> TODAY'S SUMMARY (16 articles)
Today's cyber news highlights several significant threats and trends. The Brenner Base Tunnel SE has confirmed a data breach involving 812 GB of stolen data, while Iris Ohyama reported a breach affecting 7.7 million customers. The emergence of the "sshole" vulnerability (CVE-2026-123158) is leading to increased exploitation attempts. Additionally, hackers breached French Bank Crédit Mutuel Arkéa through a third-party provider, resulting in a theft of up to $133 million. On a positive note, Brava Security has secured $15 million in funding to enhance enterprise defenses using AI. The landscape is increasingly influenced by AI, prompting predictions for identity security by 2027. Meanwhile, cyber readiness remains a critical focus for organizations as they prepare for potential incidents.
|
// AI-powered summary generated at 20:00
Sites belonging to major universities such as Harvard and Oxford, as well as DuckDuckGo, have been compromised in the attack.
The post Ghost CMS Vulnerability Exploited to Hack Over 700 Websites appeared first on SecurityWeek.
TeamPCP now operates across three package ecosystems in parallel, it reached GitHub&#;x26;#;39;s own internal codebase, it trojanized an officially Microsoft-published Python SDK, and it appears to have open-sourced its own framework on GitHub.
TeamPCP now operates across three package ecosystems in parallel, it reached GitHub&#;x26;#;39;s own internal codebase, it trojanized an officially Microsoft-published Python SDK, and it appears to have open-sourced its own framework on GitHub.
Authorities in the Netherlands have arrested the co-owners of two related Internet hosting companies for operating IT infrastructure used by Russia to carry out cyberattacks, influence operations and disinformation campaigns inside the European Union. The two men were the focus of a 2025 KrebsOnSecu...
Dutch authorities arrested two men and seized 800 servers linked to a hosting provider that investigators say supported Russian activities aimed at undermining democracy and security through cyberattacks, disinformation, and disruption of public and economic systems. Servers seized by Dutch authorit...
The FBI is warning about the Kali365 phishing-as-a-service platform (PhaaS) that is used to hijack Microsoft 365 accounts by abusing OAuth device code authentication to steal session tokens and bypass multi-factor authentication (MFA). [...]
Enterprises cannot secure AI agents by making the underlying models more robust and must instead enforce security controls at the system level around them, researchers behind a paper published this month argued, warning that traditional AI-security approaches are increasingly...
Register for Belkasoft’s free on-demand SQLite training course to build practical DFIR database analysis skills, validate tool extractions, and earn 6 CPE credits.
The affected third-party vendor has not been named, but one possible candidate is TriZetto.
The post Oncology Institute Discloses Data Breach appeared first on SecurityWeek.
Threat actors are exploiting a recently disclosed critical security flaw in Ghost CMS to inject malicious JavaScript code with an aim to fuel ClickFix attacks.
According to QiAnXin XLab, the activity involves the exploitation of CVE-2026-26980 (CVSS score: 9.4), an SQL injection vulnerability in Gh...
La Commission Nationale de Contrôle de la Protection des Données à Caractère Personnel (CNDP) marocaine et la Commission de Protection des Données du Nigéria (NDPC) ont signé un mémorandum d'entente pour promouvoir la coopération bilatérale.L'accord, signé le 22 mai 2026 à Abidjan par les dirigeants...
L'ancienne présidente de l'autorité tchèque de protection des données (ÚOOÚ) revient, dans une entrevue, sur les moments clés de son mandat exercé entre 2015 et 2020 et sur les défis actuels et futurs en matière de protection des données.L'ancienne présidente évoque une sanction de 3 600 000 CZK (en...
As AI coding assistants accelerate software development, one OWASP-backed open-source project is arguing that dependency security tooling still arrives too late to be truly useful.
CVE Lite CLI, a JavaScript and TypeScript dependency vulnerability scanner focused on local l...
L'Agence Espagnole de Protection des Données (AEPD) a publié une décision de sanction à l'encontre de ALÍA GESTIÓN INTEGRAL DE SERVICIOS, S.L. (comprenant le prononcé d'une amende de 150 000 €) pour des manquements en lien avec la sécurité des données personnelles. Cette affaire débute par la notifi...
L'Agence espagnole de protection des données (AEPD) a publié une décision déclarant une infraction à l'encontre la Mairie de Madrid pour des manquements en lien avec la gestion de deux violations de données. Cette affaire débute par la notification de ces deux violations par l'entité elle-même, caus...
U.S. state governments are taking on a larger role in cybersecurity to help protect local communities and essential services. Many states are building state-led cyber defense programs, including cybersecurity clinics, regional security operations centers (RSOCs), and state cyber corps programs to re...
L'Autorité nationale de surveillance du traitement des données à caractère personnel de Roumanie (ANSPDCP) a publié un bilan de ses activités pour les quatre premiers mois de 2026, accompagné d'une synthèse de jurisprudences récentes confirmant ses décisions de sanction.De janvier à avril 2026, l'au...
L'Agence croate pour la protection des données personnelles (AZOP) dresse un bilan de huit années d'application du RGPD, soulignant ses actions de contrôle et d'accompagnement.L'autorité constate une hausse de plus de 50 % des plaintes l'année dernière, principalement liées à la difficulté pour les...
Ask a cybersecurity pro about Network Detection and Response (NDR) and you might still hear "Noisy," "Too much data." But ask the teams running NDR that includes agentic AI capabilities and you'll hear they're actually using it to catch threats earlier, triage faster, and chase fewer false positives...
Threat actors stole files containing names and protected health information from the healthcare organization’s systems.
The post 266,000 Affected by Data Breach at Radiology Associates of Richmond appeared first on SecurityWeek.