DanSec

Vendor

Salesforce

In 58 briefs, most recently 25 September 2026. RSS for this tag

Learn more: Vulnerabilities (NVD) ↗

Coverage in DanSec Daily

  1. The $351.6M Bitget crypto theft by suspected North Korean actors, the Roundcube CVE-2026-48842 exploitation, and Salesforce Agentforce 'SalesBleed' flaws.
  2. The CareCloud breach growing to 3.7M people, Medusa ransomware hitting 500+ US critical infrastructure orgs, and Clop's attack on PTC Windchill servers.
  3. Ceva Logistics warehouse cyberattack, LiteLLM supply chain breach hitting 2,500+ orgs, and Lazarus Group Windows zero-day exploit.
  4. Microsoft ties Salesforce intrusions to ShinyHunters; Nihon Kotsu cyberattack and Lidl breach also covered, plus Russian state hacker sanctions and router …
  5. Polymarket $3M frontend hack via vendor, Klue-Salesforce breach hitting two dozen firms, and Signal backup-key phishing by Russian-linked hackers.
  6. Tata Electronics cyberattack and Klue OAuth-token breaches hitting LastPass and Salesforce customers, plus FortiBleed hitting 430,000 FortiGate firewalls with …
  7. Klue integration breach exposes Salesforce data, FortiBleed credential theft hits ~86,000 Fortinet devices, and Operation Endgame disrupts SocGholish.
  8. Klue OAuth breach exposed Salesforce data, FortiBleed leaked ~74,000 Fortinet credentials, and law enforcement disrupted the SocGholish botnet.
  9. Infinite Campus school data theft by ShinyHunters, Tchap breach of French government accounts, and PAN-OS GlobalProtect exploitation.
  10. Grafana source code theft, the ShinyHunters-linked 7-Eleven breach, and an unpatched zero-day in Microsoft Exchange under active exploitation.
  11. ShinyHunters leaks 13.5M McGraw Hill accounts, Rhysida ransomware breach hits 337,000 patients, and Windows zero-days are actively exploited.
  12. Ukrainian targeting by UAC-0247's AgingFly malware, a compromised WordPress EssentialPlugin package, and an nginx-ui flaw exploited in the wild …
  13. Covers the Kraken and McGraw-Hill breaches, a fake Ledger Live app on Apple's App Store, and Microsoft's April 2026 Patch Tuesday with 167 flaws.
  14. Ericsson data breach, suspected FBI wiretap network breach, and Salesforce data theft campaign, plus APT28 espionage malware and Ivanti EPM exploitation.
  15. Ericsson US data breach via service provider, UNC4899 crypto firm theft, and Salesforce Experience Cloud data exposure by ShinyHunters.
  16. Chrome zero-day CVE-2026-2441, CISA's BeyondTrust order, and the Dior/Louis Vuitton/Tiffany $25M Korean fine tied to Scattered LAPSUS$ Hunters Salesforce …
  17. Gainsight breach expands to more Salesforce customers, Shai-Hulud v2 npm-to-Maven supply chain attack, and Qilin ransomware hits South Korean MSP. Plus London …
  18. The Salesforce Gainsight breaches by ShinyHunters, the CrowdStrike insider leak, and the actively exploited Oracle Identity Manager flaw (CVE-2025-61757).
  19. Salesforce OAuth data access via Gainsight, Italy's FS Italiane breach through Almaviva, and Operation WrtHug compromising 50,000+ Asus routers.
  20. The PassiveNeuron espionage campaign, the actively exploited Oracle E-Business Suite SSRF flaw (CVE-2025-61884), and a WatchGuard Firebox RCE flaw affecting …
  21. SimonMed Imaging breach by Medusa, Oracle EBS zero-day hitting Harvard and Clop, and Salesforce-linked data leaks by extortion groups.
  22. SonicWall SSL VPN compromises across 100+ environments, Oracle EBS zero-day malware attacks, and FBI seizure of BreachForums domains tied to ShinyHunters.
  23. FBI seizes BreachForums amid ShinyHunters Salesforce extortion; Gladinet CentreStack zero-day CVE-2025-11371 and Oracle EBS zero-day attacks actively exploited.
  24. Salesforce customer data theft by ShinyHunters, Clop's Oracle EBS zero-day, and Redis 'RediShell' RCE flaw.
  25. Red Hat and Discord breaches, Cl0p exploiting an Oracle E-Business Suite zero-day, and a GoAnywhere MFT flaw abused in Medusa ransomware attacks.
  26. Covers Asahi ransomware, Salesforce data extortion by ShinyHunters, Jaguar Land Rover repeat attacks, and CISA-flagged Meteobridge root RCE exploited in the …
  27. Clop's Oracle E-Business Suite extortion campaign, the WestJet and Allianz Life breaches, and the WireTap/Battering RAM physical attack on Intel SGX and AMD …
  28. Co-op's £80M cyberattack loss, Shai-Hulud npm worm infecting 500+ packages, and Cisco zero-days under CISA emergency directive.
