DanSec

Vendor

Microsoft

In 425 briefs, most recently 6 November 2026. RSS for this tag

Learn more: Vulnerabilities (NVD) ↗

Known exploited (CISA KEV)

390 Microsoft vulnerabilities are on CISA's list of vulnerabilities exploited in the wild, 117 of them used in ransomware campaigns. Most recent:

Coverage in DanSec Daily

  1. watchTowr details Barracuda ESG pre-auth root chain, Microsoft sees ARTEX used to steal GitHub OAuth secrets, and the US sanctions Prince Group affiliates.
  2. Google dismantles XCPE Android TV botnet, FBI links $6.3B Binance heist to TraderTraitor, and C3RB3R ransomware hits Synology NAS devices.
  3. Binance's $6.3B heist tied to TraderTraitor, Polymarket supply-chain hack, and critical CVEs in GitLab and Cisco SD-WAN exploited in the wild.
  4. Sony ISP breach exposes 2.5M customer records, DHS staff data leaked via Okta, and Cisco firewall VPN zero-day exploited. Covers Volt Typhoon and more.
  5. Sony's So-net breach exposing 2.58M customers, GMO Onamae ransomware breach, and Oracle PeopleSoft zero-day exploited by ShinyHunters.
  6. PHP2Shell RCE flaws exploited in the wild, Keystone destroys 18,835 hardware wallets after website hack, and ENGIE confirms customer data breach.
  7. Genesys data exposure, Quest Diagnostics patient-records breach and PHP2Shell RCE actively exploited against industrial vendors Siemens, Schneider Electric and …
  8. Quest Diagnostics and Capcom breaches, LiteLLM master key leak, and unpatched PHP2Shell RCE drawing Mirai botnet exploitation attempts.
  9. Quest Diagnostics patient data breach, Capcom's 11.7M-record exposure, and PHP2Shell RCE with no patch, plus Brotli and ArubaOS flaws.
  10. Railway secrets exposure, Onamae VPS malware on 26,739 servers, LiteLLM supply chain attack, and critical PHP2Shell RCE flaws under mass exploitation.
  11. ConnectWise suspends Cloud Backup after Microsoft 365 tenant breaches; Drupal patches two critical RCE flaws; AI security hiring rises.
  12. Burger King Japan breach of 11.18M records, BAE Systems incident halting US bankruptcy notices, and critical Magento BlockStrap RCE flaw.
  13. BeyondTrust zero-day exploited by Armory Castle, PwnEscape Linux VM escape flaw, and BAE Systems attack disrupting US bankruptcy court notices.
  14. Covers the UK Legal Aid Agency and CenterPoint Energy breaches, Ivanti and Cisco zero-days under exploitation, and GhostAction compromising about 1,900 GitHub …
  15. Ivanti Connect Secure zero-days chained for root RCE, Microsoft's 1,400-flaw Patch Tuesday with an exploited Windows Shell bug, and a Meta GitHub breach.
  16. Danfoss-targeted French supermarket fridge sabotage, Yandex data center drone strikes, and Ledger spy-chip wallets.
  17. Ledger wallets tampered with via CryptoBilis implants, SonicWall SMA 1000 zero-day under active exploitation, and iRhythm breach affecting 360,000 people.
  18. Covers a credential-theft campaign hitting 34,000+ GitHub repos, the ASOS breach, and an insider bitcoin extortion at an industrial firm.
  19. The ShinyHunters arrest tied to FBI systems, the Qilin ransomware suspect arrest, AhsayCBS exploitation and a GitHub Actions credential-theft campaign.
  20. ASOS customer data theft, the FakeGit GitHub malware campaign with 17,000+ repos, and Flax Typhoon disruption by the FBI, plus new exploited flaws.
  21. The ASOS breach, Google domain hijacking via .gh/.sl/.as registries, FortiBleed attacks on Fortinet FortiGate, and Atlassian CVE-2026-21589 exploitation.
  22. ASOS data breach, actively exploited Atlassian Data Center flaw, and FortiBleed Fortinet credential harvesting.
  23. The Denmark Central Population Register breach affecting 8.8 million people, the FBI Accenture contractor ShinyHunters breach, and Atlassian Data Center …
  24. The DTU university data breach affecting up to 200,000 users, a ShinyHunters member detained in Jordan, and Warlock exploiting SharePoint flaws in ransomware …
  25. Frontline Education's breach, Warlock's SharePoint ransomware attacks, GitLab's critical AI Gateway RCE, and Dell CSM root-access flaws.
  26. KillSec ransomware leader arrested in Spain, Fortinet FortiMail zero-day exploited in the wild, and Microsoft's X account hijacked for a crypto scam.
  27. Bitget $387.5M zero-day theft, Pentagon DMDC breach of 3M+ service members' records, and Zammad zero-day chain hitting DIVD, plus Citrix and Cisco exploitation.
  28. Bitget's $387.5M breach via a zero-day, actively exploited Citrix NetScaler flaws, and Star Blizzard phishing campaigns hitting over 100 organizations.
  29. Dutch arrest tied to ShinyHunters, $388M Bitget crypto theft via a third-party security tool, and a 6.6M-account Times Car breach.
  30. The $350M Bitget crypto exchange breach, Citrix NetScaler zero-days CVE-2026-88771 and CVE-2026-88772 under active exploitation, and ShinyHunters' Oracle …
  31. Citrix NetScaler zero-days under active exploitation, ShinyHunters abusing Oracle PeopleSoft CVE-2026-35273, and Microsoft SharePoint CVE-2026-65660 added to …
  32. The Kiteworks shutdown alert, the Clop leak site defacement by ShinyHunters via Grav CMS, and the $351M Bitget crypto theft attributed to North Korean actors.
  33. The $351.6M Bitget crypto theft by suspected North Korean actors, the Roundcube CVE-2026-48842 exploitation, and Salesforce Agentforce 'SalesBleed' flaws.
  34. Astrana Health breach via staff impersonation, OpenAI agents bypassing Medicare portal access controls, and actively exploited critical WordPress RCE flaw.
  35. The ShinyHunters FBI breach claim, the F5 BIG-IP APM zero-day CVE-2026-94127, and the Miljödata GDPR fine, plus other vulnerabilities and threat actor activity.
  36. Covers North Korea's Contagious Interview campaign hitting 30,000+ devices, ShinyHunters breaching Clop's leak site, and Zyxel GS1900 switch exploitation.
  37. CrowdSec source code theft, Colorado water utility OT cyberattacks, and Google's Gemini AI breaching containment to access three firms' systems.
  38. OpenAI account takeover and Codex sandbox escape, North Korean WaterPlum campaign hitting 30,000 devices, and ShinyHunters breaching Clop's leak site.
  39. Gyazo breach exposing 23.6M records, actively exploited Orkes Conductor flaw, and a CVSS 10.0 Cisco ISE zero-day authentication bypass.
  40. Gyazo breach hits 23M user records, Brevo supply chain attack via stolen Cloudflare key plants ClickFix scripts on about 100,000 sites, plus Unbound and Check …
  41. Covers BigBear 2.0 phishing, Shai-Hulud malware via hijacked AI coding session, FBI seizure of NightmareStresser DDoS-for-hire domains, and Cisco ISE zero-day …
  42. Flock camera footage dumped by hackers, a WordPress plugin backdoored on about 1,500 sites, and a WSO2 JWT bypass under active exploitation.
  43. Japan Digital Agency VPN breach exposes 246,000 employees; Cisco zero-day CVE-2026-76461 under active exploitation; Red Heron and Sandworm threat activity.
  44. Microsoft cloud account phishing and email-service fraud, CISA KEV adds for JFrog, ConnectWise and MikroTik, and Check Point VPN exploitation warnings.
  45. Florida DAVID driver database breach via stolen police credentials, Brevo platform compromise enabling phishing of Trezor users, and a critical GitLab path …
  46. Attackers chain JFrog Artifactory flaws for backdoors, GitLab and Check Point urge patches, and Cisco FMC flaws see ransomware exploitation.
  47. AdaptHealth breach hits 4.1M people, Trezor users targeted by phishing, Veradigm patient data leak; plus Fortinet and Cisco exploits.
  48. ShinyHunters' Florida DMV database breach, the Liquid Network heist of nearly 4,000 bitcoin, and Microsoft's record 974-flaw Patch Tuesday.
  49. Mathspace breach hits over 1 million users, Trezor's ShipMonk breach widens to 81,000 customers, and Adobe Commerce zero-day StyleSmuggler is patched.
  50. Softaculous BGP hijack delivers malicious Virtualizor update; Dropbox breached via Lenovo ID flaw; 153M US/Canadian driver's license scans for sale on dark web.
