All Issues
130 issues published
Microsoft Sounds the Alarm on a Password-Stealing Surge
Microsoft is warning enterprise customers about a sharp rise in attacks using ACR Stealer, a malware-as-a-service tool designed to drain saved passwords, session tokens, and files straight off your computer. 7-Zip has a newly patched flaw that lets attackers run malicious code just by getting you to open a booby-trapped archive file — update it manually now, because it won't update itself. On the privacy front, regulators worldwide are tightening age verification laws, and the debate over whose server your face ends up on is heating up.
Abbott Hit Twice While ShinyHunters Demands Ransom
A medtech giant is juggling two separate breach investigations at once, with an extortion gang claiming over 30 million rows of stolen patient data. A new botnet is quietly raiding exposed AI tools for cloud credentials. WordPress site owners need to patch a critical core flaw right now. And scammers are using FaceTime to impersonate Apple and drain bank accounts.
Fairlife's Milk Machines Are Offline
Ransomware hit Coca-Cola's Fairlife dairy brand, shutting down US production of protein shakes and ultra-filtered milk with no timeline for recovery. CISA is pushing federal agencies to patch two critical Fortinet FortiSandbox flaws by this Sunday — both are already being exploited in the wild. If you use an AI agent for browser tasks, a new class of attack called agent data injection can make it click buttons and run commands you never approved.
Japan's Food Chain Hit, Zoom Needs Patching Now
A cyberattack on Japan's biggest refrigerated logistics company has left KFC restaurants short on chicken and supermarkets running out of frozen food. Zoom has patched a critical flaw on Windows that could let an attacker take over your account without needing a password. Update Zoom today, and check the SharePoint advisory if your organisation runs Microsoft's collaboration server.
npm Packages Poisoned, AI Now Runs the Attack
Four widely-used developer packages were quietly poisoned to deliver a botnet loader capable of stealing credentials, spreading across networks, and wiping evidence on command. SonicWall's remote-access appliances have two zero-days under active exploitation — one rated a perfect 10 — with a federal patch deadline of July 17. If your work accounts still use SMS-based login codes, Microsoft is about to make that decision for you.
Japan's Biggest Taxi Company Just Got Hacked
Japan's largest taxi operator went dark after a cyberattack knocked out its dispatch and booking systems, leaving thousands of customers stranded from digital services. A newly discovered AI attack technique called MemGhost can silently rewrite what your AI assistant thinks it knows about you — using a single email. Joomla website owners need to patch two actively exploited extensions today, or hand attackers the keys to their server.
A Poisoned npm Package Hit Developer Machines Worldwide
A compromised release of a popular JavaScript tool silently ran a password-stealing program the moment developers installed it, targeting cloud keys, crypto wallets, and AI coding tool credentials. Australia's cybersecurity agency is warning of an active global campaign hitting websites running outdated content management systems. If you run a website or work in software development, today's issue has something urgent for you.
Progress Pulls ShareFile Controllers Offline
Progress Software has ordered customers running ShareFile's self-hosted server component offline over an unspecified but credible security threat, with no patch and no timeline for return. A critical authentication bypass in Gitea's Docker image is being actively exploited in the wild, and anyone running that setup needs to upgrade today. Meanwhile, the European Parliament quietly revived a law letting big tech scan private messages for illegal content — passing it through a procedural vote most members opposed.
Windows Defender Zero-Day Patched Out of Band
A researcher's public feud with Microsoft has forced an emergency Windows Defender patch before this month's scheduled update. A supply chain attack poisoned a cryptocurrency development toolkit and may have drained wallets silently. A new AI-powered phishing platform is selling ready-made Microsoft 365 account takeovers to anyone with a browser.
KDDI Breach Hits 12 Million Email Accounts
Japanese telecoms giant KDDI confirmed attackers exposed 12.2 million email addresses and 7.6 million passwords after exploiting a zero-day in a third-party platform. Ubiquiti has patched a perfect-10 vulnerability in its UniFi Connect software — if you run Ubiquiti hardware at home or at work, update it today. AI coding agents from Anthropic and OpenAI can be tricked into running attacker code while doing their job of checking for attacker code, which is exactly as unsettling as it sounds.