Cybersecurity, AI, etc.
Cybersecurity (breaches, incidents, vulnerabilities, ransomware, supply chain attacks)
According to a report by Resecurity, the INC Ransomware operation has emerged as the “dominant threat actor” exploiting recently disclosed security flaws in SonicWall Secure Mobile Access (SMA) 1000 series…
Unit 42 has disclosed three attack paths against Chrome’s Google Password Manager cloud authenticator, dubbed Pass-ta-key, Silver Pass-ta-key, and Golden Pass-ta-key. The strongest variant targets the master key, enabling malware…
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning about a significant increase in attacks targeting internet-exposed programmable logic controllers (PLCs) in the water and wastewater systems…
A critical vulnerability in the Rails Active Storage framework has been patched, allowing an unauthenticated attacker to read arbitrary files from a Rails application and potentially escalate to remote code…
CISA released comprehensive recommendations to federal agencies today covering open-source software security, touching on open-weight AI models, patching procedures, and supply chain risk. The guidance addresses a growing concern: federal…
Summary The Clop ransomware gang has shifted tactics, now targeting internet-exposed instances of PTC Windchill and FlexPLM by exploiting a critical improper input validation vulnerability (CVE-2026-12569). Windchill is a widely…
Japanese telecommunications giant KDDI has confirmed that a zero-day vulnerability in third-party email platform software was exploited on May 16, 2026, resulting in unauthorized access to approximately 12.23 million email…
In what is shaping up to be one of the largest educational data breaches in history, the ShinyHunters hacking group has leaked data belonging to approximately 275 million students and…
Summary Check Point disclosed a critical zero-day authentication bypass in its SmartConsole, Security Management, and Multi-Domain Management (MDSM) products, tracked as CVE-2026-16232 (CVSS 9.3). The flaw lets an unauthenticated remote…
Summary The autonomous AI ransomware agent known as JADEPUFFER has expanded its operations, now deploying a new payload called ENCFORGE specifically designed to destroy AI and machine learning infrastructure. Identified…