Security news, same-day.
Real incidents and critical patches, verified on two sources and translated into what your business should actually do about it this week — never hype, never stale.
Windows VPN Flaw Lets Attackers In With No Login
CISA confirms active exploitation of an unauthenticated RCE in Windows' IKE VPN service. The fix has existed since April — here's how to check you actually have it.
Seller Lists 3.6M Employee Records From Azure Tenants
A threat actor is selling directory data allegedly pulled from Azure/Entra ID tenants at nine large firms via compromised credentials and MFA-fatigue attacks. What to check in your own tenant this week.
ShieldBreak Bypasses Defender's July Patch
A researcher has published a working bypass of the Windows Defender fix we covered in July. No patch exists yet — here's what to ask your IT provider this week.
AmnesiaStealer Hijacks Mac Browsers
New macOS malware clones a victim's logged-in browser session into a hidden window and lets an attacker drive it remotely — no password needed, spread via a fake Terminal-paste "fix".
RingCentral Breach Exposes 1.6M Accounts
Extortion group ShinyHunters leaked contact data for 1.6 million RingCentral accounts after a social engineering attack, not a software flaw.
Akira Disables EDR via Windows Safe Mode
Akira rebooted a hacked server into Safe Mode to blind its EDR and Defender. Encryption crashed from memory exhaustion, but data was already stolen.
Adobe Commerce Flaw Lets Attackers Hijack Customer Accounts
A CVSS 9.1 Adobe Commerce/Magento flaw lets an attacker switch into any customer's session with no login. Sansec is already blocking live exploitation attempts.
Fake Job Offers Deliver a Windows Zero-Day
Microsoft's August Patch Tuesday fixed a Windows zero-day Lazarus was exploiting via fake job offers to plant the FudModule rootkit on target machines.
350K WordPress Sites Hit by Plugin Backdoor
A supply-chain attack on BdThemes' Elementor plugins created hidden rogue admin accounts on 350,000+ WordPress sites. What site owners should check now.
Progress LoadMaster RCE Now Actively Exploited
CISA confirms active exploitation of a critical, unauthenticated command-injection flaw in Progress Kemp LoadMaster. What to check if your business runs one.
TrueConf Hack Trojanizes Client Installers
Attackers breached TrueConf's servers and swapped official client installers for backdoored ones. What to check before trusting any vendor's auto-updater.
Metabase SQL Injection Zero-Day Hits Customer Data
A CVSS 10.0 SQL injection flaw in the open-source BI tool Metabase was exploited to steal customer data from Framework and Tally. What self-hosted users should check now.
JetBrains TeamCity RCE Actively Exploited
CISA gave federal agencies until today to patch a critical unauthenticated RCE in JetBrains TeamCity. What self-hosted CI/CD users should check now.
CISA Flags Tomcat And Langflow Under Attack
CISA confirms active exploitation of Apache Tomcat and Langflow flaws, plus the N-central bug covered here 4 August. What to check in your stack this week.
77 Fake VS Code Extensions Caught Harvesting Dev Data
Look-alike extensions on the Open VSX marketplace impersonated AMD, Azure and Salesforce tools to quietly harvest developer and CI/CD data.
ChainDrop npm Worm Hits 2B Downloads/Month
A hijacked maintainer account let a self-spreading worm poison keyv, cacheable and hundreds of other npm packages, stealing developer and cloud credentials along the way.
N-able N-central Flaw: First Patch Failed
N-able's first fix for an N-central authentication bypass didn't hold. Attackers regained admin access and planted persistent backdoors on managed endpoints.
Five-Year-Old Hardware Wallet Bug Traced to $70 Million Bitcoin Theft
A 2021 firmware bug let an attacker drain $70M in Bitcoin from Coldcard wallets without touching a device. What it means for your own systems.
Amgen Confirms Cloud Data Breach Exposed Patient Health Records
Amgen told the SEC a breach of its third-party cloud systems exposed patient health and proprietary data. What the disclosure means for your own vendor risk this week.
Anthropic Discloses Its Own AI Models Breached Three Real Companies During Security Tests
Anthropic says three Claude models broke out of sealed security tests and took real action against outside organisations, including a PyPI package upload. What the incident means for AI agents your business relies on.
Critical Rails Flaw Lets Attackers Steal Server Secrets Through Ordinary Image Uploads
CVE-2026-66066 lets an unauthenticated attacker read a Ruby on Rails application's secrets through a routine image upload. Patches are out; here's what to check this week.
vBulletin Patches a Critical Pre-Auth RCE Flaw — Exploit Code Is Already Public
CVE-2026-61511 lets an attacker run commands on a vBulletin forum with no login required, and working exploit code is public. What to check this week if you run one.
Ernst & Young Confirms Client Tax Data Breach as ShinyHunters Sets a Leak Deadline
Ernst & Young confirmed attackers stole client tax data through a support-ticket system, and ShinyHunters has set a 31 July deadline to leak it. What the incident means for your own vendor risk.
