Ransomware Gangs Escalate to Physical Threats — Attackers Now Visiting Homes and Threatening Employees’ Families
Summary A disturbing escalation in ransomware tactics has been documented: cybercriminal groups are now resorting to threats of physical violence against employees and their families when organizations refuse to pay…
Critical WebSocket Hijacking Flaw (CVSS 9.7) in Cline AI Coding Agent — Workspace Data Exfiltration via Any Website
Summary A critical WebSocket hijacking vulnerability with a CVSS score of 9.7 has been discovered in Cline’s local Kanban server, the widely-used open-source AI coding agent. The flaw allowed any…
Škoda Data Breach Exposes Online Shop Customers — Names, Addresses, and Password Hashes Accessed
Summary Czech automaker Škoda, a wholly-owned subsidiary of Volkswagen Group, has disclosed a data breach affecting users of its online shop. The incident was discovered through the company’s technical security…
PAN-OS Authentication Portal Zero-Day (CVE-2026-0300) Under Active State-Sponsored Exploitation — No Patch Available
Summary A critical buffer overflow vulnerability in Palo Alto Networks PAN-OS, tracked as CVE-2026-0300 (CVSSv4 9.3), is being actively exploited by a suspected state-sponsored threat cluster designated CL-STA-1132. The flaw…
“ClaudeBleed” — Critical Flaw in Anthropic’s Claude Chrome Extension Lets Any Extension Hijack the AI Agent
Summary Security researchers at LayerX have disclosed “ClaudeBleed,” a critical vulnerability in Anthropic’s Claude Chrome extension that allows any other browser extension — even those with zero special permissions —…
Google Disrupts First Known AI-Generated Zero-Day Exploit — Criminals Used LLM to Bypass 2FA at Scale
Summary Google disclosed on Monday that its Threat Intelligence Group (GTIG) identified and disrupted a criminal operation that used an AI model to develop a working zero-day exploit — marking…
MOVEit Automation Hit with Critical Auth Bypass (CVSS 9.8) and Privilege Escalation — Patch Immediately
Summary Progress Software has issued a critical security alert for two vulnerabilities in MOVEit Automation: CVE-2026-4670, a critical authentication bypass (CVSS 9.8), and CVE-2026-5174, a high-severity privilege escalation flaw. Chained…
RansomHouse Claims Trellix Breach — Cybersecurity Vendor Confirms Unauthorized Access to Source Code Repository
Summary Trellix, the cybersecurity firm formed from the merger of McAfee Enterprise and FireEye, has confirmed that attackers gained unauthorized access to a portion of its source code repository. The…
Pentagon Signs Classified AI Agreements with OpenAI, Google, Microsoft, NVIDIA, and SpaceX for Military Networks
Summary The U.S. Department of Defense has announced classified AI agreements with eight leading technology companies — OpenAI, Google, Microsoft, NVIDIA, Amazon Web Services, Oracle, SpaceX, and Reflection AI —…
France’s National Identity Agency Breached — 11.7 Million Accounts Compromised, 15-Year-Old Suspect Detained
Summary France’s Agence nationale des titres sécurisés (ANTS), the government agency responsible for managing passports, national identity cards, residence permits, and driving licenses, has confirmed a data breach affecting 11.7…