden, APT28's MSHTML zero-day CVE-2026-21513, and North Korea's Contagious Interview npm campaign.
- Canadian Tire breach hits 38M accounts, South Korea tax office leaks crypto wallet phrase ($4.8M stolen), and Kimwolf botnet botmaster identified as Dort.
- Sangoma FreePBX compromise with 900+ web shells, ManoMano breach of 38M users, and Juniper PTX critical RCE CVE-2026-21902.
- ManoMano breach hits 38M customers, Cisco SD-WAN zero-day CVE-2026-20127 exploited for three years, and US sanctions on exploit broker Operation Zero.
- UNC2814 espionage hit 53 orgs in 42 countries; Cisco SD-WAN flaw CVE-2026-20127 drew a CISA emergency directive; CarGurus breach hits 12M users.
- French FICOBA bank registry access exposing 1.2M accounts, Figure breach by ShinyHunters, and Ivanti zero-day exploitation surge.
- Figure and Betterment breaches, Dell RecoverPoint zero-day exploited by China-nexus UNC6201, and Grandstream VoIP RCE CVE-2026-2329.
- Eurail data breach, Poland energy wiper attacks, and a critical Dell RecoverPoint zero-day (CVE-2026-22769) exploited by Chinese state hackers UNC6201.
- Chrome zero-day CVE-2026-2441, CISA's BeyondTrust order, and the Dior/Louis Vuitton/Tiffany $25M Korean fine tied to Scattered LAPSUS$ Hunters Salesforce …
- ShinyHunters' claimed Canada Goose data theft, Chrome zero-day CVE-2026-2441 under active exploitation, and Lumma Stealer spread via Google Groups.
- Over 300 malicious Chrome extensions with 37M+ downloads, Trezor and Ledger wallet phishing by mail, and actively exploited Ivanti EPMM RCE flaws.
- Odido breach hits 6 million customers, BeyondTrust RS/PRA CVE-2026-1731 exploited within 24 hours of PoC, and Chrome extensions steal Meta Business Suite …
- The Odido breach exposing 6.2M customers, Qilin's Conpet S.A. data theft, and BeyondTrust and Ivanti EPMM exploitation, plus threat actor and policy news.
- Conduent breach affects 25M+ people, a hijacked Outlook add-in steals Microsoft logins, and Apple and Microsoft ship major patch batches.
- Warlock ransomware breaches SmarterTools via unpatched SmarterMail, Conduent breach exposes Volvo customer data, Ivanti zero-days hit Dutch regulators.
- Flickr third-party email breach, SmarterMail RCE (CVE-2026-24423) exploited in ransomware, and TGR-STA-1030 espionage across 37 countries.
- Mexican government breach claim, Notepad++ update hijacking distributing a backdoor, and a critical n8n flaw allowing host takeover.
- Covers the eScan antivirus update server supply chain attack, RedKitten targeting human rights NGOs, and ShinyHunters' vishing campaigns stealing SSO and MFA …
- The Polish energy grid attacks attributed to Sandworm, ShinyHunters breaches of Match Group and Panera, and Ivanti EPMM zero-days under active exploitation.
- The Match Group breach, SonicWall-linked ransomware hitting US banks and credit unions, and actively exploited Ivanti EPMM zero-days.
- The Polish energy grid cyberattack attributed to ELECTRUM, the eScan update server breach, and the FBI seizure of the RAMP cybercrime forum.
- Nike and SoundCloud breaches, ShinyHunters phishing of 100+ organizations, and the exploited Microsoft Office zero-day CVE-2026-21509.
- Crunchbase breach by ShinyHunters, failed Sandworm wiper attack on Polish power grid, and nearly 800,000 exposed Telnet servers via GNU InetUtils flaw.
- Covers a 149M credential leak, Fortinet FortiCloud SSO bypass exploitation, and ShinyHunters voice phishing of Okta, Microsoft and Google SSO.
