ACTIVE THREATS: Cisco FMC flaws exploited by ransomware gang, state-sponsored hackers • AI-powered attack exploited PaperCut flaws to hack 395 organizations • Microsoft Excel KB5002914 update breaks copy and paste for some users • Surfshark VPN says hackers breached internal testing, proxy servers • PaperCut Attacker Uses Hundreds of AI Agents to Compromise 440+ Instances ACTIVE THREATS: Cisco FMC flaws exploited by ransomware gang, state-sponsored hackers • AI-powered attack exploited PaperCut flaws to hack 395 organizations • Microsoft Excel KB5002914 update breaks copy and paste for some users • Surfshark VPN says hackers breached internal testing, proxy servers • PaperCut Attacker Uses Hundreds of AI Agents to Compromise 440+ Instances
Latest cybersecurity breaches news, analysis, and intelligence.
TeamPCP orchestrated Shai-Hulud worm attacks on open source via supply chain compromises. The group's success reveals not advanced tradecraft but systemic fragility in development infrastructure.
Modern SOCs must shift from fortress defense to real-time threat visibility and rapid investigation. Attackers exploit intelligence gaps to move silently through legitimate processes; success requires continuous threat intelligence and contextual enrichment.
Dutch police arrested a hacker on May 26 for breaching AFC Ajax, exposing 300,000+ supporter accounts. The attack exploited insecure APIs and weak authentication, compromising personal data and ticket systems.
Charter Communications confirmed a data breach after threat group ShinyHunters stole customer information and demanded ransom. When the company refused to pay, ShinyHunters began releasing the stolen data publicly, affecting millions of Americans.
Iranian threat group MuddyWater escalated espionage across nine countries in Q1 2026, compromising organizations with sophisticated DLL side-loading attacks using legitimate software binaries to evade detection.
A ShinyHunters attack exposed 185,000 7-Eleven customers through vulnerable Salesforce systems, stealing names, addresses, emails, and dates of birth. The data was publicly released after the group's ransom demand went unpaid, highlighting SaaS platforms as prime targets for sophisticated extortion
AI-powered DDoS attacks now evolve in real time, mimicking legitimate traffic and evading defenses. Unlike scripted attacks, these autonomous threats self-optimize based on defensive responses.
Prompt bombing floods users with repeated MFA push notifications to wear them down into approving unauthorized logins. The attack succeeds because notifications lack contextual details (location, app identity, device info) and exploit human fatigue, especially when combined with social engineering.
AI-powered DDoS attacks now automate reconnaissance, optimize attack timing, and evade detection in real-time. This fundamental shift renders traditional defenses ineffective, requiring organizations to rethink their security strategies.
Microsoft Defender auto-isolates compromised endpoints while preserving Defender connection, blocking lateral movement. This automated response counters attackers' ransomware spread tactics that rely on network traversal.
Iranian threat actors deployed MiniFast/MiniJunk V2 malware combining phishing and SEO poisoning to target critical infrastructure sectors. The sophisticated campaign uses encrypted command-and-control channels and supply-chain tactics, suggesting state-sponsored intentions aligned with February 202
7-Eleven confirmed a breach affecting 185,000+ customers in April 2026 after the ShinyHunters extortion gang infiltrated its systems, exposing names, addresses, and contact details from loyalty programs and transactions. The threat actors demanded ransom and threatened to publicly release the stolen
Critical Ghost CMS vulnerability compromised 700+ sites including Harvard and Oxford. Attackers gained unauthorized admin access, enabling malware injection and data theft.
Radiology Associates of Richmond's July 2025 breach exposed 266,183 patients' SSNs, medical records, and financial data, undetected 9 months. This is the provider's second major breach in 2 years.
Oncology Institute (100+ clinics) confirms patient data breach via third-party vendor compromise. Breach reported November 2025 but only confirmed May 2026, highlighting healthcare's supply-chain vulnerability.
NDR platforms historically flooded SOCs with thousands of noisy alerts that analysts struggled to triage. Agentic AI is changing this by automating alert prioritization, enabling teams to act on genuine threats faster while reducing analyst burnout.
Laravel Lang packages were hijacked via rewritten GitHub tags distributing credential-stealing malware across 4 repositories, affecting 233–700 versions. Attackers exploited tag rewrites instead of publishing new versions to evade detection systems.
Laravel-Lang package supply chain attack delivered credential-stealing malware via 700+ malicious versions. Backdoor executes on every PHP request, affecting thousands of production applications globally.
Chinese APT Webworm targets EU governments using Discord for command-and-control and Microsoft Graph for reconnaissance, employing encrypted tunnels to evade detection. The campaign uses spear-phishing to establish persistent access in diplomatic and defense networks.
A 23-year-old Canadian faces extradition for operating Kimwolf, a DDoS botnet with 2 million infected devices and record 31.4 Tbps attacks. It exploited residential proxies to evade detection.
Grafana disclosed that attackers accessed its GitHub repos using a security token exposed in the earlier TanStack supply chain attack. Failure to rotate the compromised credentials led to theft of proprietary code and internal data, illustrating how supply chain compromises cascade across dependent
Chinese APT Webworm compromised European government networks by weaponizing Discord for command-and-control, abusing Microsoft Graph APIs to exfiltrate data, and using SOCKS proxies to evade detection.
Stolen credentials, which dominated cyberattacks for 20 years, are losing ground to AI-enabled threats that bypass traditional security controls. Defenders invested heavily in credential protection may now face blindsided organizations as attackers shift toward more sophisticated, harder-to-defend i
Google exposed a critical Chromium flaw allowing silent botnet attacks. Service Workers execute persistent JavaScript even after browsers close, affecting billions of Chrome, Edge, and other Chromium users without any user interaction or notification.
Modern attacks exploit trust rather than vulnerabilities—using compromised credentials, legitimate access, and trusted channels. The real threat has shifted from stopping intruders to defending against abuse of systems we've already authorized.
Lucifer is a Drainer-as-a-Service automating cryptocurrency theft through phishing and fake token approvals instead of technical hacking. It tricks users into voluntarily authorizing their own wallet theft, democratizing attacks for non-technical criminals and representing a major shift in crypto se
Identity has replaced perimeter security as the primary attack vector. A single compromised credential can access critical systems; identity weaknesses factor into 90% of incident investigations.
3,800 GitHub repositories were breached through a compromised Nx Console extension in a TanStack npm supply-chain attack. Attackers gained developer credentials; no customer data was exposed.
GitHub's internal repos were breached via a trojanized Nx Console extension live for just 18 minutes. The malware stole developer credentials by disguising itself as routine MCP setup code, targeting 1Password, Claude API keys, and npm tokens.
Hacking tools are democratizing, enabling amateurs to compromise critical infrastructure. A teen halted trains with £300 of radio equipment, exposing how obscurity-based security fails.