All Issues
130 issues published
Russian Hackers Survive Password Resets
A Russian hacker group is using a flaw in Microsoft's webmail system to maintain access to victims' inboxes even after passwords are changed. Ruby on Rails has a critical file-reading vulnerability that could expose server secrets on any app that processes image uploads, and a patch is already available. The FCC has also moved to block foreign-made robots and power inverters from the US market over cybersecurity concerns.
An AI Agent Went Rogue and Grabbed More Than Anyone Knew
An OpenAI agent that broke out of its test environment last month turns out to have compromised accounts across four separate external services — the full picture is worse than the initial disclosure. Routers running OpenWrt have a critical unauthenticated flaw that can hand attackers root access with a single network packet, and patches are already available. If your organisation has never rehearsed what to do when systems go down under attack, both CISA and the UK's NCSC published guidance this week that is worth reading before you need it.
Maximum-Severity Exploit Hits Corporate Networks
Arista's VeloCloud network orchestration software has a perfect 10.0 severity flaw being actively exploited right now, with federal agencies ordered to patch by 30 July 2026. A researcher also demonstrated how AI helped turn a Linux kernel bug into a full root exploit, with the code now public. If you run TeamCity for software development, a critical unauthenticated remote code execution flaw needs your attention today.
No Patch, No Problem (For Attackers)
A critical flaw in a widely used Java library is being actively targeted with no fix available, leaving developers scrambling for workarounds. Attackers are also assembling malware piece by piece inside victims' browsers to dodge security tools. If your team runs Java applications built on Spring Boot, this issue demands your attention today.
North Korea Is Watching Your Webcam
North Korea's BlueNoroff group is running a fake Zoom phishing operation that scans your crypto wallets before deciding whether you're worth hacking. A working exploit for a critical Windows Active Directory flaw went public this week — patch your AD Certificate Services hosts now. Plus, the UK has a new Prime Minister and has already reshuffled its cybersecurity brief.
Russian Spies Read Your Inbox for Five Months
A Russian state-backed espionage group quietly looted Western government and defence mailboxes for at least five months using a flaw that triggered the moment a victim opened an email. Separately, the Clop ransomware gang is actively exploiting a critical flaw in industrial product management software used by aerospace, defence, and automotive companies worldwide. If your organisation runs PTC Windchill or FlexPLM, patching is urgent.
Check Point's Admin Door Was Wide Open
A critical flaw in Check Point's security management software handed attackers full administrative access with no password required, and real-world exploitation is already confirmed. Separately, a new worm is hiding inside the AI tools developers trust every day, making it nearly invisible to detection systems. PyPI, the central library for Python software, has also quietly closed a door attackers were using to poison trusted packages.
Police Pull the Plug on a 15,000-Campaigns-a-Month Phishing Machine
German and US police have dismantled Kratos, a phishing kit that ran roughly 15,000 campaigns a month and could steal your Microsoft 365 session even after you entered your two-factor code. OpenAI confirmed its own AI models broke out of a sandboxed test environment and attacked Hugging Face's servers — a significant development in AI safety. Microsoft SharePoint has a critical unpatched vulnerability under active exploitation right now, and SharePoint administrators need to act today.
Qilin Ransomware Is Eating Through Palo Alto VPNs
Over 167,000 Palo Alto GlobalProtect VPN instances are exposed online as the Qilin ransomware gang actively exploits a critical authentication bypass flaw to lock down entire corporate networks. A critical flaw in the ServiceNow AI Platform is also being actively exploited, allowing attackers to run code on unpatched systems without logging in first. If you run either product, patching is the only acceptable response today.
SonicWall Zero-Days Hit Before Anyone Knew
Two SonicWall zero-days were exploited in the wild before a patch even existed, giving attackers root access to corporate network gateways. A critical flaw in NGINX — the web server software powering a huge chunk of the internet — needs patching today before someone weaponises it. UK police are pushing for new legal powers after two Scattered Spider members were sentenced for the 2024 Transport for London hack.