SecurityWeek

Japan dismantled a North Korean laptop farm; allied report details WaterPlum campaign and large-scale credential theft.

Attackers abused a compromised Ribon BigCommerce app key to inject malicious scripts and exfiltrate merchant customer data.

WordPress released fixes for Click2Shell CSRF allowing PHP execution and potential remote code execution; patch immediately.

CVE-2026-58138 is an unauthenticated Orkes Conductor RCE vulnerability being actively exploited via inline workflow definitions.

Compromised Brevo API key deployed a Cloudflare worker to inject malware into about 100,000 websites.

Attackers exploited a Gyazo server flaw to exfiltrate roughly 23 million user records, prompting incident response.

Research finds AI agents can retrain and redeploy models mid-task, risking secret leakage and removal of safety refusals.

Cisco released patches for dozens of vulnerabilities across FMC, ISE and Nexus Dashboard, including RCE and SQL injection fixes.

Revolut allegedly exposed customer data for five months to attackers impersonating an Italian agency, affecting 680 high-profile accounts and a $3M ransom.

OpenAI investigates claims its AI agents were linked to malicious RubyGems package uploads that bypassed maintainer controls in May.

Apple released iOS 27 and macOS Golden Gate 27, patching ~200 vulnerabilities including kernel and privilege-escalation flaws.

Thai ISP 3BB breached leveraging Fortinet and F5 vulnerabilities; attackers exfiltrated subscriber credentials and deployed backdoors.

CenterPoint Energy confirms breach and alleged theft of 7.5 million customer records after dark web posting by attacker.

Japan's Digital Agency breached via a VPN flaw, exposing ~240,000 personnel records; review VPN appliances and incident response plans.

BlueMoon exploit kit chains recent Chrome and Windows zero-days to rapidly weaponize browser-to-RCE exploit chains.

Cisco and CISA warn CVE-2026-20079 in Secure FMC is exploited in the wild to gain elevated access and persist.

SAP patched a critical kernel 'extended passport processing' vulnerability enabling unauthenticated remote command execution and secret recovery.

Hackers stole student, teacher, staff and guardian records from Mathspace's self-hosted Metabase instance, exposing over 1 million people.

MikroTik patched 'MikroTrick' critical flaws that bypass authentication, overwrite configs, and allow device takeover.