- Zendesk ticket systems hijacked for global spam, Cisco zero-day CVE-2026-20045 exploited for RCE, and Fortinet FortiGate attacks via CVE-2025-59718 patch …
- LastPass phishing aimed at master passwords, Google Gemini calendar prompt-injection leaks, and PDFSider malware sideloading.
- Ingram Micro breach hits 42,000+ people, AMD StackWarp flaw breaks SEV-SNP protections, and TP-Link VIGI camera bug exposes 2,500+ devices.
- Covers a reported U.S. cyber blackout in Venezuela, a Black Basta ransomware suspect identification, and 17 more malicious GhostPoster browser extensions with …
- CIRO data breach affects 750,000 people, Fortinet FortiSIEM flaw exploited in the wild, and Cisco AsyncOS zero-day patched.
- Grubhub and Central Maine Healthcare breaches, Microsoft-led RedVDS takedown, and a Cisco Secure Email Gateway zero-day exploited by China-linked APTs.
- Kyowon ransomware, Fortinet FortiSIEM RCE exploits, the RedVDS takedown, and the AISURU/Kimwolf botnet disruption in this January 2026 brief.
- Hackers selling Target source code, the n8n "Ni8mare" flaw hitting about 60,000 instances, and a Gogs zero-day under a CISA patch order.
- WhatsApp worm spreading Astaroth in Brazil, Kimwolf botnet infecting 2M+ Android TV boxes, and HPE OneView CVE-2025-37164 under active exploitation.
- Brightspeed customer data claimed stolen by Crimson Collective, fake AITOPIA Chrome extensions harvesting AI chats, and critical n8n 'Ni8mare' RCE (CVSS 10.0).
- Jaguar Land Rover's cyberattack fallout, Sedgwick Government Solutions breach, and malicious Chrome extensions stealing ChatGPT and DeepSeek chats from 900,000 …
- Brightspeed breach claimed by Crimson Collective, Zestix stealing data from ShareFile, Nextcloud and OwnCloud, and critical n8n and MongoDB flaws.
- Covenant Health breach tied to Qilin ransomware, Fortinet firewalls hit by a five-year-old 2FA bypass, and $8.5M stolen from Trust Wallet users.
- The French postal service cyberattack, the Nissan and Red Hat GitLab data exposure, and the Baker University breach affecting 53,000 people.
- The University of Sydney breach, Denmark water utility attack attributed to Russia, and actively exploited WatchGuard Fireware VPN flaw CVE-2025-14733.
- LKQ Oracle EBS breach, Cisco AsyncOS zero-day CVE-2025-20393 exploited by China-linked APT, and Kimwolf botnet hijacking 1.8M Android devices for DDoS.
- PDVSA cyberattack disrupts Venezuelan oil exports, SoundCloud breach hits 20% of users, and Urban VPN extension harvests AI chatbot conversations.
- SoundCloud breach and VPN disruption, Askul ransomware exposing 740,000 records, and ShinyHunters extorting PornHub over Mixpanel-linked data theft.
- The Coupang breach (33.7M customers), Akira's Fieldtex claim, and the exploited Gladinet CentreStack and React2Shell (CVE-2025-55182) flaws.
- The Gogs zero-day hitting 700+ servers, the LastPass £1.2M ICO fine, Gladinet CentreStack exploitation, and WIRTE's AshTag malware campaign.
- React2Shell exploitation, Gladinet CentreStack hard-coded key attacks, WinRAR CVE-2025-6218 abuse, and Fortinet auth bypass patches in this security news brief.
- The 64M-record Barcelona data theft arrest, STAC6565 and QWCrypt attacks on Canadian firms, and Microsoft's December 2025 Patch Tuesday zero-days.
- Pear ransomware hits Tri-Century Eye Care; React2Shell and ICTBroadcast flaws exploited; malicious VS Code extensions found in Microsoft Marketplace.
- Clop's Oracle E-Business Suite zero-day breach at Barts Health, active exploitation of the React2Shell flaw, and a record 29 Tbps Aisuru DDoS attack.