  29. Ransomware disrupting European airport check-ins including Heathrow, the Stellantis Salesforce data breach, and a CVSS 10 GoAnywhere MFT flaw.
  30. Salesforce data theft by ShinyHunters via Salesloft Drift tokens, Shai-Hulud NPM supply chain worm, and Chrome zero-day CVE-2025-10585.
  31. Npm supply chain compromise of 40+ packages, KillSec ransomware breach of a Brazilian healthcare software provider, and Google's LERS account abuse.
  32. Covers FBI alert on UNC6040/UNC6395 Salesforce data theft and extortion, GitHub Pages SEO-poisoning malware, and the VoidProxy phishing-as-a-service platform.
  33. Apple spyware alerts in France, FBI warning on Salesforce data theft by UNC6040/UNC6395, and CVE-2025-5086 exploitation in DELMIA Apriso.
  34. The npm supply chain attack, the Salesloft Drift breach hitting Salesforce, and GhostAction's theft of 3,325 CI secrets from GitHub workflows.
  35. The Wealthsimple breach, the Salesforce-linked attack on Proofpoint and Tanium, SAP S/4HANA CVE-2025-42957 exploitation, and CastleRAT from TAG-150.
  36. Jaguar Land Rover cyberattack disrupts operations, Workiva breach via Salesforce CRM, and Salesloft/Drift fallout hits Cloudflare, Palo Alto Networks and …
  37. Salesloft Drift OAuth breach hits Cloudflare, Palo Alto Networks and Zscaler; Jaguar Land Rover cyberattack halts production; WhatsApp zero-day exploited …
  38. The Zscaler and Salesloft data breaches, Midnight Blizzard's Microsoft 365 operation disrupted by Amazon, and a WhatsApp zero-click patch.
  39. The TransUnion breach affecting 4.4M US consumers, the Nevada ransomware attack, and a FreePBX zero-day under active exploitation.
  40. The TransUnion breach affecting 4.4 million people, a Nevada ransomware attack, and an actively exploited FreePBX zero-day.
  41. Covers the TransUnion breach (4.4M people), MathWorks ransomware theft, and the Nx npm supply chain attack that leaked 2,300+ credentials via AI-powered …
  42. Miljödata breach disrupts 200+ Swedish municipalities; Citrix NetScaler flaw CVE-2025-7775 exploited; Salesforce data theft via Salesloft Drift OAuth tokens.
  43. Nevada state government cyberattack shuts offices; Salesloft Drift token breach exposes Salesforce data; Citrix NetScaler zero-day CVE-2025-7775 patched.
  44. Farmers Insurance 1.1M-person breach via Salesforce attacks, BianLian's Aspire Rural Health breach, and Docker Desktop container escape CVE-2025-9074 (CVSS …
  45. Allianz Life Salesforce breach exposes 1.1M records, Play ransomware exploits Windows CLFS, and ActiveMQ attackers deploy DripDropper malware.
  46. The Workday CRM breach, unpatched N-able N-central servers under active exploitation, and RansomExx's PipeMagic backdoor abusing a Windows flaw.
  47. Workday breach linked to Salesforce attacks, unpatched N-able N-central servers under active exploitation, and $2.8M seized from Zeppelin ransomware operator.
  48. The Allianz Life Salesforce data theft, unpatched Citrix NetScaler CitrixBleed 2 exposure, and the Charon ransomware campaign against Middle East public sector …
  49. Google Salesforce CRM breach, US federal court records cyberattack, and 60 malicious Ruby gems stealing developer credentials, plus Lenovo webcam flaws.
  50. The Bouygues Telecom breach of 6.4 million customers, the Salesforce vishing campaign tied to ShinyHunters, and the CISA-mandated patch for Exchange …
  51. Google Salesforce data breach by ShinyHunters, DaVita ransomware notice to over 1 million people, and WhatsApp removing 6.8 million scam-centre accounts.
  52. Pandora and Cisco data breaches, Android and Adobe AEM zero-days, and SonicWall firewall attacks by ransomware gangs in this August 2025 brief.
  53. Chanel and Northwest Radiologists breaches, Akira's suspected SonicWall zero-day, and SharePoint exploits hitting 148 organisations.
  54. ShinyHunters vishing breaches at Qantas, Allianz Life and Adidas; SafePay claims 3.5TB Ingram Micro theft; Microsoft SharePoint mass exploitation hits South …
  55. The TxDOT crash-records data breach, Microsoft's June 2025 Patch Tuesday zero-days, and the six-hour Heroku outage.
  56. Sensata and UNFI breaches, critical Roundcube RCE CVE-2025-49113 actively exploited, and a Wazuh flaw exploited by Mirai botnets.
  57. Kettering Health ransomware claim, AT&T breach data re-release, and BADBOX 2.0 botnet infecting over 1 million IoT devices.
  58. Play ransomware breached about 900 organizations, Lee Enterprises disclosed a breach of ~40,000 people, and Cisco ISE CVE-2025-20120 auth bypass patched.