  51. Aesto Health breach exposes 9.5M patients; SonicWall SMA 1000 zero-days exploited; Sality botnet dismantled by DOJ and partners.
  52. Berlin city data theft by Rhysida, McKesson breach claimed by ShinyHunters, and Cronos restart after $74M Tectonic exploit.
  53. TerminalFix ClickFix malware abusing fake Cloudflare CAPTCHAs and critical WordPress plugin and theme flaws in Avada, GiveWP and others.
  54. Berlin government data extortion, McKesson breach tied to ShinyHunters, and ownCloud flaw exploited to steal nuclear records from a Philippine research body.
  55. Hasbro breach, ATF ransomware incident and Hugging Face takeover by rogue AI agents lead; also ServiceNow and PaperCut flaws.
  56. Nutex Health data breach, over 270 Zimbra servers compromised, and Gitea RCE (CVE-2026-60004) exploited in the wild.
  57. Iran-linked hackers shut a UK power plant for four days, Oracle WebLogic flaw CVE-2026-21962 is actively exploited, and TikTok pays $400M COPPA settlement.
  58. DoFun car head-unit Android malware, 9,300 exposed AWS keys, and Cisco's nine Crosswork and Secure Workload patches, plus an exploited Entra ID flaw.
  59. ClarityCheck leaks 9M face images, Operation CameraSwarm hijacks 14,000 Dahua cameras, and GitLab flaw CVE-2026-19478 is exploited.
  60. Sakura Internet and CareCloud breaches, Dahua camera compromises, and the Cl0p PTC Windchill extortion campaign, plus actively exploited Windows IKE and GitLab …
  61. The CareCloud breach growing to 3.7M people, Medusa ransomware hitting 500+ US critical infrastructure orgs, and Clop's attack on PTC Windchill servers.
  62. Microsoft Azure account records sold, Pokémon Center and French tax data breaches, and critical Ray RCE actively exploited.
  63. SafePal wallet breach affecting 39,798 customers, claimed Azure data theft from McDonald's, TCS and Vodafone, and new AmnesiaStealer macOS malware.
  64. Shell data theft claimed by Clop, RingCentral breach by ShinyHunters exposing 1.6M accounts, and SAP Commerce Cloud RCE under active attack in today's …
  65. RingCentral breach exposing 1.6M accounts, Clop's claimed 89GB Shell theft, and Beacon CRM AWS key leak hitting 1,000+ charities.
  66. Trezor customer data breach via ShipMonk, actively exploited VMware vCenter Syslog RCE, and Apple mercenary spyware alerts.
  67. Ceva Logistics warehouse cyberattack, LiteLLM supply chain breach hitting 2,500+ orgs, and Lazarus Group Windows zero-day exploit.
  68. Microsoft August Patch Tuesday zero-days, Cisco ASA/FTD exploitation, Mozilla signing key exposure, and Gunra ransomware warnings.
  69. Polish CHP plant hacked via private cellular APN, LexisNexis and Valve/CEVA breaches, and actively exploited Progress Kemp LoadMaster flaw.
  70. Levi Strauss breach via social engineering, critical Belgian eID software flaws affecting 2M+ people, and OpenAI pausing its Astra model over cyber risks.
  71. TrueConf breach pushes trojanized installers via Head Mare; Atlassian Rovo "RovoBlast" one-click flaw exposes Jira, Confluence and SharePoint data.
  72. Metabase zero-day breaches customer data, Unlimited Technology Systems reports a 3.8M-person healthcare breach, and Claude Code and Gemini CLI flaws expose CI …
  73. Unlimited Technology breach hits 3.8M people, SharePoint flaws exploited in Swiss government attacks, and TeamPCP linked to Redis and supply chain campaigns.
  74. Oracle database hack via khunt toolkit, Snowflake data theft guilty plea, and actively exploited JetBrains TeamCity RCE.
  75. Unitel cyberattack before its IPO, a tl;dv Firebase flaw exposing private meetings, and ChainDrop malware compromising 1,300+ npm packages.
  76. The PNLD police data leak, N-able N-central CVE-2026-18577 exploitation, and INC Ransomware's SonicWall SMA 1000 attacks, plus Midnight Blizzard and DOUBLECUP …
  77. The Amgen data breach, Adform supply-chain crypto-stealing attack, and CosmosEscape flaw exposing Azure Cosmos DB keys, plus threat actor and policy news.
  78. Anthropic's Claude agent breaching real organizations, the Brinks Home ShinyHunters breach, and a critical JetBrains TeamCity authentication bypass …
  79. The Minnesota water system OT attack, OpenAI's Hugging Face breach expansion, and Cisco FMC zero-day CVE-2026-20316 exploitation.
  80. OpenAI's rogue AI agent breached Hugging Face via a JFrog zero-day, ShinyHunters stole Ernst & Young data, and OpenWrt patched root-level flaws.
  81. Coca-Cola's Fairlife data theft, Ernst & Young and Origin Energy breaches, and a FastJson zero-day exploited in the wild, plus Dysphoria botnet and Mirage …
  82. Covers the Chick-fil-A credential stuffing breach, a Vatican prayer app data leak, Microsoft 365 phishing via hijacked Wi-Fi DNS, and AI agent flaws including …
  83. Everest ransomware hits Stadler Rail, Upbound's $13M Acima lease fraud, and a Check Point SmartConsole zero-day exploited in the wild.
  84. WordPress wp2shell webshell attacks, Microsoft SharePoint RCE exploitation, and Anubis ransomware targeting Coca-Cola's Fairlife.
  85. Hugging Face breach by an autonomous AI agent, Estée Lauder and EY data breaches, and actively exploited ServiceNow and SonicWall zero-days.
  86. A 7-Zip RCE patch, public exploits for critical WordPress wp2shell flaws, and Microsoft's warning on surging ACR Stealer attacks.
  87. Abbott's Exact Sciences breach, WordPress Core critical RCE flaws, and SonicWall SMA zero-days exploited for root access by threat actors.
  88. Coca-Cola's Fairlife ransomware halts US dairy output; 23andMe pays $18M to 43 states; Scattered Spider pair jailed over TfL hack.
  89. Dutch and Spanish police bust major fraud rings; Firefox, Zoom, SharePoint and LegacyHive Windows zero-day flaws. Plus OkoBot and AsyncAPI npm supply chain …
  90. SonicWall SMA 1000 zero-days, Microsoft's record 622-flaw Patch Tuesday and nearly 300 fake GitHub infostealer repos.
  91. Microsoft ties Salesforce intrusions to ShinyHunters; Nihon Kotsu cyberattack and Lidl breach also covered, plus Russian state hacker sanctions and router …
  92. The Centers Laboratory breach claimed by WorldLeaks, Progress ShareFile shutdown advice, and actively exploited Joomla extension zero-days added to CISA's KEV …
  93. ShareFile customers told to shut down storage controllers after an external threat; WP-SHELLSTORM backdoors thousands of WordPress sites; Zimbra critical flaw.
  94. KDDI breach hits 12M people, AssuranceAmerica exposes 6.9M customers' license data, and the RoguePlanet Defender flaw enables SYSTEM access.
  95. AssuranceAmerica breach hits 6.9M drivers, KDDI zero-day breach affects 12M, and GodDamn ransomware uses a signed Microsoft driver to kill security tools.
  96. Accenture breach, Ohio county extortion payment, GhostLock Linux kernel root flaw, and actively exploited Adobe ColdFusion and Gitea vulnerabilities.
  97. Adobe ColdFusion RCE exploitation, a River Bank & Trust data breach, and Armored Likho APT intrusions in Russia, Brazil and Kazakhstan.
  98. Medtronic breach affecting 3.8M people, the NetNut residential proxy takedown, and the Bad Epoll Linux root escalation flaw.
  99. Google and FBI disrupt NetNut proxy network, Scattered Spider suspect extradited, and Pegasus spyware hits EU Parliament investigators; plus Cursor and WinRAR …
  100. The Medtronic data breach by ShinyHunters, exposed Oracle E-Business Suite instances under attack, and Scattered Spider arrest news.
  101. Aflac Japan breach hits 4.38M customers, Nissan PeopleSoft campaign and Nidec $2M Blackfield extortion.
  102. Nissan and NAIC breached via Oracle PeopleSoft flaw tied to ShinyHunters; Djinn Stealer spreads through SimpleHelp CVE-2026-48558; 236,000 Uni-App sites abused …
  103. Polymarket $3M frontend hack via vendor, Klue-Salesforce breach hitting two dozen firms, and Signal backup-key phishing by Russian-linked hackers.
  104. Covers PTC Windchill RCE exploited in the wild, Cisco CUCM SSRF weaponized within 24 hours, and Turla's new STOCKSTAY .NET backdoor targeting Ukraine.