- Inotiv ransomware theft, Marquis breach affecting 780,000+, and React2Shell (CVE-2025-55182) exploitation by China-linked actors.
- Cloudflare's record 29.7 Tbps Aisuru botnet DDoS, the Oracle E-Business Suite Clop campaign hitting universities, and WordPress King Addons plugin takeovers.
- Coupang breach exposing 33.7M users, Shai-Hulud 2.0 npm attack leaking 400,000 developer secrets, and North Korean threat actors renting engineers' identities …
- Coupang breach exposing 33.7M customers, CodeRED alert platform shut down by Inc ransomware, and SmartTube app compromised via stolen signing keys.
- Gainsight breach expands to more Salesforce customers, Shai-Hulud v2 npm-to-Maven supply chain attack, and Qilin ransomware hits South Korean MSP. Plus London …
- The Oracle EBS extortion campaign hitting Cox, Canon and Mazda, the Shai-Hulud npm malware wave, and Harvard's voice phishing breach, plus new zero-days.
- The Pennsylvania AG ransomware breach by Inc Ransom, the WhatsApp contact discovery flaw exposing 3.5 billion numbers, and a FortiWeb zero-day under active …
- The Oracle E-Business Suite-linked Cl0p breaches including Logitech, Chrome and FortiWeb zero-days, and the record 15.72 Tbps Aisuru DDoS attack on Microsoft …
- Microsoft's November 2025 Patch Tuesday with 60+ fixes and an actively exploited zero-day, plus Google's Android Rust and Play Store battery-drain changes.
- Logitech and Washington Post breaches tied to Clop's Oracle E-Business Suite attacks, plus Fortinet FortiWeb zero-day exploited and added to CISA KEV.
- The Oracle EBS data theft fallout, Operation Endgame takedowns, and actively exploited Fortinet and WatchGuard flaws in today's cybersecurity news.
- Citrix Bleed 2 and Cisco ISE zero-day exploitation, the Synnovis ransomware data breach, and a 67,000-package npm spam worm.
- The GlobalLogic Oracle EBS data theft, the Rhadamanthys infostealer takedown, and Microsoft's November 2025 Patch Tuesday with 63 flaws including a kernel …
- Oracle EBS Cl0p extortion hits nearly 30 firms incl. Logitech and Washington Post; CBO confirms breach; Konni abuses Google Find Hub.
- Covers the CBO hack, Russian destructive attacks on Ukraine's grain sector, and LANDFALL spyware exploiting a Samsung zero-day via WhatsApp images.
- Covers SonicWall firewall config breach by state-sponsored actors, Balancer V2 $128M crypto theft, and actively exploited CentOS Web Panel RCE flaw from CISA.
- Miljödata breach affecting 1.5M, Nikkei Slack compromise and actively exploited Post SMTP WordPress flaw.
- Balancer DeFi $120M hack, Everest ransomware claims, and XWiki RCE exploitation.
- The Ribbon Communications breach, Cisco IOS XE webshell attacks, the Motex Lanscope zero-day exploited by Tick, and Conti extradition news.
- Ribbon Communications nation-state breach, Conduent 10.5M-record ransomware-claimed breach, and China-linked VMware Tools zero-day exploitation.
- Dentsu/Merkle breach, Canadian water and energy hacktivist intrusions, and DELMIA Apriso and XWiki exploitation, plus TEE.fail and PhantomRaven.
- The Dentsu/Merkle breach, Cl0p's Oracle EBS zero-day attacks on Schneider Electric and Emerson, and TEE.Fail trusted execution attacks.
- Top Secret clearance database exposed, ChatGPT Atlas hidden-command flaw, and Chrome zero-day tied to Memento Labs spyware.
- AWS DNS outage, WSUS CVE-2025-59287 under active exploitation, and Lazarus Group fake job lures against European drone firms.
