All Issues
130 issues published
Accenture's Source Code Is Up for Sale
Accenture has confirmed a breach after a hacker began selling what they claim is 35 GB of the company's source code and internal keys on a cybercrime forum. A 15-year-old Linux kernel flaw now has working exploit code in the wild — if you manage Linux servers, patching is the priority today. The Texas App Store Accountability Act is now enforceable, meaning under-18s must verify their age before downloading apps.
China-Linked Hackers Targeted University Email Servers
A suspected China-aligned hacking group exploited patched flaws in a widely used university webmail platform to steal credentials and plant persistent backdoors on U.S. and Canadian campuses. Adobe ColdFusion, a web development platform used across thousands of organisations, has a maximum-severity flaw being actively exploited in the wild — patch it now. The UK government has launched a voluntary Cyber Resilience Pledge, with over 60 major businesses signing up to raise the security baseline across their supply chains.
AI Wrote the Ransomware. Seriously.
Researchers have confirmed what many feared: a fully autonomous AI agent ran an entire ransomware campaign from break-in to data destruction, no human operator required. Cisco's ClamAV antivirus engine also received urgent patches for seven bugs, some hiding in the code since 2004. If you use ClamAV, update to version 1.5.3 or 1.4.5 today.
North Korea's Supply Chain Is Your Problem Now
North Korean hackers have planted malicious code inside nearly 2,000 public GitHub repositories, targeting software developers through fake job offers and infected packages. A patched authentication bypass in SimpleHelp RMM is being actively exploited to steal credentials from cloud, AI, and developer tools. If your team uses SimpleHelp for remote support, patch it today.
A Spy Tool Was Used to Watch the Spy Investigators
A European Parliament member who sat on the committee investigating Pegasus spyware was himself repeatedly infected with Pegasus while serving on that committee. Meanwhile, a critical Linux kernel flaw gives ordinary users full root control on desktops, servers, and Android devices — and a patch is available now. If you run Linux or Android, this is your cue to update.
Google Takes Down 2 Million Device Proxy Network
Google and the FBI have dismantled a massive residential proxy network that was quietly running through smart TVs and streaming boxes in homes worldwide. A critical flaw in the Cursor AI code editor has been patched — but if you haven't updated yet, you should do that now. And the EU-US data transfer agreement that underpins nearly $2 trillion in annual trade is facing a serious legal challenge.
The First AI That Ransoms and Forgets the Key
An AI agent ran an entire ransomware attack by itself — break-in, credential theft, encryption, ransom note — then lost the decryption key, meaning victims cannot recover their data even if they pay. Adobe has patched six maximum-severity flaws in ColdFusion, all rated CVSS 10.0, and you should update today. If you use Opera browser, a new built-in feature called Paste Protect is already blocking one of the most common malware tricks in use right now.
81 Million Login Attempts and 78 Accounts Gone
Attackers hit Microsoft's Azure login system with over 81 million password attempts, compromising 78 accounts across 64 organisations by exploiting a legacy authentication method that bypasses MFA. Citrix has patched six vulnerabilities in its NetScaler network software, with the most urgent allowing unauthenticated file reads on exposed management interfaces. If you use Microsoft Teams, a new admin policy is worth enabling today to stop unauthorised bots from silently joining your meetings.
Oracle's Payment System Is Under Active Attack
Oracle's enterprise payment software is being actively exploited in the wild, and attackers appear to have figured it out on their own without any public blueprint. Progress Kemp LoadMaster has a critical pre-authentication flaw with a working proof of concept now public, so if you run it, patch immediately. WhatsApp is rolling out usernames today, and reserving yours is a simple step that keeps your phone number private.
14 Million Email Logins Exposed at Japanese ISPs
Japan's largest telecoms operator just confirmed a breach affecting up to 14.2 million email accounts across six ISPs, with passwords potentially in attackers' hands. A critical flaw in the SSH library embedded in curl, Git, and PHP now has a public proof-of-concept — if your software reaches out to external SSH servers, read the Vulnerability Watch section today. And the US insurance regulator confirms a zero-day in Oracle PeopleSoft was behind a breach of credit rating data first detected June 11.