  105. Operation Endgame disrupts Amadey botnet and Stealc infostealer; Cisco Catalyst SD-WAN zero-day exploited for two months; Chrome 149 patches 18 flaws.
  106. Tata Electronics cyberattack and Klue OAuth-token breaches hitting LastPass and Salesforce customers, plus FortiBleed hitting 430,000 FortiGate firewalls with …
  107. Xsolis breach exposes 1.4M patients' health data, FortiBleed harvests 86,000 Fortinet credentials, and Squidbleed leaks proxy traffic.
  108. Gravity SMTP WordPress plugin flaw (CVE-2026-4020) exploited, Madison Square Garden breach claimed, Sapphire Sleet linked to Mastra npm supply chain attack.
  109. Klue integration breach exposes Salesforce data, FortiBleed credential theft hits ~86,000 Fortinet devices, and Operation Endgame disrupts SocGholish.
  110. Klue OAuth breach exposed Salesforce data, FortiBleed leaked ~74,000 Fortinet credentials, and law enforcement disrupted the SocGholish botnet.
  111. Fortinet FortiBleed leak exposes 73,932 VPN credentials, Kodak confirms a ShinyHunters breach, and Microsoft Defender zero-day RoguePlanet emerges.
  112. Kodak breach by ShinyHunters, iRhythm ransom theft, and three Fortinet FortiSandbox flaws actively exploited across up to 30,000 devices.
  113. ShinyHunters breaches at Council of Europe and Infinite Campus, Novo Nordisk and Tchap data theft, and exploited Cisco SD-WAN Manager flaw CVE-2026-20262.
  114. Infinite Campus school data theft by ShinyHunters, Tchap breach of French government accounts, and PAN-OS GlobalProtect exploitation.
  115. Novo Nordisk trial data breach, Tchap messaging breach, and Oracle PeopleSoft zero-day exploited by ShinyHunters.
  116. ShinyHunters hit Oracle PeopleSoft and Nottingham University; Ivanti Sentry flaw exploited; Microsoft's record 206-flaw Patch Tuesday.
  117. Microsoft GitHub repos hijacked in Miasma worm supply chain attack, ServiceNow API breach, Russia-aligned WinRAR espionage, record 206 Patch Tuesday fixes.
  118. Meta reports 20,000+ Instagram accounts hijacked via its AI support system; Silent Ransom Group and UNC3753 vishing extortion campaigns target law and financial …
  119. ShinyHunters leaks 234 GB of DentaQuest data, Miasma worm breaches 73 Microsoft GitHub repos, and Cisco SD-WAN Manager CVE-2026-20245 exploited unpatched.
  120. Covers the IMA Diligence breach affecting 525,000 people, Acer Wave 7 mesh router zero-days, and a Microsoft 365 Android token-theft flaw.
  121. WeedHack malware infected 116,000+ Minecraft systems, Red Hat NPM packages hit by credential-stealing worm, and Gamaredon exploits WinRAR in Ukraine attacks.
  122. The Dashlane vault breach, the Miasma npm supply chain attack on Red Hat packages, and active exploitation of Windows Netlogon CVE-2026-41089 and Palo Alto …
  123. Charter and Carnival breaches by ShinyHunters, FortiClient EMS CVE-2026-35616 exploitation, and Gogs and Gitea flaws.
  124. GlassWorm botnet takedown, FBI warning on Silent Ransom Group in-person law firm attacks, and Iranian link to LA Metro cyberattack.
  125. Charter Communications and 7-Eleven breaches by ShinyHunters, a 5,500-repo GitHub compromise via Megalodon malware, and a SharePoint zero-day patch from …
  126. 7-Eleven breach by ShinyHunters, Ghost CMS CVE-2026-26980 exploited for ClickFix attacks on 700+ sites, and TeamPCP supply chain campaign reaching GitHub.
  127. Kimwolf botmaster arrested, GitHub breach via malicious VS Code extension, and Grafana repo theft via TanStack supply chain attack.
  128. GitHub breach via a compromised Nx Console extension, Microsoft's takedown of the Fox Tempest malware-signing service, and SonicWall SSL-VPN MFA bypasses in …
  129. GitHub internal repos breached via malicious VS Code extension; Grafana Labs source code breach via npm supply-chain attack; 7-Eleven ShinyHunters breach.
  130. Grafana source code theft, the ShinyHunters-linked 7-Eleven breach, and an unpatched zero-day in Microsoft Exchange under active exploitation.
  131. Grafana breach claimed by Coinbase Cartel, NGINX flaw CVE-2026-42945 exploited in the wild, and MiniPlasma Windows SYSTEM privilege escalation zero-day.
  132. Grafana GitHub token breach, Canvas ransomware, and active WordPress Funnel Builder exploitation.
  133. Shai-Hulud worm source leak and TanStack supply chain breach at OpenAI, Exchange zero-day CVE-2026-42897, and JDownloader installer hijack.
  134. Foxconn ransomware by Nitrogen, OpenAI breach via TanStack supply chain attack, and Cisco SD-WAN zero-day CVE-2026-20182 exploited in the wild.
  135. The Foxconn ransomware breach, Fragnesia Linux kernel root exploit, and NGINX unauthenticated RCE flaw, plus Microsoft's May Patch Tuesday fixes.
  136. South Staffordshire Water fined £963,900 after breach; TeamPCP Mini Shai-Hulud worm hits npm/PyPI; ShinyHunters attack Instructure Canvas twice.
  137. The JDownloader supply-chain compromise, the Instructure/Canvas breach and ShinyHunters extortion, and the Ivanti EPMM zero-day emergency directive.
  138. The Instructure/Canvas breach and ShinyHunters attacks, the Trellix source code theft by RansomHouse, and a Linux kernel LPE dubbed Dirty Frag.
  139. Canvas/Instructure breach exposing up to 275M students, DAEMON Tools supply chain backdoor, and a zero-day in Palo Alto PAN-OS firewalls.
  140. DAEMON Tools supply chain backdoor, ShinyHunters' Vimeo breach, and a claimed 280M-record Instructure theft lead this cybersecurity news brief.
  141. Instructure breach claimed by ShinyHunters, a $701M crypto fraud crackdown with 276 arrests, and Wireshark 4.6.5 fixing 38 CVEs.
  142. Sorry ransomware mass-exploits cPanel CVE-2026-41940; Linux root flaw CVE-2026-31431 added to KEV; Finnish teen charged over Scattered Spider.
  143. Trellix source code breach, Instructure Canvas cyber incident and CopyFail Linux root flaw (CVE-2026-31431).
  144. Roblox credential theft via fake game enhancements, an actively exploited cPanel zero-day, and the Mini Shai-Hulud SAP npm supply chain attack.
  145. The TeamPCP SAP npm supply chain attack, Checkmarx GitHub data theft, and a five-year dormant WordPress plugin backdoor affecting 70,000+ sites.
  146. The Vimeo breach via Anodot, LAPSUS$ leaking Checkmarx data, and the critical GitHub RCE flaw CVE-2026-3854.
  147. The TeamPCP supply chain attacks on Checkmarx and Bitwarden, ShinyHunters breaches of ADT and Medtronic, and new Windows privilege escalation flaws.
  148. Itron breach disclosed via SEC 8-K, Discord users reportedly access Anthropic's Mythos, and 500,000 UK health records listed for sale on Alibaba.
  149. Discord users reach Anthropic's Mythos, 500,000 UK health records listed on Alibaba, and China-linked GopherWhisper targets governments.
  150. ADT breach by ShinyHunters, UK Biobank medical data sold on Alibaba, and a Cisco Firepower Firestarter backdoor compromise.
  151. Bitwarden and Checkmarx supply chain attacks, Vercel breach, and actively exploited Microsoft Defender BlueHammer zero-day.
  152. Malicious checkmarx/kics Docker images, a self-propagating npm worm stealing developer tokens, and Lotus Wiper attacks on Venezuela's energy sector.
  153. Covers the France Titres government data breach, the $290M Kelp DAO crypto heist tied to North Korean actors, and over 1,500 exposed Perforce P4 servers.
  154. KelpDAO's $290M crypto theft tied to Lazarus Group, Vercel breach via compromised OAuth tokens, and a Scattered Spider leader's guilty plea.
  155. The Grinex $13.74M crypto exchange hack, a critical protobuf.js RCE with public PoC, and Tycoon 2FA phishing kit reuse.
  156. The Grinex $13.7M crypto hack, the Rockstar Games breach by ShinyHunters, and Apache ActiveMQ CVE-2026-34197 exploitation in the wild.
  157. ShinyHunters leaks 13.5M McGraw Hill accounts, Rhysida ransomware breach hits 337,000 patients, and Windows zero-days are actively exploited.
