Daily curated cyber threat intelligence for security professionals.
Sourcedatabreaches.net
Curated
Victoria’s Year 12 exams have been thrown into turmoil after the state curriculum and assessment authority’s website was hacked. A message posted by the hacker mocked the authority’s security and claimed the hacker had obtained and distributed this year’s exam papers.
Sourcecybernews.com
Curated
A researcher found two flaws in Ray-Ban Meta smart glasses that allowed her to hack a borrowed device and run her own unapproved code on it. The work raises privacy and device ownership questions, according to Cybernews.
Sourcewww.itsecurityguru.org
Curated
A security researcher has uncovered more than 100 serious vulnerabilities in publicly available UK government code, including credentials that could have given an attacker read-write access across an entire public body’s Microsoft 365 estate. The findings, first reported by WIRED, have reignited debate over whether government should keep publishing its code.
Sourcehackread.com
Curated
Hackers are exploiting a decade-old OpenSSH flaw, dubbed SSHole, to bypass Linux logins and install a Python backdoor. CISA has confirmed the exploitation as patched packages become available.
Sourcecybernews.com
Curated
An exposed CSCTelecom database leaked 125 million SMS messages in real time, according to Cybernews. The messages exposed bank codes, emergency calls and medical data across the Baltic region, affecting clients of Swedbank, SEB, airBaltic and dozens of other companies.
Sourcewww.schneier.com
Curated
Three men — Jacob Soall, Sharon Hazan, and Guy Sheetrit — have been arrested for using AI to alter and impersonate the voices and images of executives and attorneys at various companies, according to a press release from the U.S. attorney’s office for the Southern District of New York. The impersonations were used to convince employees to send over large payments.
Sourcewww.malwarebytes.com
Curated
Muse maker Interaxon reportedly trained AI on users' de-identified brainwave data from its sleep band without telling users. The company revised its privacy policy after journalists asked questions about the practice.
Sourcedatabreaches.net
Curated
Wyndham has acknowledged a cybersecurity incident after a good-faith security researcher discovered a security lapse in its app that exposed customer data. The hotel and resort giant’s acknowledgement was reported by TechCrunch’s Zack Whittaker.
Sourcewww.bleepingcomputer.com
Curated
Baker Tilly Advisory Group is notifying clients that a data breach at a third-party provider compromised certain personal information about them and their dependents. The compromised information was held by the provider rather than in Baker Tilly’s own systems.
Sourcewww.channelnewsasia.com
Curated
Minmed has reported a ‘malicious cybersecurity incident’ involving its teleconsult and health screening system. It is the third cybersecurity incident reported by a Singapore healthcare provider in the past week, after Fullerton Health and Doctor Anywhere disclosed cyberattacks.
Sourcewww.channelnewsasia.com
Curated
Personal data of users of Dementia Singapore’s CARA SG app may have been affected in a cybersecurity incident involving the app. Names, email addresses, phone numbers and membership IDs may have been affected.
Sourcedatabreaches.net
Curated
French lender Credit Mutuel Arkea says hackers stole around €100 million ($112.61 million) in a cyber heist, and it is working to try to recover the money. The case is a rare instance of cybercriminals successfully stealing a large sum directly from a mainstream bank.
Sourcewww.bleepingcomputer.com
Curated
Multiple threat actors are abusing GSocket, a legitimate open-source remote access tool, to maintain access to compromised Linux servers even after the vulnerabilities exploited for initial access are patched. Microsoft says attackers deploy GSocket to keep encrypted remote access to the servers.
Sourcecybernews.com
Curated
Ukrainian authorities have busted a call center network behind a €4.3 million investment scam. The operation used fake crypto platforms and call centers to target German victims, according to investigators.
Sourcesecurityaffairs.com
Curated
Poland has temporarily shut down ePUAP, the government platform citizens and businesses use to reach public services, after detecting and stopping a cyberattack. A government notice says ePUAP electronic mailboxes are unavailable to citizens and public institutions while the platform is offline.
