SecurityWeek

Extortion group data leak; breach shows attacker access lasting months. Review data exposure and customer notification readiness.

Authenticated pull-request variant enables remote code execution. Apply upstream patches and restrict PR flows.

Chrome 148 patches 151 vulnerabilities, including critical RCE flaws. Urge immediate browser updates across endpoints.

Major retail breach affecting millions; highlights risk from third-party access and credential abuse. Prepare containment and notification playbooks.

Apex One on-premise systems are under active exploitation for CVE-2026-34926. Patch immediately to reduce risk.

Law enforcement in the MENA region arrested hundreds in a cross-border cybercrime crackdown; review regional threat posture and indicators of compromise.

A critical unpatched vulnerability in ChromaDB allows unauthenticated attackers to execute code and take control exposed servers. Patch and rotate credentials immediately.

Two OpenAI employee devices were compromised; credential material stolen from code repositories. No user data or production systems affected.

Microsoft issues mitigations for a high-severity Exchange Server zero-day (CVE-2026-42897) exploited in the wild. Install mitigations promptly.

CVE-2026-6973 exploited in targeted attacks; patches released to mitigate. Immediate patching recommended.

Chrome 148 closes 127 vulnerabilities, including critical overflow and use-after-free flaws. Update immediately to reduce exploitation risk.

Tiny package-based attack chain shows rapid compromise across popular software ecosystems.

Mini Shai-Hulud supply-chain attack breached SAP-related NPM packages to steal credentials; review dependencies and monitor for credential theft.

Active exploitation of a critical auth bypass in cPanel/WHM has been observed in the wild for months, enabling unauthorized admin access. Patch and containment efforts are underway.

Zero-Day in Microsoft Defender exploited to access SAM and NTLM hashes; patch available. Review Windows security posture and apply the patch promptly.

Multiple healthcare providers disclosed breaches affecting hundreds of thousands; reinforces need for identity controls and data segregation.

North Korean-linked actors exploited DeFi infrastructure to steal $290M in a high-profile crypto heist; organizations should review cross-chain and bridge trust controls.

Remote code execution CVE-2026-34197 exploited in the wild; upgrade and rotate credentials advised.

Autovista faced ransomware impacting automotive data operations; assess backups, isolate affected systems, and strengthen access controls.