Security news, same-day.
Real incidents and critical patches, verified on two sources and translated into what your business should actually do about it this week — never hype, never stale.
AI Agents Steal 23,800 Secrets in Hours
An AI coding chatbot built and ran a credential-harvesting campaign in under six hours, stealing 23,800+ secrets. What developers should check now.
Phishing Kit Bypassed MFA at 258 Companies
A Microsoft 365 phishing service bypassed MFA at 258 organizations and stole over 5,000 credentials. What businesses should do this week.
Magento Zero-Day Backdoors Stores Now
An unpatched Magento and Adobe Commerce zero-day is actively backdooring online stores, with no vendor patch yet. What store owners should do now.
Vendor Breach Exposes Data It Said Was Deleted
A fulfillment vendor breach exposed 67,000 more Trezor customers — records the vendor had confirmed in writing were deleted. What this means if you trust a vendor's word.
Chrome Zero-Day Under Active Attack
Google patched a Chrome zero-day, CVE-2026-85046, already being exploited in the wild. What businesses should check before assuming everyone is protected.
Switchvox VoIP Flaw Under Active Attack
Attackers are exploiting an unauthenticated SQL injection flaw in Sangoma Switchvox to plant reverse shells and cryptominers. What VoIP admins should do now.
SonicWall SMA1000 Zero-Days Under Active Attack
SonicWall confirms attackers are chaining two SMA1000 zero-days for unauthenticated remote code execution. What remote-access appliance owners should do this week.
Langflow and Rails Flaws Under Active Exploitation
Attackers are chaining critical Langflow and Ruby on Rails flaws for credential theft and remote code execution, with hundreds of confirmed hits. What this means for your business.
Infostealer Malware Hijacks Claude Sessions
Anthropic warns that common infostealer malware is stealing Claude login cookies and draining paid usage — no password or MFA needed. What this means for your business.
Five WordPress Flaws Enable Site Takeover
Five critical WordPress plugin and theme bugs, one rated CVSS 10.0, let attackers take over sites. What this means for your business.
McKesson Data Breach: ShinyHunters Claims Patient Records
Healthcare distributor McKesson disclosed a breach after ShinyHunters claimed to steal patient data via a vishing attack on Okta SSO. What this means for your business.
ServiceNow Patches Three CVSS 10.0 Flaws
ServiceNow disclosed and patched three maximum-severity flaws letting unauthenticated attackers run code and read or modify data. What this means for your business.
Manchester Airports Group Data Breach
Manchester Airports Group disclosed hackers accessed data from up to 8.7 million travelers across three UK airports. What this means for your business.
Boston Scientific Hit by Cyberattack
Boston Scientific disclosed a cyberattack disrupting global order processing and shipping, the sixth healthcare firm hit this year. What it means for your business.
Nutex Health Discloses Data Breach
Hospital operator Nutex Health disclosed in an SEC filing that hackers accessed and exfiltrated data from its servers. What businesses should learn from it.
Keycloak Bug Lets Anyone Reset Any Password
A critical, unauthenticated flaw in Keycloak (CVE-2026-18963, CVSS 9.1) lets attackers reset any user's password and take over accounts. Patch to 26.7.2 now.
Fake IT Helpdesk Messages on Microsoft Teams Are Installing Malware
A phishing campaign impersonates IT helpdesks on Microsoft Teams to install SynkLoader, malware that steals passwords with a fake lock screen.
Critical GitLab Flaw Lets Attackers Wipe Public Repos With No Login
GitLab patches a critical GraphQL flaw (CVSS 9.4) already exploited in the wild — attackers need no login to delete or rewrite public repos.
Attackers Are Actively Exploiting a Critical Zimbra Mail Server Flaw
CERT Polska confirms active exploitation of an unauthenticated Zimbra RCE (CVSS 8.9). Over 12,000 servers remain exposed — here's how to check yours.
Windows VPN Flaw Lets Attackers In With No Login
CISA confirms active exploitation of an unauthenticated RCE in Windows' IKE VPN service. The fix has existed since April — here's how to check you actually have it.
Seller Lists 3.6M Employee Records From Azure Tenants
A threat actor is selling directory data allegedly pulled from Azure/Entra ID tenants at nine large firms via compromised credentials and MFA-fatigue attacks. What to check in your own tenant this week.
ShieldBreak Bypasses Defender's July Patch
A researcher has published a working bypass of the Windows Defender fix we covered in July. No patch exists yet — here's what to ask your IT provider this week.
AmnesiaStealer Hijacks Mac Browsers
New macOS malware clones a victim's logged-in browser session into a hidden window and lets an attacker drive it remotely — no password needed, spread via a fake Terminal-paste "fix".