- Magento/Adobe Commerce SessionReaper (CVE-2025-54236) mass compromise, MuddyWater Phoenix backdoor campaign, and SharePoint ToolShell exploitation by Chinese …
- Europol dismantles a SIM farm network behind 49 million fake accounts; FBI and DHS officials doxed; AMOS macOS stealer spread via Google Ads fake Homebrew and …
- Prince Group crypto seizure, Harvard breached via Oracle E-Business Suite zero-day CVE-2025-61884, and Flax Typhoon ArcGIS backdoor campaign.
- SonicWall SSL VPN compromises across 100+ environments, Oracle EBS zero-day malware attacks, and FBI seizure of BreachForums domains tied to ShinyHunters.
- FBI seizes BreachForums amid ShinyHunters Salesforce extortion; Gladinet CentreStack zero-day CVE-2025-11371 and Oracle EBS zero-day attacks actively exploited.
- Discord Zendesk breach affecting 5.5M users, Qilin's Asahi brewery leak, and a LockBit-Qilin-DragonForce ransomware cartel.
- Salesforce customer data theft by ShinyHunters, Clop's Oracle EBS zero-day, and Redis 'RediShell' RCE flaw.
- Discord third-party support data breach, CometJacking attack on Perplexity's Comet browser, and surge in scans against Palo Alto Networks logins.
- Covers Asahi ransomware, Salesforce data extortion by ShinyHunters, Jaguar Land Rover repeat attacks, and CISA-flagged Meteobridge root RCE exploited in the …
- Clop's Oracle E-Business Suite extortion campaign, the WestJet and Allianz Life breaches, and the WireTap/Battering RAM physical attack on Intel SGX and AMD …
- UK seizure of £5.5bn in Bitcoin, WestJet passport data breach, and Asahi cyberattack disrupting Japanese production.
- The Fortra GoAnywhere zero-day (CVE-2025-10035), Volvo supply chain ransomware theft, and Flo Health's $56M settlement with Google.
- Boyd Gaming data breach, Jaguar Land Rover production shutdown, and fake Malwarebytes and LastPass installers on GitHub targeting Mac users.
- Ransomware disrupting European airport check-ins including Heathrow, the Stellantis Salesforce data breach, and a CVSS 10 GoAnywhere MFT flaw.
- UNC1549 espionage against European telecoms, Turla and Gamaredon teaming up on Ukraine, and a CVSS 10.0 GoAnywhere MFT command injection patch.
- SonicWall cloud backup breach, Tiffany & Co. data theft and BianLian-linked Medical Associates of Brevard breach affecting nearly 250,000 people.
- Salesforce data theft by ShinyHunters via Salesloft Drift tokens, Shai-Hulud NPM supply chain worm, and Chrome zero-day CVE-2025-10585.
- JLR extends shutdown after cyberattack; Microsoft and Cloudflare dismantle RaccoonO365 phishing network; DHS misconfigured data hub exposes sensitive …
- Npm supply chain compromise of 40+ packages, KillSec ransomware breach of a Brazilian healthcare software provider, and Google's LERS account abuse.
- Covers FBI alert on UNC6040/UNC6395 Salesforce data theft and extortion, GitHub Pages SEO-poisoning malware, and the VoidProxy phishing-as-a-service platform.
- LNER breach, INC ransomware attack on Panama's finance ministry, and a critical SonicWall SSLVPN flaw (CVE-2024-40766) exploited by Akira ransomware.
- The Jaguar Land Rover breach, a record NPM supply-chain attack, and Scattered Spider's $380M Clorox heist, plus Microsoft's 80 patches and Chinese APT activity.
- Plex data breach, Adobe's SessionReaper Magento flaw and SAP NetWeaver criticals.
- The Wealthsimple breach, the Salesforce-linked attack on Proofpoint and Tanium, SAP S/4HANA CVE-2025-42957 exploitation, and CastleRAT from TAG-150.
- PowerSchool sued by Texas over 62M-student breach; Sitecore zero-day exploited with WeepSteel malware; APT28 deploys NotDoor Outlook backdoor.