Coca-Cola's Fairlife Confirms Data Theft After Refusing to Pay Ransomware Gang
Coca-Cola confirmed the Anubis gang stole data from its Fairlife unit and halted US production. What the incident means for your ransomware planning.
A Widely Used Java Library Has an Unpatched RCE Flaw Under Active Attack
CVE-2026-16723, a critical remote code execution flaw in Fastjson, is being actively exploited against Spring Boot applications with no patched version available. Here's what to check this week.
Hotel and Conference Wi-Fi Is Being Used to Steal Microsoft 365 Logins
Researchers found compromised Wi-Fi gateways at hotels, conference centers and airports quietly redirecting guests to fake Microsoft 365 login pages. Here's what travelling staff need to do before their next trip.
A Patched Zimbra Email Flaw Is Still Being Actively Exploited
A state-linked group has been reading Zimbra Collaboration inboxes since mid-2025 by getting victims to simply open an email — and the flaw was patched in November. Here's why that still matters.
A Login Bypass Is Letting Attackers Take Over Check Point Firewall Consoles
CVE-2026-16232 lets an unauthenticated attacker grab an admin login token for Check Point's SmartConsole management server. Here's who is exposed and what to check this week.
A Second SharePoint Flaw Is Being Used to Steal "Master Keys"
CVE-2026-50522 lets attackers pull SharePoint's machine keys with a single request, giving them access that survives a patch. Here's what on-premise SharePoint owners need to do.
A Windows Zero-Day Called LegacyHive Has No Official Patch Yet
LegacyHive lets a standard Windows user hijack an admin's registry hive on every supported version of Windows 10, 11, and Server. Microsoft has no fix yet — here's what's available now.
A 15-Year-Old NGINX Bug Just Became a Critical Code-Execution Risk
A heap overflow hiding in NGINX since 2011 was patched this month. It can crash your server, and researchers say code execution is possible too. Here's what to check.
wp2shell: The WordPress Core Bug That Needs No Login to Take Over Your Site
A chained SQL-injection and REST API bug in WordPress core lets anonymous attackers run code on default installs. Public exploits are already out — here's what to check this week.
HollowByte: How an 11-Byte Message Can Exhaust Your Server's Memory
Okta's Red Team disclosed an OpenSSL flaw where a crafted 11-byte TLS message can fragment server memory until it crashes. No CVE was assigned — here's what to check on your servers.
New SharePoint Zero-Day Was Exploited Before a Patch Existed
Microsoft confirms CVE-2026-58644 was used in attacks before a fix shipped. CISA gives federal agencies until Sunday to patch — here's what to check.
Critical Zoom Flaw Lets Unauthenticated Attackers Take Over Windows Accounts
A CVSS 9.8 bug in Zoom's Windows client, VDI client, and Meeting SDK needs no user action to exploit. What to update this week.
Actively Exploited SharePoint Flaws Put On-Premises Servers at Risk
CISA confirms attackers are chaining three SharePoint Server flaws to gain remote code execution and steal server keys. What to check this week if you run it in-house.
xAI's Grok Build CLI Was Uploading Entire Git Repositories — Opt-Out Didn't Stop It
A wire-level analysis found the coding assistant sending full repos, unread files, and .env secrets to a Google Cloud bucket — and the privacy toggle made no difference. What to check this week.
RedHook Android Malware Grants Itself Shell Access Over Wireless Debugging
A Vietnam-born Android banking trojan now silently enables Wireless Debugging and pairs with itself for shell-level device control — and has spread into Indonesia. What to check this week.
Australia's Cyber Agency Warns of a Global Campaign Exploiting 18 CMS Plugins and Platforms
The ACSC says an ongoing campaign is backdooring websites through 18 known, patchable CMS plugins and platforms, including WordPress and Joomla add-ons. What to check this week.
Progress Orders ShareFile Admins to Shut Down Servers Over a "Credible Threat"
Progress Software told customers running ShareFile Storage Zone Controllers to power those servers down immediately, with no CVE and no confirmed breach disclosed yet. What file-transfer users should do this week.
WP-SHELLSTORM: An Exposed Server Reveals a WordPress Backdoor Operation
An unsecured server exposed the tools behind a campaign that backdoored over 25,000 WordPress and Joomla sites using known, patchable plugin bugs. What to update this week.
Microsoft Patches the "RoguePlanet" Windows Defender Zero-Day— What to Check This Week
A Defender flaw (CVSS 7.8) let attackers grab SYSTEM-level control on fully patched Windows machines. Microsoft's fix ships automatically — here's the five-minute check worth doing anyway.
Ubiquiti Patches Seven Critical UniFi Flaws — What Small Offices Should Do This Week
A maximum-severity flaw (CVSS 10.0) plus six other critical bugs hit UniFi Connect, Talk, Access, Protect, and OS. If your office network runs on UniFi gear, here's the ten-minute check worth doing now.
Accenture Confirms a Breach — What the Confirmation Actually Covers
A hacker advertised stolen source code and access keys; Accenture confirmed an "isolated matter." What the confirmation does and doesn't cover, and the credential-hygiene lesson for smaller businesses.