ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know
Latest cybersecurity breaches news, analysis, and intelligence.
SocGholish compromises websites to route victims to targeted malware based on profiles, enabling cybercriminals to attack finance, healthcare, and critical infrastructure organizations.
LastPass was breached through stolen OAuth tokens from Klue, compromising customer data in Salesforce. Encrypted vaults remained secure, but the incident highlights third-party integration risks.
An Algerian was extradited to the US for operating dark web marketplaces facilitating cybercrime and fraud. The case reflects growing international law enforcement coordination against transnational digital crime.
Email security teams generate more alerts than analysts can process despite heavy tool investments. A webinar explores how behavioral AI automation—not additional tools—can reduce alert fatigue and accelerate incident response to phishing, business email compromise, and account takeover attacks.
London Hydro's June 2026 breach exposed personal and account data for 170,000 Ontario customers. No financial or ID information was compromised, but the incident highlights critical infrastructure security gaps.
Xsolis exposed 1.4M patient records via phishing attack. The healthcare tech firm manages revenue and utilization data for hospitals and insurers, making this a significant supply-chain breach.
JaredFromSubway's $15M hack exploited Ethereum's token approval vulnerabilities. Attackers used fake trading pools to trick the bot into granting dangerous spending permissions, then withdrew WETH, USDC, and USDT.
Compromised WhatsApp accounts send fake documents to deploy backdoor malware globally. The attack hits 11 countries by exploiting trust in known contacts.
FortiBleed targets FortiGate firewalls with custom packet-sniffing tools to harvest administrative credentials and authentication tokens directly from compromised devices. The sophisticated campaign has compromised thousands of instances globally, enabling attackers persistent network access through
Squidbleed exposes cleartext HTTP credentials in Squid proxy through a 1997 FTP parser bug. Authenticated attackers craft malicious FTP responses to leak auth tokens from memory buffers.
Threat actors now offer searchable "credential broker" services where buyers query vast stolen databases for specific targets. This on-demand model—positioning criminals as intermediaries—represents a dangerous maturation of the account takeover ecosystem, reducing barriers to entry for attackers se
Novo Nordisk's GitHub token leak exposed source code and CI/CD pipelines. It highlights a critical gap: organizations invest in secrets tools but neglect basic access governance.
A Russian-speaking threat actor group is using malicious Google Ads to deliver CastleStealer credential-stealing malware via OXLOADER loader, exploiting ad platform legitimacy to target users across industries. The sophisticated campaign enables identity theft and account compromise by harvesting br
A malicious dependency the attackers added to over 140 Mastra packages fetches a payload targeting cryptocurrency extensions. The post North Korean Hackers Blamed for Mastra NPM Supply Chain Attack appeared first on SecurityWeek.
HackerOne, Huntress, Jamf, OneTrust, Recorded Future, Snyk, and Tanium are among the affected Klue customers. The post More Cybersecurity Firms Disclose Impact From Klue Hack appeared first on SecurityWeek.
Hackers stole personal information after breaching the systems of a third-party license vendor serving TPWD. The post Texas Parks & Wildlife Data Breach Affects 3 Million Individuals appeared first on SecurityWeek.
Microsoft has attributed a recent Mastra AI supply chain attack that compromised more than 140 npm packages to the North Korean hacking group Sapphire Sleet, also known as BlueNoroff. [...]
Klue's OAuth breach exposed Salesforce data via compromised integration credentials. The Icarus group claimed the attack, revealing how integrations are now prime supply chain vulnerability vectors.
Texas Parks and Wildlife's vendor was breached, exposing 3M+ hunting and fishing license customers' driver's licenses, passport info, and contact details. SSNs and financial data were not compromised.
CISA warns of FortiBleed: 86,644 Fortinet firewalls compromised via default credentials by Russian actors. The attack harvests additional logins from network traffic to self-perpetuate across targets.
FortiBleed exposed 86,000 Fortinet firewall credentials—half of all internet-accessible devices—granting attackers administrative control to modify rules, intercept VPN traffic, and deploy backdoors globally.
Modern cybersecurity teams face overwhelming pressure from AI-powered attacks, supply chain vulnerabilities, and nation-state threats, with organizations now defending against 1,000+ breach attempts annually. The result: widespread burnout and retention crises as CISOs navigate an impossible mandate
Shadow AI shifted from passive data leakage to active agents with system access. They can read, modify, delete data, and trigger automation—an access control crisis, not just data loss.
Salesforce disabled Klue's integration after OAuth tokens were stolen via a compromised credential, exposing customer CRM data. The attack highlights supply chain risks in enterprise SaaS integrations.
CISA warns of FortiBleed: 74,000 Fortinet FortiGate credentials exposed, risking unauthorized network access for enterprises. Immediate action needed to secure devices and prevent attackers from exploiting compromised admin and service accounts.
A leaked GitHub token from Novo Nordisk compromised source code and CI/CD pipelines, exposing how the company's high-privilege credentials were inadequately protected. The incident reveals that secrets management is fundamentally an identity and access control problem, not a tooling issue.
Attackers breached TinyPulse, Nintendo's employee survey platform, exposing survey data. Nintendo's systems remained secure. The incident exemplifies third-party vendor vulnerabilities affecting multiple organizations.
UNC6508 exploits outdated REDCap servers to breach healthcare organizations and steal medical research data. Attackers remain undetected for months, installing backdoors and harvesting credentials before exfiltrating sensitive information.
Klue Battlecards breach exposed Salesforce customer data via OAuth tokens. Third major third-party app compromise in two years reveals critical gaps in SaaS security monitoring and integration vetting.
Trusted platforms became prime attack vectors this week—23 fake Chrome extensions hit 758K users, Claude chat weaponized for malware, and macOS systems compromised via phishing lures. Attackers now exploit vendor credibility as their primary delivery mechanism instead of breaking systems directly.