- Jaguar Land Rover cyberattack disrupts operations, Workiva breach via Salesforce CRM, and Salesloft/Drift fallout hits Cloudflare, Palo Alto Networks and …
- The TransUnion breach affecting 4.4M US consumers, the Nevada ransomware attack, and a FreePBX zero-day under active exploitation.
- The TransUnion breach affecting 4.4 million people, a Nevada ransomware attack, and an actively exploited FreePBX zero-day.
- Covers the TransUnion breach (4.4M people), MathWorks ransomware theft, and the Nx npm supply chain attack that leaked 2,300+ credentials via AI-powered …
- Miljödata breach disrupts 200+ Swedish municipalities; Citrix NetScaler flaw CVE-2025-7775 exploited; Salesforce data theft via Salesloft Drift OAuth tokens.
- Nevada state government cyberattack shuts offices; Salesloft Drift token breach exposes Salesforce data; Citrix NetScaler zero-day CVE-2025-7775 patched.
- Farmers Insurance 1.1M-person breach via Salesforce attacks, BianLian's Aspire Rural Health breach, and Docker Desktop container escape CVE-2025-9074 (CVSS …
- DaVita's ransomware breach affecting nearly 2.7M people, Apple zero-day CVE-2025-43300, and Murky Panda cloud and telecom espionage.
- The DaVita ransomware breach affecting 2.7M people, Murky Panda's cloud supply-chain intrusions, and Apple's zero-day patch for CVE-2025-43300.
- Colt Technology breach by Warlock ransomware, Apple zero-day patch, and Scattered Spider member sentenced to 10 years.
- Inotiv ransomware, Intel and Workhorse Software data exposures, password manager clickjacking flaws, Apple's CVE-2025-43300 zero-day, and RapperBot botnet …
- The WarLock ransomware attack on Colt Technology, UAT-7237 APT breaches of Taiwanese web servers, and Cisco's patched critical FMC RADIUS flaw.
- Canadian House of Commons data breach, pro-Russian hackers opening Norwegian dam valves, and $300M crypto seizures.
- Connex Credit Union breach hits 172,000 members; Citrix NetScaler CVE-2025-6543 exploited against Dutch critical orgs; BlackSuit ransomware infrastructure …
- Google Calendar invites hijacking Gemini agents, a WinRAR zero-day (CVE-2025-8088) exploited in the wild, and fake Tesla sites promoted via Google ads.
- Google Salesforce CRM breach, US federal court records cyberattack, and 60 malicious Ruby gems stealing developer credentials, plus Lenovo webcam flaws.
- The Bouygues Telecom breach of 6.4 million customers, the Salesforce vishing campaign tied to ShinyHunters, and the CISA-mandated patch for Exchange …
- Google Salesforce data breach by ShinyHunters, DaVita ransomware notice to over 1 million people, and WhatsApp removing 6.8 million scam-centre accounts.
- Pandora and Cisco data breaches, Android and Adobe AEM zero-days, and SonicWall firewall attacks by ransomware gangs in this August 2025 brief.
- PlayPraetor Android RAT infects 11,000+ devices via fake Google Play pages; Microsoft releases PyRIT cloud red-teaming tool; pop3user legacy login activity.
- ShinyHunters vishing breaches at Qantas, Allianz Life and Adidas; SafePay claims 3.5TB Ingram Micro theft; Microsoft SharePoint mass exploitation hits South …
- Saint Paul city cyberattack prompting National Guard activation, Aeroflot flight cancellations, and Allianz Life breach hitting 1.4M US customers.
- The Toptal npm supply chain breach, Cisco ISE and PaperCut exploitation, and the BlackSuit-to-Chaos ransomware shift in one daily brief.
- Allianz Life breach, WordPress Post SMTP flaw exposing 200k+ sites, and ToolShell SharePoint exploits.
- Ransomware up 63% in Q2 2025, Amazon's Q Developer VS Code extension hijacked with wiper commands, and a North Korean IT worker laptop-farm sentencing.
