All Issues
130 issues published
FortiBleed Exposes 73,000 VPN Logins
A new leak called FortiBleed has exposed VPN login credentials for over 73,000 Fortinet devices worldwide, with major companies among the victims. Cisco also patched a critical flaw that lets a logged-in attacker take over the underlying server. If you run a Fortinet VPN, today's move is simple: rotate your credentials and turn on multi-factor authentication (MFA) now.
Three Fortinet Flaws Exploited, One Patched Last Week
Hackers are actively exploiting three critical vulnerabilities in Fortinet's threat detection software — one of which was only patched last week. A cardiac monitoring company called iRhythm has disclosed a data breach after attackers stole patient health data and demanded a ransom. The FBI is warning that crypto scammers are now sending physical couriers to collect cash from victims in person — if anyone asks you to hand money to a stranger for an investment, walk away.
Trusted WordPress Plugins Were Planting Back Doors
Three popular WordPress plugins were secretly modified to hand attackers full admin access to any site where an administrator was logged in — if you run WordPress, check your admin accounts now. Palo Alto's GlobalProtect VPN has an authentication bypass under active exploitation that enterprise teams need to patch today. The FBI and Google dismantled a $1.9 billion AI-powered phishing operation this week, and a proposed FCC rule could make anonymous phone plans history in the US.
The IT Guy Who Became the Threat
The person who once protected a school district's systems spent 21 months destroying them after he was let go — and the district had no idea he still had the keys. Splunk Enterprise has a critical unpatched-until-now flaw that lets anyone on the network run code without logging in first — patch today if this affects you. We're also looking at a major change coming to NPM that will make software supply chains harder to poison.
400 Arch Linux Packages Were a Trap
Over 400 packages in the Arch Linux community software repository were quietly hijacked this week to steal credentials from developers who installed them — if you pulled any after June 11, check the affected list now. A decade-old flaw in phpBB forum software lets anyone log in as an administrator with a single web request; update to version 3.3.17 immediately. Google is also suing a Chinese cybercrime network that weaponised its own Gemini AI to generate fraudulent pages and flood Americans with fake bank texts.
France's Secure Messenger Left 73,000 Accounts Exposed
France's government-issued encrypted messaging app was breached through a single compromised account, exposing data from over 73,000 public sector employees, including everything shared in public chat rooms that carried no encryption. A maximum-severity flaw in Ivanti Sentry is being actively exploited in the wild, and CISA has given federal agencies three days to patch it. Researchers have also named a new attack class called Agentjacking, which manipulates AI coding tools into executing malicious code by posing as routine error reports.
The AI Too Dangerous to Release Publicly
Anthropic just shipped its most powerful AI model in two versions — one for the public, one locked to vetted cyber defenders only. Meanwhile, the ShinyHunters extortion gang has claimed data from over 100 organisations through compromised Oracle PeopleSoft servers, and an unpatched flaw in a popular AI development tool is being actively exploited right now. If you run Windows, update today — Microsoft's June Patch Tuesday includes three publicly disclosed zero-days.
Attackers Called First, Then Showed Up
Hackers posing as IT support staff called their way into dozens of U.S. companies — and some even walked through the front door. Chrome has its fifth zero-day of the year and needs an immediate update. Apple is rolling out a feature that automatically replaces your weak or compromised passwords, and it's worth knowing about before it lands.
Oxford Students' Data Stolen in Career Platform Hack
Oxford University is notifying students, staff, and alumni after attackers broke into its CareerConnect careers platform on 28 May, making off with names, email addresses, and encrypted passwords. A new botnet is also spreading through home router firmware, with no CVE assigned yet. If you have an Instagram account, today is a good day to turn on two-factor authentication.
A Worm Just Ate 73 Microsoft Repos
A self-replicating worm tore through 73 of Microsoft's own GitHub repositories this week, poisoning code that developers around the world depend on. Cisco's SD-WAN network management software has a high-severity flaw being actively exploited right now — and there is no patch yet. On the AI front, an autonomous AI agent found 21 previously unknown vulnerabilities in a media library that lives inside nearly every video app you use.