All Issues
97 Cyber issues published
Japan's Food Chain Hit, Zoom Needs Patching Now
A cyberattack on Japan's biggest refrigerated logistics company has left KFC restaurants short on chicken and supermarkets running out of frozen food. Zoom has patched a critical flaw on Windows that could let an attacker take over your account without needing a password. Update Zoom today, and check the SharePoint advisory if your organisation runs Microsoft's collaboration server.
npm Packages Poisoned, AI Now Runs the Attack
Four widely-used developer packages were quietly poisoned to deliver a botnet loader capable of stealing credentials, spreading across networks, and wiping evidence on command. SonicWall's remote-access appliances have two zero-days under active exploitation — one rated a perfect 10 — with a federal patch deadline of July 17. If your work accounts still use SMS-based login codes, Microsoft is about to make that decision for you.
Japan's Biggest Taxi Company Just Got Hacked
Japan's largest taxi operator went dark after a cyberattack knocked out its dispatch and booking systems, leaving thousands of customers stranded from digital services. A newly discovered AI attack technique called MemGhost can silently rewrite what your AI assistant thinks it knows about you — using a single email. Joomla website owners need to patch two actively exploited extensions today, or hand attackers the keys to their server.
A Poisoned npm Package Hit Developer Machines Worldwide
A compromised release of a popular JavaScript tool silently ran a password-stealing program the moment developers installed it, targeting cloud keys, crypto wallets, and AI coding tool credentials. Australia's cybersecurity agency is warning of an active global campaign hitting websites running outdated content management systems. If you run a website or work in software development, today's issue has something urgent for you.
Progress Pulls ShareFile Controllers Offline
Progress Software has ordered customers running ShareFile's self-hosted server component offline over an unspecified but credible security threat, with no patch and no timeline for return. A critical authentication bypass in Gitea's Docker image is being actively exploited in the wild, and anyone running that setup needs to upgrade today. Meanwhile, the European Parliament quietly revived a law letting big tech scan private messages for illegal content — passing it through a procedural vote most members opposed.
Windows Defender Zero-Day Patched Out of Band
A researcher's public feud with Microsoft has forced an emergency Windows Defender patch before this month's scheduled update. A supply chain attack poisoned a cryptocurrency development toolkit and may have drained wallets silently. A new AI-powered phishing platform is selling ready-made Microsoft 365 account takeovers to anyone with a browser.
KDDI Breach Hits 12 Million Email Accounts
Japanese telecoms giant KDDI confirmed attackers exposed 12.2 million email addresses and 7.6 million passwords after exploiting a zero-day in a third-party platform. Ubiquiti has patched a perfect-10 vulnerability in its UniFi Connect software — if you run Ubiquiti hardware at home or at work, update it today. AI coding agents from Anthropic and OpenAI can be tricked into running attacker code while doing their job of checking for attacker code, which is exactly as unsettling as it sounds.
Accenture's Source Code Is Up for Sale
Accenture has confirmed a breach after a hacker began selling what they claim is 35 GB of the company's source code and internal keys on a cybercrime forum. A 15-year-old Linux kernel flaw now has working exploit code in the wild — if you manage Linux servers, patching is the priority today. The Texas App Store Accountability Act is now enforceable, meaning under-18s must verify their age before downloading apps.
China-Linked Hackers Targeted University Email Servers
A suspected China-aligned hacking group exploited patched flaws in a widely used university webmail platform to steal credentials and plant persistent backdoors on U.S. and Canadian campuses. Adobe ColdFusion, a web development platform used across thousands of organisations, has a maximum-severity flaw being actively exploited in the wild — patch it now. The UK government has launched a voluntary Cyber Resilience Pledge, with over 60 major businesses signing up to raise the security baseline across their supply chains.
AI Wrote the Ransomware. Seriously.
Researchers have confirmed what many feared: a fully autonomous AI agent ran an entire ransomware campaign from break-in to data destruction, no human operator required. Cisco's ClamAV antivirus engine also received urgent patches for seven bugs, some hiding in the code since 2004. If you use ClamAV, update to version 1.5.3 or 1.4.5 today.