- NNSA breach via Microsoft SharePoint zero-days, Clorox's $380M suit against Cognizant, and a backdoored npm 'is' package.
- NCSC attributes Microsoft 365 Authentic Antics malware to APT28, CrushFTP zero-day hijacks servers, and Google sues BADBOX 2.0 botnet operators.
- The $27M BigONE crypto exchange breach, Salt Typhoon's nine-month Army National Guard intrusion, and Cisco ISE CVE-2025-20337 (CVSS 10) with other …
- Co-op's 6.5M member data theft, UNFI's up to $400M sales hit and Louis Vuitton breaches tied to ShinyHunters.
- The Belk and McDonald's data incidents, North Korea's npm Contagious Interview campaign, and Chrome 138's fifth zero-day of 2025.
- Louis Vuitton and McDonald's data breaches, Gravity Forms WordPress plugin supply chain attack, and Gigabyte UEFI firmware flaws enabling Secure Boot bypass.
- Thirteen Romanian suspects arrested over phishing of UK taxpayers via HMRC, plus a critical Kigen eSIM flaw and a Google Gemini email summary abuse.
- The McHire chatbot data exposure of 64M applicants, the Gravity Forms supply-chain backdoor, and Wing FTP Server and FortiWeb exploitation.
- The Qantas breach (5.7M customers), Ingram Micro's SafePay ransomware attack, and McDonald's Paradox.ai hiring platform exposure.
- M&S ransomware by DragonForce, the SK Telecom breach exposing 27 million records, and the BaitTrap fake news investment fraud network.
- Ingram Micro ransomware outage, Qantas extortion over 6 million customer records, and a $140M theft from six Brazilian banks.
- Ingram Micro SafePay ransomware outage, exposed JDWP interfaces hijacked for crypto mining, and Taiwan's warning on Chinese apps like RedNote and TikTok.
- The Ingram Micro outage, a claimed Telefónica data leak, critical Sudo root-escalation flaws, and NightEagle's Exchange zero-day campaign against China.
- Qantas breach hits 6M customers, Cisco Unified CM hardcoded root SSH backdoor patched, and Gamaredon spearphishing Ukraine. Plus Scattered Spider and NimDoor.
- Qantas and Johnson Controls breach notices, a Chrome zero-day (CVE-2025-6554) under active exploitation, and Silver Fox's Gh0stRAT campaign against Taiwanese …
- Swiss federal data exposed via Radix ransomware breach, Scattered Spider targets airlines, and over 1,200 unpatched Citrix NetScaler servers under active …
- The McLaren Health Care breach (743,000 patients), Citrix NetScaler patches, and Salt Typhoon's breach of Canadian telecoms via a Cisco flaw.
- Covers the CoinMarketCap supply chain attack injecting a wallet drainer, an Oxford City Council data breach, and 16 billion leaked passwords.
- Iran state TV hack, $11M BitoPro crypto theft by Lazarus Group, Aflac breach tied to Scattered Spider, and record 7.3 Tbps DDoS attack.
- Salt Typhoon breaches Viasat, Krispy Kreme data theft of 160,000+ people, and Paragon Graphite spyware used against European journalists.
- The Zoomcar breach affecting 8M+ users, Veeam's critical CVE-2025-23121 backup RCE, and the Langflow flaw exploited to deploy the Flodrix botnet.
- The Washington Post journalist email breach, Zoomcar's 8.4M-user data breach, and Scattered Spider's pivot to U.S. insurers.
- Victoria's Secret outage after May 24 security incident, Apple zero-click Messages exploit by Paragon spyware, and SimpleHelp RMM flaw exploited by ransomware …
- Paragon Graphite spyware hit journalists' iPhones, EchoLeak exposed Microsoft 365 Copilot, and 80,000 Entra ID accounts faced password spraying.
- Erie Insurance cyberattack, INTERPOL's Operation Secure takedown of infostealer infrastructure, and a Microsoft WebDAV zero-day exploited by Stealth Falcon.