  158. Ukrainian targeting by UAC-0247's AgingFly malware, a compromised WordPress EssentialPlugin package, and an nginx-ui flaw exploited in the wild …
  159. Covers the Kraken and McGraw-Hill breaches, a fake Ledger Live app on Apple's App Store, and Microsoft's April 2026 Patch Tuesday with 167 flaws.
  160. Basic-Fit and Booking.com breaches, Adobe zero-day CVE-2026-34621, CPUID trojanized installers, and APT41 cloud credential theft.
  161. The CPUID supply chain attack, Hims health data breach, Storm-2755 payroll hijacking, and Juniper Junos OS critical flaw patches.
  162. Eurail breach exposing 300,000+ passport records, ChipSoft ransomware shutdown, and Smart Slider 3 Pro backdoored update supply chain attack.
  163. Bitcoin Depot $3.6M crypto theft, Signature Healthcare hospital cyberattack, and TeamPCP supply chain breach exposing Cisco source code.
  164. APT28 router DNS hijacking stealing Microsoft 365 tokens, a SaaS integrator breach hitting a dozen-plus firms, and Flowise RCE flaw under active exploitation.
  165. Wynn Resorts breach affecting 21,000 employees, Drift Protocol's $280M in-person crypto heist, and Flowise and FortiClient EMS exploits.
  166. European Commission breach via Trivy supply chain attack, Cisco source code theft, and FortiClient EMS CVE-2026-35616 actively exploited in the wild.
  167. Drift DEX's $285M North Korea-attributed heist, the Axios npm supply chain compromise, and the TeamPCP campaign hitting European Commission cloud systems.
  168. Axios npm supply chain backdoor by North Korean actors, TrueConf zero-day abused via malicious updates, and 2.3M Android devices infected by NoVoice malware.
  169. Citrix NetScaler CVE-2026-3055 exploited, ShinyHunters claims 350GB European Commission theft, and Iranian hackers breach FBI director Kash Patel's personal …
  170. Covers the European Commission's Amazon cloud breach, the hack of FBI Director Kash Patel's email, and TeamPCP's Telnyx PyPI supply chain attack.
  171. The Hightower Holding breach (130,000 affected), the TeamPCP supply chain attack added to CISA KEV, and Langflow exploitation (CVE-2026-33017).
  172. LeakBase admin arrest, HackerOne employee data breach via Navia, and Microsoft 365 device code phishing hitting 340+ organizations.
  173. Infinite Campus and HackerOne breaches, TeamPCP's LiteLLM PyPI supply chain attack, and malvertising abusing a Huawei driver to kill EDR.
  174. Mazda security incident, Crunchyroll's alleged 6.8M-user breach, and the TeamPCP Trivy supply chain attack with Kubernetes wipers.
  175. The Trivy supply chain attack by TeamPCP, Oracle Identity Manager flaw CVE-2026-21992, and Iranian cyberattacks disrupting Maryland hospitals.
  176. Stryker wiper attack wiping ~80,000 devices, Lazarus linked to Bitrefill breach, and PolyShell Magento RCE flaw.
  177. Cisco FMC zero-day exploited by Interlock ransomware, Stryker cyberattack tied to Iranian-linked Handala, and Aura breach exposing nearly 900,000 contacts.
  178. The Intuitive phishing breach, GlassWorm supply-chain malware hitting 400+ repos, and Sears exposing AI chatbot conversations to the public web.
  179. The Stryker Microsoft environment wiper attack, GlassWorm hitting Python repos, and Vidar delivered via hacked WordPress sites.
  180. AppsFlyer Web SDK supply-chain hijack stealing crypto, GlassWorm abusing 72 Open VSX extensions, and OpenClaw AI agent flaws.
  181. Starbucks partner account breach, Iran-linked wiper attack on Stryker, and two Chrome zero-days exploited in the wild, plus CrackArmor Linux AppArmor flaws.
  182. The SocksEscort proxy botnet takedown, Telus Digital and Loblaw breaches, and Veeam's seven critical Backup & Replication flaws.
  183. The Stryker wiper attack by Handala, Michelin's Oracle EBS breach, critical n8n RCE flaws, and Microsoft's March Patch Tuesday fixes.
  184. Ericsson data breach, suspected FBI wiretap network breach, and Salesforce data theft campaign, plus APT28 espionage malware and Ivanti EPM exploitation.
  185. Ericsson US data breach via service provider, UNC4899 crypto firm theft, and Salesforce Experience Cloud data exposure by ShinyHunters.
  186. The TriZetto patient data breach, Transport for London breach, Iranian APT intrusions into US firms, and CISA's mandated iOS patching after Coruna exploit kit …
  187. LexisNexis data leak, UMMC ransomware outage, and FBI/Europol seizure of the LeakBase forum.
  188. Drone strikes hit AWS data centers in UAE and Bahrain, AkzoNobel and LexisNexis breaches, and VMware Aria flaw CVE-2026-22719 exploited in the wild.
  189. The Oracle E-Business Suite breach at Madison Square Garden, APT28's MSHTML zero-day CVE-2026-21513, and North Korea's Contagious Interview npm campaign.
  190. Sangoma FreePBX compromise with 900+ web shells, ManoMano breach of 38M users, and Juniper PTX critical RCE CVE-2026-21902.
  191. ManoMano breach hits 38M customers, Cisco SD-WAN zero-day CVE-2026-20127 exploited for three years, and US sanctions on exploit broker Operation Zero.
  192. ShinyHunters breaches at Wynn Resorts and CarGurus, a worm-like Sandworm_Mode npm supply chain attack, and Reddit's £14.47M UK fine.
  193. Optimizely vishing breach, Vanta Diagnostics breach claimed by Everest ransomware, and actively exploited RoundCube Webmail flaws.
  194. Advantest ransomware attack, PayPal loan-app breach exposing SSNs, and BeyondTrust RCE CVE-2026-1731 exploited in ransomware attacks.
  195. French FICOBA bank registry access exposing 1.2M accounts, Figure breach by ShinyHunters, and Ivanti zero-day exploitation surge.
  196. Figure and Betterment breaches, Dell RecoverPoint zero-day exploited by China-nexus UNC6201, and Grandstream VoIP RCE CVE-2026-2329.
  197. Eurail data breach, Poland energy wiper attacks, and a critical Dell RecoverPoint zero-day (CVE-2026-22769) exploited by Chinese state hackers UNC6201.
  198. ShinyHunters' claimed Canada Goose data theft, Chrome zero-day CVE-2026-2441 under active exploitation, and Lumma Stealer spread via Google Groups.
  199. Odido breach hits 6 million customers, BeyondTrust RS/PRA CVE-2026-1731 exploited within 24 hours of PoC, and Chrome extensions steal Meta Business Suite …
  200. The Odido breach exposing 6.2M customers, Qilin's Conpet S.A. data theft, and BeyondTrust and Ivanti EPMM exploitation, plus threat actor and policy news.
  201. Conduent breach affects 25M+ people, a hijacked Outlook add-in steals Microsoft logins, and Apple and Microsoft ship major patch batches.
  202. Warlock ransomware breaches SmarterTools via unpatched SmarterMail, Conduent breach exposes Volvo customer data, Ivanti zero-days hit Dutch regulators.
  203. Spain's Ministry of Science IT outage, Conpet ransomware attack tied to Qilin, and Substack breach.
  204. Mexican government breach claim, Notepad++ update hijacking distributing a backdoor, and a critical n8n flaw allowing host takeover.
  205. Notepad++ supply chain attack, ShinyHunters' Panera Bread leak of 5.1M records, and actively exploited SolarWinds Web Help Desk RCE added to CISA KEV.
  206. Lotus Blossom hijacks Notepad++ update channel, Panera Bread breach exposes 5.1M accounts, and 341 malicious OpenClaw AI skills found.
  207. The Polish energy grid attacks attributed to Sandworm, ShinyHunters breaches of Match Group and Panera, and Ivanti EPMM zero-days under active exploitation.
  208. The Match Group breach, SonicWall-linked ransomware hitting US banks and credit unions, and actively exploited Ivanti EPMM zero-days.
  209. The Polish energy grid cyberattack attributed to ELECTRUM, the eScan update server breach, and the FBI seizure of the RAMP cybercrime forum.
  210. Nike and SoundCloud breaches, ShinyHunters phishing of 100+ organizations, and the exploited Microsoft Office zero-day CVE-2026-21509.
  211. Crunchbase breach by ShinyHunters, failed Sandworm wiper attack on Polish power grid, and nearly 800,000 exposed Telnet servers via GNU InetUtils flaw.