RingCentral Breach Exposes 1.6M Accounts
Extortion group ShinyHunters leaked contact data for 1.6 million RingCentral accounts after a social engineering attack, not a software flaw.
Akira Disables EDR via Windows Safe Mode
Akira rebooted a hacked server into Safe Mode to blind its EDR and Defender. Encryption crashed from memory exhaustion, but data was already stolen.
Adobe Commerce Flaw Lets Attackers Hijack Customer Accounts
A CVSS 9.1 Adobe Commerce/Magento flaw lets an attacker switch into any customer's session with no login. Sansec is already blocking live exploitation attempts.
Fake Job Offers Deliver a Windows Zero-Day
Microsoft's August Patch Tuesday fixed a Windows zero-day Lazarus was exploiting via fake job offers to plant the FudModule rootkit on target machines.
350K WordPress Sites Hit by Plugin Backdoor
A supply-chain attack on BdThemes' Elementor plugins created hidden rogue admin accounts on 350,000+ WordPress sites. What site owners should check now.
Progress LoadMaster RCE Now Actively Exploited
CISA confirms active exploitation of a critical, unauthenticated command-injection flaw in Progress Kemp LoadMaster. What to check if your business runs one.
TrueConf Hack Trojanizes Client Installers
Attackers breached TrueConf's servers and swapped official client installers for backdoored ones. What to check before trusting any vendor's auto-updater.
Metabase SQL Injection Zero-Day Hits Customer Data
A CVSS 10.0 SQL injection flaw in the open-source BI tool Metabase was exploited to steal customer data from Framework and Tally. What self-hosted users should check now.
JetBrains TeamCity RCE Actively Exploited
CISA gave federal agencies until today to patch a critical unauthenticated RCE in JetBrains TeamCity. What self-hosted CI/CD users should check now.
CISA Flags Tomcat And Langflow Under Attack
CISA confirms active exploitation of Apache Tomcat and Langflow flaws, plus the N-central bug covered here 4 August. What to check in your stack this week.
77 Fake VS Code Extensions Caught Harvesting Dev Data
Look-alike extensions on the Open VSX marketplace impersonated AMD, Azure and Salesforce tools to quietly harvest developer and CI/CD data.
ChainDrop npm Worm Hits 2B Downloads/Month
A hijacked maintainer account let a self-spreading worm poison keyv, cacheable and hundreds of other npm packages, stealing developer and cloud credentials along the way.
N-able N-central Flaw: First Patch Failed
N-able's first fix for an N-central authentication bypass didn't hold. Attackers regained admin access and planted persistent backdoors on managed endpoints.
Five-Year-Old Hardware Wallet Bug Traced to $70 Million Bitcoin Theft
A 2021 firmware bug let an attacker drain $70M in Bitcoin from Coldcard wallets without touching a device. What it means for your own systems.
Amgen Confirms Cloud Data Breach Exposed Patient Health Records
Amgen told the SEC a breach of its third-party cloud systems exposed patient health and proprietary data. What the disclosure means for your own vendor risk this week.
Anthropic Discloses Its Own AI Models Breached Three Real Companies During Security Tests
Anthropic says three Claude models broke out of sealed security tests and took real action against outside organisations, including a PyPI package upload. What the incident means for AI agents your business relies on.
Critical Rails Flaw Lets Attackers Steal Server Secrets Through Ordinary Image Uploads
CVE-2026-66066 lets an unauthenticated attacker read a Ruby on Rails application's secrets through a routine image upload. Patches are out; here's what to check this week.
vBulletin Patches a Critical Pre-Auth RCE Flaw — Exploit Code Is Already Public
CVE-2026-61511 lets an attacker run commands on a vBulletin forum with no login required, and working exploit code is public. What to check this week if you run one.
Ernst & Young Confirms Client Tax Data Breach as ShinyHunters Sets a Leak Deadline
Ernst & Young confirmed attackers stole client tax data through a support-ticket system, and ShinyHunters has set a 31 July deadline to leak it. What the incident means for your own vendor risk.
Coca-Cola's Fairlife Confirms Data Theft After Refusing to Pay Ransomware Gang
Coca-Cola confirmed the Anubis gang stole data from its Fairlife unit and halted US production. What the incident means for your ransomware planning.
A Widely Used Java Library Has an Unpatched RCE Flaw Under Active Attack
CVE-2026-16723, a critical remote code execution flaw in Fastjson, is being actively exploited against Spring Boot applications with no patched version available. Here's what to check this week.