- The TxDOT crash-records data breach, Microsoft's June 2025 Patch Tuesday zero-days, and the six-hour Heroku outage.
- Sensata and UNFI breaches, critical Roundcube RCE CVE-2025-49113 actively exploited, and a Wazuh flaw exploited by Mirai botnets.
- Kettering Health ransomware claim, AT&T breach data re-release, and BADBOX 2.0 botnet infecting over 1 million IoT devices.
- Victoria's Secret earnings delay, Coinbase data breach via bribed TaskUs staff, and Scattered Spider's attacks on UK retailers Marks & Spencer and Co-op.
- Cartier and The North Face breaches, a Chrome emergency zero-day patch, and Qualcomm Adreno zero-days exploited in targeted attacks.
- ConnectWise ScreenConnect breach by suspected nation-state, DragonForce ransomware via SimpleHelp RMM, and Victoria's Secret site outage.
- Covers the 184M password exposure, $223M Cetus Protocol crypto heist, and Europol's Operation Endgame ransomware crackdown.
- Chinese UAT-6382 exploits Trimble Cityworks to breach US local governments; Ivanti EPMM flaws hit European, North American and Asian agencies; 184M credentials …
- Cellcom outage cyberattack, SK Telecom malware breach exposing 27M USIM records, and RVTools supply chain attack delivering Bumblebee malware.
- Procolored printer drivers spread malware for six months, Coinbase offers $20M bounty after extortion, and Intel CPUs face new Spectre-style flaws.
- Coinbase breach via bribed support agents, Nucor halted by a cyber incident, and APT28 exploiting webmail zero-days in the RoundPress campaign.
- The Coinbase insider data breach and extortion attempt, SAP NetWeaver exploitation by BianLian and RansomExx, and Samsung MagicINFO Mirai attacks.
- Marks & Spencer customer data theft, Microsoft May 2025 Patch Tuesday with five zero-days, and SAP NetWeaver exploitation by ransomware gangs.
- The Output Messenger zero-day used in Kurdish espionage, an airline cyberattack, and a Global botnet takedown with four arrests.
- ICE deportation airline hack exposes detainee data, a school software ransomware attack, and Noodlophile infostealer lures using fake AI video tools.
- Ascension healthcare breach affecting 430,000+ patients, Insight Partners breach widening, and LockBit affiliate panel leaked.
- Langflow and Samsung MagicINFO RCE exploitation, GeoVision devices feeding Mirai botnets, and the UK Legal Aid Agency incident.
- TeleMessage's breach and suspended services, the Darcula SMS phishing platform stealing 884,000 cards, and UK retail attacks prompting new NCSC guidance.
- SK Telecom's USIM breach and SIM replacements, APT28's attribution by France, and the AirBorne AirPlay zero-click RCE flaws.
- Blue Shield of California exposed 4.7M members' health data to Google analytics; NLRB data exfiltration alleged by a whistleblower; Lazarus Group's $137M TRON …
- Marks & Spencer cyberattack disrupts Click and Collect; DeepSeek breach exposes data on dark web; SK Telecom discloses malware exposing USIM customer data.
- Japanese brokerage account breaches, 'Scallywag' WordPress plugin ad fraud, and an ASUS AiCloud router flaw (CVSS 9.2).
- Ahold Delhaize breach by INC ransomware, Darcula-enabled SMS phishing spike, and Erlang/OTP SSH and Windows NTLM flaws.
- SonicWall SMA exploitation, Apple iOS zero-days, a Fortinet symlink backdoor on 16,000+ devices, and the CrazyHunter ransomware targeting Taiwan.
- Phishing tops UK attacks, North Korea expands IT worker fraud, and MITRE's CVE funding expires, threatening the vulnerability database.
- North Korean IT worker schemes, AkiraBot's AI-generated spam campaign against 420,000 sites, and a Lovable AI jailbreak flaw.
- ClipBanker malware spread via SourceForge, Everest ransomware leak site hacked, and CrushFTP flaw added to CISA KEV catalog.