  212. Microsoft Windows 11 UNMOUNTABLE_BOOT_VOLUME boot failures after January 2026 Patch Tuesday, and VMware flaw under active exploitation, plus ISC scanning …
  213. Nike breach claimed by WorldLeaks, Sandworm's failed DynoWiper attack on Poland's grid, and CISA KEV addition for VMware vCenter CVE-2024-37079.
  214. Covers a 149M credential leak, Fortinet FortiCloud SSO bypass exploitation, and ShinyHunters voice phishing of Okta, Microsoft and Google SSO.
  215. Under Armour ransomware breach, Fortinet FortiGate attacks, and Osiris ransomware hitting a Southeast Asian food franchisee, plus SmarterMail and Cisco …
  216. LastPass phishing aimed at master passwords, Google Gemini calendar prompt-injection leaks, and PDFSider malware sideloading.
  217. CIRO breach exposing 750,000 Canadian investors, StealC panel XSS flaw, and Microsoft's emergency Windows out-of-band patches.
  218. CIRO data breach affects 750,000 people, Fortinet FortiSIEM flaw exploited in the wild, and Cisco AsyncOS zero-day patched.
  219. Grubhub and Central Maine Healthcare breaches, Microsoft-led RedVDS takedown, and a Cisco Secure Email Gateway zero-day exploited by China-linked APTs.
  220. Kyowon ransomware, Fortinet FortiSIEM RCE exploits, the RedVDS takedown, and the AISURU/Kimwolf botnet disruption in this January 2026 brief.
  221. Central Maine Healthcare and Endesa breaches, Microsoft's January 2026 Patch Tuesday zero-days, and GoBruteforcer botnet hitting crypto projects.
  222. Hackers selling Target source code, the n8n "Ni8mare" flaw hitting about 60,000 instances, and a Gogs zero-day under a CISA patch order.
  223. IDHS exposing ~700,000 residents' health data, a VMware ESXi zero-day exploited via SonicWall VPN, and Trend Micro Apex Central RCE patches.
  224. WhatsApp worm spreading Astaroth in Brazil, Kimwolf botnet infecting 2M+ Android TV boxes, and HPE OneView CVE-2025-37164 under active exploitation.
  225. Brightspeed customer data claimed stolen by Crimson Collective, fake AITOPIA Chrome extensions harvesting AI chats, and critical n8n 'Ni8mare' RCE (CVSS 10.0).
  226. Jaguar Land Rover's cyberattack fallout, Sedgwick Government Solutions breach, and malicious Chrome extensions stealing ChatGPT and DeepSeek chats from 900,000 …
  227. RondoDox botnet exploits React2Shell to hijack IoT devices; GlassWorm pushes trojanized crypto wallets to macOS developers via malicious VSCode extensions.
  228. FBI seizes web3adspanels.org credential-hosting domain, La Poste DDoS, SEC charges in $14M AI crypto scam, MongoDB RCE patch urged.
  229. The French postal service cyberattack, the Nissan and Red Hat GitLab data exposure, and the Baker University breach affecting 53,000 people.
  230. The University of Sydney breach, Denmark water utility attack attributed to Russia, and actively exploited WatchGuard Fireware VPN flaw CVE-2025-14733.
  231. Ferry malware arrests in France, E-Note crypto exchange seizure, HPE OneView CVE-2025-37164 RCE, and Kimsuky's $2B crypto theft in 2025.
  232. LKQ Oracle EBS breach, Cisco AsyncOS zero-day CVE-2025-20393 exploited by China-linked APT, and Kimwolf botnet hijacking 1.8M Android devices for DDoS.
  233. PDVSA cyberattack disrupts Venezuelan oil exports, SoundCloud breach hits 20% of users, and Urban VPN extension harvests AI chatbot conversations.
  234. SoundCloud breach and VPN disruption, Askul ransomware exposing 740,000 records, and ShinyHunters extorting PornHub over Mixpanel-linked data theft.
  235. The Coupang breach (33.7M customers), Akira's Fieldtex claim, and the exploited Gladinet CentreStack and React2Shell (CVE-2025-55182) flaws.
  236. The Gogs zero-day hitting 700+ servers, the LastPass £1.2M ICO fine, Gladinet CentreStack exploitation, and WIRTE's AshTag malware campaign.
  237. React2Shell exploitation, Gladinet CentreStack hard-coded key attacks, WinRAR CVE-2025-6218 abuse, and Fortinet auth bypass patches in this security news brief.
  238. The 64M-record Barcelona data theft arrest, STAC6565 and QWCrypt attacks on Canadian firms, and Microsoft's December 2025 Patch Tuesday zero-days.
  239. Pear ransomware hits Tri-Century Eye Care; React2Shell and ICTBroadcast flaws exploited; malicious VS Code extensions found in Microsoft Marketplace.
  240. Inotiv ransomware theft, Marquis breach affecting 780,000+, and React2Shell (CVE-2025-55182) exploitation by China-linked actors.
  241. Cloudflare's record 29.7 Tbps Aisuru botnet DDoS, the Oracle E-Business Suite Clop campaign hitting universities, and WordPress King Addons plugin takeovers.
  242. Coupang breach exposing 33.7M users, Shai-Hulud 2.0 npm attack leaking 400,000 developer secrets, and North Korean threat actors renting engineers' identities …
  243. Coupang breach exposing 33.7M customers, CodeRED alert platform shut down by Inc ransomware, and SmartTube app compromised via stolen signing keys.
  244. The Asahi Group breach affecting up to 1.9 million people, the FFF data theft via a compromised account, and a Microsoft Teams cross-tenant flaw bypassing …
  245. FFF data breach, 17,000+ secrets exposed in public GitLab repos, and North Korean Contagious Interview npm packages spreading OtterCookie malware.
  246. OpenAI API customer data exposed via Mixpanel breach, Asahi ransomware hits 2M people, and CodeRED alert system outage; plus Tomiris and Bloody Wolf activity.
  247. Gainsight breach expands to more Salesforce customers, Shai-Hulud v2 npm-to-Maven supply chain attack, and Qilin ransomware hits South Korean MSP. Plus London …
  248. Dartmouth breach via Oracle E-Business Suite by Clop, OnSolve CodeRED emergency alert disruption, and SitusAMC hack hitting US banks, plus Fluent Bit flaws and …
  249. The Oracle EBS extortion campaign hitting Cox, Canon and Mazda, the Shai-Hulud npm malware wave, and Harvard's voice phishing breach, plus new zero-days.
  250. The Salesforce Gainsight breaches by ShinyHunters, the CrowdStrike insider leak, and the actively exploited Oracle Identity Manager flaw (CVE-2025-61757).
  251. Salesforce OAuth data access via Gainsight, Italy's FS Italiane breach through Almaviva, and Operation WrtHug compromising 50,000+ Asus routers.
  252. The Pennsylvania AG ransomware breach by Inc Ransom, the WhatsApp contact discovery flaw exposing 3.5 billion numbers, and a FortiWeb zero-day under active …
  253. The Oracle E-Business Suite-linked Cl0p breaches including Logitech, Chrome and FortiWeb zero-days, and the record 15.72 Tbps Aisuru DDoS attack on Microsoft …
  254. Microsoft's November 2025 Patch Tuesday with 60+ fixes and an actively exploited zero-day, plus Google's Android Rust and Play Store battery-drain changes.
  255. JLR's £196M cyberattack losses, RondoDox botnet exploiting unpatched XWiki flaw, and guilty pleas over North Korean IT worker infiltration.
  256. Logitech and Washington Post breaches tied to Clop's Oracle E-Business Suite attacks, plus Fortinet FortiWeb zero-day exploited and added to CISA KEV.
  257. The Oracle EBS data theft fallout, Operation Endgame takedowns, and actively exploited Fortinet and WatchGuard flaws in today's cybersecurity news.
  258. Citrix Bleed 2 and Cisco ISE zero-day exploitation, the Synnovis ransomware data breach, and a 67,000-package npm spam worm.
  259. The GlobalLogic Oracle EBS data theft, the Rhadamanthys infostealer takedown, and Microsoft's November 2025 Patch Tuesday with 63 flaws including a kernel …
  260. Oracle EBS Cl0p extortion hits nearly 30 firms incl. Logitech and Washington Post; CBO confirms breach; Konni abuses Google Find Hub.
  261. GlassWorm returns with malicious VS Code extensions on OpenVSX; Microsoft discloses Whisper Leak AI side-channel attack and reminds Windows 10 users to enroll …
  262. Covers the CBO hack, Russian destructive attacks on Ukraine's grain sector, and LANDFALL spyware exploiting a Samsung zero-day via WhatsApp images.
  263. The SonicWall cloud backup breach, Sandworm's wiper attacks on Ukraine, Cisco UCCX patches (CVE-2025-20333), and a $128M Balancer DeFi exploit.
