ACTIVE THREATS: Orthanc DICOM Server • GitLab Vulnerability Exploited One Day After Disclosure • CISA Adds 5 Actively Exploited Artifactory, ScreenConnect, and RouterOS Flaws to KEV • Dutch NCSC: Critical Check Point VPN flaws exploitation is imminent • Phishing Research Challenges Conventional Security Awareness Testing ACTIVE THREATS: Orthanc DICOM Server • GitLab Vulnerability Exploited One Day After Disclosure • CISA Adds 5 Actively Exploited Artifactory, ScreenConnect, and RouterOS Flaws to KEV • Dutch NCSC: Critical Check Point VPN flaws exploitation is imminent • Phishing Research Challenges Conventional Security Awareness Testing
Latest cybersecurity breaches news, analysis, and intelligence.
ShinyHunters has compromised Canvas LMS credentials across multiple educational institutions worldwide and is demanding ransom while threatening to leak sensitive student and faculty data. The extortion campaign affects K-12 schools and universities, with the threat group providing data samples to p
A critical vulnerability in Claude Code's MCP protocol allows attackers to silently intercept OAuth tokens, enabling unauthorized access to developers' connected SaaS platforms and creating a significant supply chain risk.
Hyper-personalized AI phishing makes employee compromise nearly inevitable. Organizations should focus on rapid damage detection and containment after the first click succeeds, not just prevention.
An AI-driven cyberattack failed to breach SCADA systems despite employing advanced machine learning techniques and multiple attack vectors. The incident reveals the resilience of properly secured OT infrastructure against sophisticated threats.
Cybersecurity faced a perfect storm this week with zero-days, plaintext password exposures, credential dumps, and supply chain attacks—but most exploited foundational security failures rather than sophisticated tactics.
Modern cybersecurity requires both attack prevention and rapid recovery. Since breaches are inevitable, organizations must focus on detection and response rather than trying to prevent all attacks.
Dragos reported threat actors weaponized Claude AI to reconnaissance a Mexican water utility's infrastructure. They submitted network details to the AI to identify critical operational technology assets and guide attacks on the facility.
Attackers exploit Google Ads to phish ManageWP login credentials. Compromised accounts provide access to multiple WordPress sites, enabling mass malware deployment and data theft across victim networks.
ShinyHunters breached Instructure's Canvas LMS, exfiltrating student personal data, academic records, and credentials for millions of users globally. The exposure reveals systemic security risks across educational institutions' dependence on vendor security.
CISA's CI Fortify initiative helps critical infrastructure survive geopolitical cyber attacks by prioritizing operational resilience over prevention alone. It emphasizes maintaining functionality during compromise and sustained attacks from nation-state actors.
Romanian hacker Gavril Sandu was extradited to the US in 2026, nine years after his 2017 indictment for a hacking conspiracy dating back decades. His case illustrates persistent challenges in international cybercrime prosecution, where diplomatic barriers and fugitive status allow defendants to evad
Attackers exploit Windows Phone Link to deploy CloudZ RAT and Pheno malware, intercepting SMS messages and bypassing 2FA on synced Android devices. The attack leverages the inherent trust in PC-phone sync functionality while evading security detection.
The Hacker News launches Cybersecurity Stars Awards 2026 to honor security defenders. The program recognizes leadership and innovation—shifting industry focus from threats to the solutions-builders.
UAE reports a threefold surge in cyberattacks from Iranian-aligned actors targeting critical infrastructure. The coordinated, state-sponsored attacks reflect escalating Iran-UAE tensions moving into cyberspace.
Hackers claim to have breached Instructure's Canvas LMS, compromising data from approximately 8,800 schools and universities serving millions of students, educators, and administrators. The attacker threatens to release or sell stolen institutional records, credentials, and personal information in a
Trellix source code breach exposes core components to threat actors, compromising enterprise defenses. The supply chain attack demonstrates how security vendors themselves are vulnerable targets.
A 23-year-old was arrested for hacking Taiwan's High-Speed Rail TETRA communication system, triggering emergency brakes on moving trains. The breach exposed critical infrastructure vulnerabilities in transportation networks across East Asia.
Red team specialist Joey Melo discusses how AI guardrails are vulnerable to text-based attacks. Exploited systems could generate misinformation, assist fraud, and create liability for organizations.
Vimeo suffered a data breach in April 2026 exposing personal information of 119,000 users, with the ShinyHunters extortion gang suspected. The incident was discovered via Have I Been Pwned, highlighting the threat actor's typical extortion tactics targeting high-profile platforms.
Researchers scanned 1M AI services, finding 45% without authentication, 60% with exposed credentials, 80% missing security headers—revealing how deployment speed outpaced security best practices.
Trellix confirmed a source code repository breach but found no compromise of its software supply chain or released products. The investigation revealed no customer impact or malicious code injection; the company secured the repository and strengthened access controls.
Trellix disclosed a source code repository breach exposing intellectual property and technical details that could enable new attack vectors. The incident underscores supply chain security risks at major cybersecurity firms.
Finnish teen arrested for ties to Scattered Spider, a prolific cybercriminal group behind major social engineering attacks. Faces US extradition in case highlighting international law enforcement's growing ability to pursue sophisticated threat actors globally.
DigiCert revoked thousands of certificates after attackers compromised its support portal through malware. The incident reveals critical supply chain risk when trusted certificate authorities are targeted, enabling threat actors to compromise downstream customers at scale.
Fraudsters exploit credit unions' lending processes using stolen identities rather than hacking, navigating standard approval workflows to secure unauthorized loans. This approach exploits the gap between rapid approvals and fraud detection—a simple but devastatingly effective strategy.
MSPs must treat backup and disaster recovery as security controls, not afterthoughts. Strong perimeter defenses alone fail; resilience matters because MSP breaches compromise thousands of downstream customers.
Instructure's Canvas LMS suffered a major breach exposing millions of students' names, emails, and IDs. Hackers threatened public release and demanded ransom while also disrupting global platform services.
Instructure confirmed a Canvas LMS breach claimed by ShinyHunters extortion group. The attack impacts millions across K-12, higher education, and corporate training worldwide.
ConsentFix v3 is an automated attack exploiting Azure OAuth by deploying fake apps disguised as legitimate services. Using compromised credentials, attackers trick users into granting consent for persistent cloud access.
Cybersecurity firm Trellix disclosed a source code repository breach but provided limited technical details on scope and attack vector. The company engaged forensic experts and law enforcement, highlighting risks within the security industry itself.