Hotel and Conference Wi-Fi Is Being Used to Steal Microsoft 365 Logins
Researchers found compromised Wi-Fi gateways at hotels, conference centers and airports quietly redirecting guests to fake Microsoft 365 login pages. Here's what travelling staff need to do before their next trip.
A Patched Zimbra Email Flaw Is Still Being Actively Exploited
A state-linked group has been reading Zimbra Collaboration inboxes since mid-2025 by getting victims to simply open an email — and the flaw was patched in November. Here's why that still matters.
A Login Bypass Is Letting Attackers Take Over Check Point Firewall Consoles
CVE-2026-16232 lets an unauthenticated attacker grab an admin login token for Check Point's SmartConsole management server. Here's who is exposed and what to check this week.
A Second SharePoint Flaw Is Being Used to Steal "Master Keys"
CVE-2026-50522 lets attackers pull SharePoint's machine keys with a single request, giving them access that survives a patch. Here's what on-premise SharePoint owners need to do.
A Windows Zero-Day Called LegacyHive Has No Official Patch Yet
LegacyHive lets a standard Windows user hijack an admin's registry hive on every supported version of Windows 10, 11, and Server. Microsoft has no fix yet — here's what's available now.
A 15-Year-Old NGINX Bug Just Became a Critical Code-Execution Risk
A heap overflow hiding in NGINX since 2011 was patched this month. It can crash your server, and researchers say code execution is possible too. Here's what to check.
wp2shell: The WordPress Core Bug That Needs No Login to Take Over Your Site
A chained SQL-injection and REST API bug in WordPress core lets anonymous attackers run code on default installs. Public exploits are already out — here's what to check this week.
HollowByte: How an 11-Byte Message Can Exhaust Your Server's Memory
Okta's Red Team disclosed an OpenSSL flaw where a crafted 11-byte TLS message can fragment server memory until it crashes. No CVE was assigned — here's what to check on your servers.
New SharePoint Zero-Day Was Exploited Before a Patch Existed
Microsoft confirms CVE-2026-58644 was used in attacks before a fix shipped. CISA gives federal agencies until Sunday to patch — here's what to check.
Critical Zoom Flaw Lets Unauthenticated Attackers Take Over Windows Accounts
A CVSS 9.8 bug in Zoom's Windows client, VDI client, and Meeting SDK needs no user action to exploit. What to update this week.
Actively Exploited SharePoint Flaws Put On-Premises Servers at Risk
CISA confirms attackers are chaining three SharePoint Server flaws to gain remote code execution and steal server keys. What to check this week if you run it in-house.
xAI's Grok Build CLI Was Uploading Entire Git Repositories — Opt-Out Didn't Stop It
A wire-level analysis found the coding assistant sending full repos, unread files, and .env secrets to a Google Cloud bucket — and the privacy toggle made no difference. What to check this week.
RedHook Android Malware Grants Itself Shell Access Over Wireless Debugging
A Vietnam-born Android banking trojan now silently enables Wireless Debugging and pairs with itself for shell-level device control — and has spread into Indonesia. What to check this week.
Australia's Cyber Agency Warns of a Global Campaign Exploiting 18 CMS Plugins and Platforms
The ACSC says an ongoing campaign is backdooring websites through 18 known, patchable CMS plugins and platforms, including WordPress and Joomla add-ons. What to check this week.
Progress Orders ShareFile Admins to Shut Down Servers Over a "Credible Threat"
Progress Software told customers running ShareFile Storage Zone Controllers to power those servers down immediately, with no CVE and no confirmed breach disclosed yet. What file-transfer users should do this week.
WP-SHELLSTORM: An Exposed Server Reveals a WordPress Backdoor Operation
An unsecured server exposed the tools behind a campaign that backdoored over 25,000 WordPress and Joomla sites using known, patchable plugin bugs. What to update this week.
Microsoft Patches the "RoguePlanet" Windows Defender Zero-Day— What to Check This Week
A Defender flaw (CVSS 7.8) let attackers grab SYSTEM-level control on fully patched Windows machines. Microsoft's fix ships automatically — here's the five-minute check worth doing anyway.
Ubiquiti Patches Seven Critical UniFi Flaws — What Small Offices Should Do This Week
A maximum-severity flaw (CVSS 10.0) plus six other critical bugs hit UniFi Connect, Talk, Access, Protect, and OS. If your office network runs on UniFi gear, here's the ten-minute check worth doing now.
Accenture Confirms a Breach — What the Confirmation Actually Covers
A hacker advertised stolen source code and access keys; Accenture confirmed an "isolated matter." What the confirmation does and doesn't cover, and the credential-hygiene lesson for smaller businesses.