Sourcewww.securityweek.com
Curated
Maersk has confirmed data theft amid a $5 million extortion attempt by the WhiteArmor ransomware group, which claims it stole 100GB of data from the shipping giant. Maersk says the incident involved unauthorized access to a legacy local system inherited from a previous acquisition.
Sourcewww.securityweek.com
Curated
A critical vulnerability in Red Hat Quay could allow attackers to steal private container images and overwrite repositories. Exploitation could also let attackers maintain persistent access to the container image registry, according to SecurityWeek.
Sourcewww.securityweek.com
Curated
Hackers have begun targeting zero-day vulnerabilities in N-able’s N-central remote monitoring and management platform, with malicious activity starting shortly after a researcher publicly disclosed more than 30 zero-days. N-able has rushed out patches, including fixes for the unauthenticated flaws. The company had earlier taken hosted N-central environments offline following the disclosure.
Sourcekrebsonsecurity.com
Curated
The cybercrime group Qilin has emerged as the world’s most active ransomware affiliate program, claiming at least 365 victim organizations in the past three months alone. Even so, the group’s administrator has made operational security mistakes over the last decade that point to a 36-year-old man living in St. Petersburg, Russia. Krebs on Security sets out the evidence behind the identification.
Sourcethehackernews.com
Curated
Attackers have used cloud-hosted ScreenConnect panels to install rogue clients on hundreds of managed endpoints, targeting at least 288 endpoints across 48 organizations. ConnectWise has disabled five third-party extensions in partner environments following reports of unauthorized access. The company said there is no evidence the activity involves a compromise of its infrastructure or a vulnerability in the ScreenConnect software.
Sourcethehackernews.com
Curated
A critical flaw in Apache HTTP Server’s HTTP/2 module, mod_http2, can let a remote attacker run code on the server. Tracked as CVE-2026-119618, it affects versions 2.4.55 through 2.4.70 and is fixed in version 2.4.71, released yesterday. Only servers with HTTP/2 enabled are affected, according to Red Hat.
Sourcewww.techradar.com
Curated
Security researchers at Censys identified 1,465 hosts running exposed consoles for ARTEX, a Chinese-made AI penetration-testing tool that has been adopted in real-world attacks since its release in late July 2026. About 10 percent of those hosts, 155, were also running at least one other tool commonly used in cyberattacks, such as Cobalt Strike, Vshell or Adaptix C2, and 32 publicly accessible directories exposed exploit binaries, post-exploitation tools and other sensitive files. Censys said not all of the exposed instances are malicious, and overall global deployment is likely higher.
Sourcewww.bleepingcomputer.com
Curated
Vanderbilt University says it is responding to an active cybersecurity incident that may affect university devices, systems and cloud-based services, and has told students, faculty and staff to shut down university devices and disconnect from university Wi-Fi. The BYOD ransomware group has claimed it encrypted the university databases and stole sensitive student, employee and research data, including over one million SSNs. Vanderbilt has not confirmed the group involvement, whether systems were encrypted, or whether data was stolen.
Sourcewww.securityweek.com
Curated
Fortinet has published 89 security advisories addressing nearly 100 vulnerabilities across its products, including about 17 critical flaws, several of which could allow arbitrary code execution; FortiMail received the largest batch of critical fixes, followed by FortiAuthenticator, FortiOS, FortiManager and FortiAnalyzer. Fortinet says none of the flaws are known to be exploited in the wild; one FortiClient flaw, dubbed Fortinet2Shell by the researcher who found it, could let a malicious website execute code on a victim’s machine through a CORS misconfiguration when FortiPAM is enabled.
Sourcethehackernews.com
Curated
eMudhra has revoked 8 more intermediate CAs — six for TLS and two for code signing — that it had previously declared unaffected by its October key compromise, after determining that the same key-ceremony script pulled their RSA keys from its hardware security modules and that it cannot demonstrate the key material was handled as its own rules require. The revocations use the cessationOfOperation reason rather than keyCompromise; eMudhra is exiting the publicly trusted TLS business, and Microsoft, Chrome, Firefox and Apple are removing trust in its roots through November.