  264. Miljödata breach affecting 1.5M, Nikkei Slack compromise and actively exploited Post SMTP WordPress flaw.
  265. Balancer DeFi $120M hack, Everest ransomware claims, and XWiki RCE exploitation.
  266. Penn breach claims 1.2M donors exposed, Open VSX token leak enabling supply-chain attacks, and arrest of alleged Jabber Zeus coder MrICQ in Italy.
  267. The Ribbon Communications breach, Cisco IOS XE webshell attacks, the Motex Lanscope zero-day exploited by Tick, and Conti extradition news.
  268. Ribbon Communications nation-state breach, Conduent 10.5M-record ransomware-claimed breach, and China-linked VMware Tools zero-day exploitation.
  269. Dentsu/Merkle breach, Canadian water and energy hacktivist intrusions, and DELMIA Apriso and XWiki exploitation, plus TEE.fail and PhantomRaven.
  270. The Dentsu/Merkle breach, Cl0p's Oracle EBS zero-day attacks on Schneider Electric and Emerson, and TEE.Fail trusted execution attacks.
  271. Top Secret clearance database exposed, ChatGPT Atlas hidden-command flaw, and Chrome zero-day tied to Memento Labs spyware.
  272. Jaguar Land Rover cyber incident, OpenAI Atlas browser prompt-injection flaw, and CoPhish phishing abusing Microsoft Copilot Studio for OAuth token theft.
  273. AWS DNS outage, WSUS CVE-2025-59287 under active exploitation, and Lazarus Group fake job lures against European drone firms.
  274. Toys R Us Canada data breach, Collins Aerospace airport check-in disruption, and Lazarus Group's Operation DreamJob against European defense firms.
  275. Magento/Adobe Commerce SessionReaper (CVE-2025-54236) mass compromise, MuddyWater Phoenix backdoor campaign, and SharePoint ToolShell exploitation by Chinese …
  276. The PassiveNeuron espionage campaign, the actively exploited Oracle E-Business Suite SSRF flaw (CVE-2025-61884), and a WatchGuard Firebox RCE flaw affecting …
  277. F5 breach, Muji ransomware outage via Askul, AWS two-hour outage, and Salt Typhoon's Snappybee attack on a European telecom, plus GlassWorm and WatchGuard …
  278. China accuses NSA of attacking National Time Service Center; Experian Netherlands fined €2.7M under GDPR; TikTok ClickFix lures spread infostealers.
  279. Envoy Air's Oracle EBS data theft claimed by Clop, Prosper's breach of 17.6 million accounts, and Zendesk email bombing.
  280. F5 breach tied to Chinese actors, Prosper breach hitting 17.6M accounts, and Cisco IOS flaw exploited to deploy Linux rootkits.
  281. F5 BIG-IP source code theft, Capita's £14M UK fine, and Clop's Oracle zero-day attack on Harvard.
  282. Prince Group crypto seizure, Harvard breached via Oracle E-Business Suite zero-day CVE-2025-61884, and Flax Typhoon ArcGIS backdoor campaign.
  283. SimonMed Imaging breach by Medusa, Oracle EBS zero-day hitting Harvard and Clop, and Salesforce-linked data leaks by extortion groups.
  284. SonicWall SSL VPN compromises across 100+ environments, Oracle EBS zero-day malware attacks, and FBI seizure of BreachForums domains tied to ShinyHunters.
  285. FBI seizes BreachForums amid ShinyHunters Salesforce extortion; Gladinet CentreStack zero-day CVE-2025-11371 and Oracle EBS zero-day attacks actively exploited.
  286. Oracle EBS zero-day exploited by CL0P, SonicWall cloud backup breach exposing firewall configs, and Discord ID photo leak of 70,000 users.
  287. Discord Zendesk breach affecting 5.5M users, Qilin's Asahi brewery leak, and a LockBit-Qilin-DragonForce ransomware cartel.
  288. Salesforce customer data theft by ShinyHunters, Clop's Oracle EBS zero-day, and Redis 'RediShell' RCE flaw.
  289. Covers Asahi ransomware, Salesforce data extortion by ShinyHunters, Jaguar Land Rover repeat attacks, and CISA-flagged Meteobridge root RCE exploited in the …
  290. Red Hat GitLab repo breach claim, WestJet breach affecting 1.2M, and Oracle E-Business Suite extortion campaign possibly tied to Cl0p are the top stories.
  291. Clop's Oracle E-Business Suite extortion campaign, the WestJet and Allianz Life breaches, and the WireTap/Battering RAM physical attack on Intel SGX and AMD …
  292. Ransomware theft of 8,000 preschoolers' data, Microsoft cutting Israel's military off from cloud surveillance, and Neon pausing operations over flaws.
  293. The Fortra GoAnywhere zero-day (CVE-2025-10035), Volvo supply chain ransomware theft, and Flo Health's $56M settlement with Google.
  294. Co-op's £80M cyberattack loss, Shai-Hulud npm worm infecting 500+ packages, and Cisco zero-days under CISA emergency directive.
  295. Boyd Gaming data breach, Jaguar Land Rover production shutdown, and fake Malwarebytes and LastPass installers on GitHub targeting Mac users.
  296. Ransomware disrupting European airport check-ins including Heathrow, the Stellantis Salesforce data breach, and a CVSS 10 GoAnywhere MFT flaw.
  297. JLR halts vehicle production after cyberattack, Collins Aerospace software disrupts European airports, and Microsoft patches a critical Entra ID token flaw.
  298. UNC1549 espionage against European telecoms, Turla and Gamaredon teaming up on Ukraine, and a CVSS 10.0 GoAnywhere MFT command injection patch.
  299. Iran-linked UNC1549 breaches European telecoms, Gamaredon and Turla team up on Ukraine, and ShinyHunters tied to healthcare breaches affecting 600K+ people.
  300. SonicWall cloud backup breach, Tiffany & Co. data theft and BianLian-linked Medical Associates of Brevard breach affecting nearly 250,000 people.
  301. Salesforce data theft by ShinyHunters via Salesloft Drift tokens, Shai-Hulud NPM supply chain worm, and Chrome zero-day CVE-2025-10585.
  302. JLR extends shutdown after cyberattack; Microsoft and Cloudflare dismantle RaccoonO365 phishing network; DHS misconfigured data hub exposes sensitive …
  303. Npm supply chain compromise of 40+ packages, KillSec ransomware breach of a Brazilian healthcare software provider, and Google's LERS account abuse.
  304. Covers FBI alert on UNC6040/UNC6395 Salesforce data theft and extortion, GitHub Pages SEO-poisoning malware, and the VoidProxy phishing-as-a-service platform.
  305. Apple spyware alerts in France, FBI warning on Salesforce data theft by UNC6040/UNC6395, and CVE-2025-5086 exploitation in DELMIA Apriso.
  306. Apple spyware notifications in France, Dassault DELMIA Apriso CVE-2025-5086 exploitation, and new Yurei ransomware group, plus HybridPetya UEFI bypass.
  307. LNER breach, INC ransomware attack on Panama's finance ministry, and a critical SonicWall SSLVPN flaw (CVE-2024-40766) exploited by Akira ransomware.
  308. The Jaguar Land Rover breach, a record NPM supply-chain attack, and Scattered Spider's $380M Clorox heist, plus Microsoft's 80 patches and Chinese APT activity.
  309. Plex data breach, Adobe's SessionReaper Magento flaw and SAP NetWeaver criticals.
  310. The npm supply chain attack, the Salesloft Drift breach hitting Salesforce, and GhostAction's theft of 3,325 CI secrets from GitHub workflows.
  311. The Wealthsimple breach, the Salesforce-linked attack on Proofpoint and Tanium, SAP S/4HANA CVE-2025-42957 exploitation, and CastleRAT from TAG-150.
  312. PowerSchool sued by Texas over 62M-student breach; Sitecore zero-day exploited with WeepSteel malware; APT28 deploys NotDoor Outlook backdoor.
  313. Jaguar Land Rover cyberattack disrupts operations, Workiva breach via Salesforce CRM, and Salesloft/Drift fallout hits Cloudflare, Palo Alto Networks and …
  314. Salesloft Drift OAuth breach hits Cloudflare, Palo Alto Networks and Zscaler; Jaguar Land Rover cyberattack halts production; WhatsApp zero-day exploited …
  315. The Zscaler and Salesloft data breaches, Midnight Blizzard's Microsoft 365 operation disrupted by Amazon, and a WhatsApp zero-click patch.
  316. The TransUnion breach affecting 4.4M US consumers, the Nevada ransomware attack, and a FreePBX zero-day under active exploitation.
  317. The TransUnion breach affecting 4.4 million people, a Nevada ransomware attack, and an actively exploited FreePBX zero-day.
  318. Covers the TransUnion breach (4.4M people), MathWorks ransomware theft, and the Nx npm supply chain attack that leaked 2,300+ credentials via AI-powered …
  319. Miljödata breach disrupts 200+ Swedish municipalities; Citrix NetScaler flaw CVE-2025-7775 exploited; Salesforce data theft via Salesloft Drift OAuth tokens.
  320. Nevada state government cyberattack shuts offices; Salesloft Drift token breach exposes Salesforce data; Citrix NetScaler zero-day CVE-2025-7775 patched.
  321. Farmers Insurance 1.1M-person breach via Salesforce attacks, BianLian's Aspire Rural Health breach, and Docker Desktop container escape CVE-2025-9074 (CVSS …
  322. BianLian's Aspire Rural Health breach, a Data I/O ransomware attack, and a Farmers Insurance breach affecting over 1 million people.
  323. DaVita's ransomware breach affecting nearly 2.7M people, Apple zero-day CVE-2025-43300, and Murky Panda cloud and telecom espionage.
  324. The DaVita ransomware breach affecting 2.7M people, Murky Panda's cloud supply-chain intrusions, and Apple's zero-day patch for CVE-2025-43300.
  325. Inotiv ransomware, Intel and Workhorse Software data exposures, password manager clickjacking flaws, Apple's CVE-2025-43300 zero-day, and RapperBot botnet …
  326. Allianz Life Salesforce breach exposes 1.1M records, Play ransomware exploits Windows CLFS, and ActiveMQ attackers deploy DripDropper malware.
  327. The Workday CRM breach, unpatched N-able N-central servers under active exploitation, and RansomExx's PipeMagic backdoor abusing a Windows flaw.
  328. Kremlin-linked attack on a Norwegian dam, a partial FortiWeb auth-bypass exploit, and leaked ERMAC 3.0 Android banking trojan analysed.
  329. The WarLock ransomware attack on Colt Technology, UAT-7237 APT breaches of Taiwanese web servers, and Cisco's patched critical FMC RADIUS flaw.
  330. Pennsylvania AG office cyberattack, RansomHub-linked Manpower breach of 140,000, and Russian hackers breaching US court e-filing; plus Fortinet FortiSIEM flaw.
  331. The Allianz Life Salesforce data theft, unpatched Citrix NetScaler CitrixBleed 2 exposure, and the Charon ransomware campaign against Middle East public sector …
  332. Connex Credit Union breach hits 172,000 members; Citrix NetScaler CVE-2025-6543 exploited against Dutch critical orgs; BlackSuit ransomware infrastructure …
  333. Google Calendar invites hijacking Gemini agents, a WinRAR zero-day (CVE-2025-8088) exploited in the wild, and fake Tesla sites promoted via Google ads.
  334. Columbia University breach hits 870,000, Bouygues discloses 6.4M-customer breach, and Royal/BlackSuit ransomware dismantled after 450+ U.S. victims.
  335. The Bouygues Telecom breach of 6.4 million customers, the Salesforce vishing campaign tied to ShinyHunters, and the CISA-mandated patch for Exchange …
  336. Google Salesforce data breach by ShinyHunters, DaVita ransomware notice to over 1 million people, and WhatsApp removing 6.8 million scam-centre accounts.
  337. Pandora and Cisco data breaches, Android and Adobe AEM zero-days, and SonicWall firewall attacks by ransomware gangs in this August 2025 brief.
  338. Chanel and Northwest Radiologists breaches, Akira's suspected SonicWall zero-day, and SharePoint exploits hitting 148 organisations.
  339. PlayPraetor Android RAT infects 11,000+ devices via fake Google Play pages; Microsoft releases PyRIT cloud red-teaming tool; pop3user legacy login activity.
  340. Akira ransomware exploiting SonicWall SSL VPN zero-days, the Pi-hole GiveWP breach, and Secret Blizzard AitM attacks on Moscow embassies.
  341. North Korea-linked UNC4899 crypto theft, UNC2891 ATM network breaches, and patched Honeywell Experion PKS industrial control flaws.
  342. ShinyHunters vishing breaches at Qantas, Allianz Life and Adidas; SafePay claims 3.5TB Ingram Micro theft; Microsoft SharePoint mass exploitation hits South …
  343. Saint Paul city cyberattack prompting National Guard activation, Aeroflot flight cancellations, and Allianz Life breach hitting 1.4M US customers.
  344. The Toptal npm supply chain breach, Cisco ISE and PaperCut exploitation, and the BlackSuit-to-Chaos ransomware shift in one daily brief.
  345. Allianz Life breach, WordPress Post SMTP flaw exposing 200k+ sites, and ToolShell SharePoint exploits.
  346. Ransomware up 63% in Q2 2025, Amazon's Q Developer VS Code extension hijacked with wiper commands, and a North Korean IT worker laptop-farm sentencing.
  347. BlackSuit ransomware sites seized, Toptal GitHub breach poisons npm packages, and ToolShell SharePoint flaws hit 400+ servers.
  348. NNSA breach via Microsoft SharePoint zero-days, Clorox's $380M suit against Cognizant, and a backdoored npm 'is' package.
  349. SharePoint zero-days under active exploitation by Chinese APTs, Cisco ISE RCE flaws, and Dell's breach by World Leaks group.
  350. Dell confirms World Leaks breach of its test lab and CrushFTP zero-day exposes 1,000+ servers; also SharePoint ToolShell zero-days hit US agencies, plus Dior …
  351. SharePoint zero-days (CVE-2025-53770/53771) breached 75+ servers, 3,500 sites ran stealth crypto miners, and npm packages were trojanized via phishing.
  352. NCSC attributes Microsoft 365 Authentic Antics malware to APT28, CrushFTP zero-day hijacks servers, and Google sues BADBOX 2.0 botnet operators.
  353. The $27M BigONE crypto exchange breach, Salt Typhoon's nine-month Army National Guard intrusion, and Cisco ISE CVE-2025-20337 (CVSS 10) with other …
  354. Co-op's 6.5M member data theft, UNFI's up to $400M sales hit and Louis Vuitton breaches tied to ShinyHunters.
  355. The Belk and McDonald's data incidents, North Korea's npm Contagious Interview campaign, and Chrome 138's fifth zero-day of 2025.
  356. The McHire chatbot data exposure of 64M applicants, the Gravity Forms supply-chain backdoor, and Wing FTP Server and FortiWeb exploitation.
  357. UK arrests over Scattered Spider attacks on M&S, Co-op and Harrods; Qantas breach hits 5.7M customers; Citrix NetScaler CVE-2025-5777 added to KEV.
  358. The Qantas breach (5.7M customers), Ingram Micro's SafePay ransomware attack, and McDonald's Paradox.ai hiring platform exposure.
  359. M&S ransomware by DragonForce, the SK Telecom breach exposing 27 million records, and the BaitTrap fake news investment fraud network.
  360. The Ingram Micro outage, a claimed Telefónica data leak, critical Sudo root-escalation flaws, and NightEagle's Exchange zero-day campaign against China.
  361. Spanish police bust a €10M investment fraud ring, IdeaLab ransomware data theft, and Ivanti CSA zero-days exploited by Chinese actors against French sectors.
  362. Qantas breach hits 6M customers, Cisco Unified CM hardcoded root SSH backdoor patched, and Gamaredon spearphishing Ukraine. Plus Scattered Spider and NimDoor.
  363. Qantas and Johnson Controls breach notices, a Chrome zero-day (CVE-2025-6554) under active exploitation, and Silver Fox's Gh0stRAT campaign against Taiwanese …
  364. Swiss federal data exposed via Radix ransomware breach, Scattered Spider targets airlines, and over 1,200 unpatched Citrix NetScaler servers under active …
  365. Ahold Delhaize breach hits 2.2M people, Cloudflare mitigates record DDoS, Russia throttles Cloudflare, Citrix Bleed 2 exploited.
  366. The UNFI and Hawaiian Airlines cyberattacks, a DOJ charge against alleged IntelBroker, and critical Cisco ISE and Open VSX flaws.
  367. Citrix NetScaler 'CitrixBleed 2' exploitation, Cyber Fattah's leak of 2024 Saudi Games data, and arrests of BreachForums operators in France.
  368. Nucor's data-theft breach, a trojanized SonicWall NetExtender VPN client, Microsoft Exchange login-page injections, and APT28 Signal-based malware campaigns in …
  369. Iran state TV hack, $11M BitoPro crypto theft by Lazarus Group, Aflac breach tied to Scattered Spider, and record 7.3 Tbps DDoS attack.
  370. Salt Typhoon breaches Viasat, Krispy Kreme data theft of 160,000+ people, and Paragon Graphite spyware used against European journalists.
  371. Episource breach hits 5.4M US patients, Predatory Sparrow drains $90M from Iran's Nobitex, and Water Curse hijacks 76 GitHub accounts.
  372. The Washington Post journalist email breach, Zoomcar's 8.4M-user data breach, and Scattered Spider's pivot to U.S. insurers.
  373. Malicious PyPI package impersonating Chimera steals developer AWS and CI/CD secrets; 46,000+ Grafana instances unpatched; Windows Server June update freezes …
  374. Victoria's Secret outage after May 24 security incident, Apple zero-click Messages exploit by Paragon spyware, and SimpleHelp RMM flaw exploited by ransomware …
  375. Paragon Graphite spyware hit journalists' iPhones, EchoLeak exposed Microsoft 365 Copilot, and 80,000 Entra ID accounts faced password spraying.
  376. Erie Insurance cyberattack, INTERPOL's Operation Secure takedown of infostealer infrastructure, and a Microsoft WebDAV zero-day exploited by Stealth Falcon.
  377. The TxDOT crash-records data breach, Microsoft's June 2025 Patch Tuesday zero-days, and the six-hour Heroku outage.
  378. Play ransomware breached about 900 organizations, Lee Enterprises disclosed a breach of ~40,000 people, and Cisco ISE CVE-2025-20120 auth bypass patched.
  379. Victoria's Secret earnings delay, Coinbase data breach via bribed TaskUs staff, and Scattered Spider's attacks on UK retailers Marks & Spencer and Co-op.
  380. Cartier and The North Face breaches, a Chrome emergency zero-day patch, and Qualcomm Adreno zero-days exploited in targeted attacks.
  381. ConnectWise ScreenConnect breach by a suspected nation-state, AVCheck takedown, and China-linked Earth Lamia exploiting SAP NetWeaver and SQL Server flaws.
  382. ConnectWise ScreenConnect breach by suspected nation-state, DragonForce ransomware via SimpleHelp RMM, and Victoria's Secret site outage.
  383. Critical WooCommerce Wishlist flaw puts 100k+ WordPress sites at risk; AyySSHush botnet hits 9,000 ASUS routers; Interlock ransomware targets universities.
  384. Adidas and MathWorks breaches, the DragonForce MSP ransomware attack via SimpleHelp, and Void Blizzard's NGO phishing campaigns.
  385. Malicious npm/VS Code packages stealing data via Discord webhooks, and Russia-linked TAG-110 phishing Tajik government with macro-enabled Word templates.
  386. 70+ malicious npm and VS Code packages exfiltrating data via Discord, ChatGPT Deep Research adding Dropbox and Box integration, and OpenAI's o3 altering a …
  387. Russian state hackers target security cameras to spy on Ukraine aid shipments; Signal criticises Microsoft's Recall feature over privacy concerns.
  388. Covers the 184M password exposure, $223M Cetus Protocol crypto heist, and Europol's Operation Endgame ransomware crackdown.
  389. Chinese UAT-6382 exploits Trimble Cityworks to breach US local governments; Ivanti EPMM flaws hit European, North American and Asian agencies; 184M credentials …
  390. Marks & Spencer cyberattack disrupting operations, Coinbase breach hitting 69,461 customers, and the Lumma infostealer takedown.
  391. Cellcom outage cyberattack, SK Telecom malware breach exposing 27M USIM records, and RVTools supply chain attack delivering Bumblebee malware.
  392. The UK Legal Aid Agency data breach, the Arla Foods cyberattack disrupting production, and the RVTools compromise delivering Bumblebee malware.
  393. Coinbase to reimburse up to $400M after a data breach; twelve indicted over a $263M crypto heist; Defendnot tool disables Microsoft Defender.
  394. Procolored printer drivers spread malware for six months, Coinbase offers $20M bounty after extortion, and Intel CPUs face new Spectre-style flaws.
  395. Coinbase breach via bribed support agents, Nucor halted by a cyber incident, and APT28 exploiting webmail zero-days in the RoundPress campaign.
  396. The Coinbase insider data breach and extortion attempt, SAP NetWeaver exploitation by BianLian and RansomExx, and Samsung MagicINFO Mirai attacks.
  397. Marks & Spencer customer data theft, Microsoft May 2025 Patch Tuesday with five zero-days, and SAP NetWeaver exploitation by ransomware gangs.
  398. The Output Messenger zero-day used in Kurdish espionage, an airline cyberattack, and a Global botnet takedown with four arrests.
  399. ICE deportation airline hack exposes detainee data, a school software ransomware attack, and Noodlophile infostealer lures using fake AI video tools.
  400. LockBit's breach, PowerSchool extortion of school districts, and the actively exploited OttoKit WordPress flaw.
  401. Langflow and Samsung MagicINFO RCE exploitation, GeoVision devices feeding Mirai botnets, and the UK Legal Aid Agency incident.
  402. TeleMessage's breach and suspended services, the Darcula SMS phishing platform stealing 884,000 cards, and UK retail attacks prompting new NCSC guidance.
  403. Coordinated hacks on UK retailers, a two-year Iranian APT intrusion into Middle East critical infrastructure, and a critical Apache Commons Text RCE flaw.
  404. Co-op confirms data theft after DragonForce claims, a Magento supply chain attack hits 500+ stores, and UK retailers face a ransomware wave.
  405. Harrods cyberattack amid UK retail spree, Commvault zero-day CVE-2025-3928 breach, and NullBulge's Disney Slack data theft guilty plea.
  406. SonicWall SMA100 exploitation, Co-op cyberattack disruption and Ascension healthcare data breach.
  407. SK Telecom's USIM breach and SIM replacements, APT28's attribution by France, and the AirBorne AirPlay zero-click RCE flaws.
  408. The M&S cyberattack, Craft CMS zero-day exploitation and SAP NetWeaver server hijacks, plus the Earth Kurma APT campaign in Southeast Asia.
  409. Microsoft reports Storm-1977 password-spraying attacks on education cloud tenants deploying crypto miners; also covers Brave's Cookiecrumbler and a Coinbase 2FA …
  410. Marks & Spencer cyberattack halts online orders, SAP NetWeaver zero-day exploited with web shells, and Craft CMS zero-days hit servers. Plus MTN breach and Salt …
  411. Healthcare breaches dominate: Yale New Haven Health exposes 5.5M patients, Interlock leaks DaVita data, and Lazarus Group targets South Korean firms with …
  412. Blue Shield of California exposed 4.7M members' health data to Google analytics; NLRB data exfiltration alleged by a whistleblower; Lazarus Group's $137M TRON …
  413. Marks & Spencer cyberattack disrupts Click and Collect; DeepSeek breach exposes data on dark web; SK Telecom discloses malware exposing USIM customer data.
  414. DOGE's alleged NLRB data exfiltration, a Microsoft Entra lockout mishap, and the 'Fog' ransomware campaign hitting over 100 victims since January.
  415. APT29 phishes European diplomats with wine-themed lures and GRAPELOADER; malicious npm packages plant SSH backdoors; Entra ID leaked-credential alerts lock out …
  416. Ahold Delhaize breach by INC ransomware, Darcula-enabled SMS phishing spike, and Erlang/OTP SSH and Windows NTLM flaws.
  417. SonicWall SMA exploitation, Apple iOS zero-days, a Fortinet symlink backdoor on 16,000+ devices, and the CrazyHunter ransomware targeting Taiwan.
  418. Phishing tops UK attacks, North Korea expands IT worker fraud, and MITRE's CVE funding expires, threatening the vulnerability database.
  419. Gladinet Triofox/CentreStack RCE under active exploitation, Hertz breach via Cleo zero-day theft, and Fortinet zero-day exploit chatter.
  420. The DaVita ransomware attack, Chinese transformer backdoor fears, and Pakistan-linked actors using Xeno RAT and Spark RAT against India.
  421. Langflow CVE-2025-3248 exploitation, the Tycoon2FA phishing kit targeting Microsoft 365, and 'slopsquatting' supply chain risks from AI-hallucinated packages.
  422. FortiGate read-only access after patching, Paper Werewolf's PowerModul implant, and PAN-OS GlobalProtect brute-force attacks.
  423. North Korean IT worker schemes, AkiraBot's AI-generated spam campaign against 420,000 sites, and a Lovable AI jailbreak flaw.
  424. Microsoft's 134-flaw Patch Tuesday with a zero-day, RansomEXX exploiting a Windows CLFS zero-day, and Mirai botnet attacks on TVT DVRs.
  425. ClipBanker malware spread via SourceForge, Everest ransomware leak site hacked, and CrushFTP flaw added to CISA KEV catalog.