The FIFA World Cup 2026 opened on June 11. By that date, according to Check Point Research, the fraud infrastructure targeting it had already been built, staged, and partially deployed. Threat actor activity was pre-planned, months out, across three sectors and at least ten langu…
An unknown threat actor has been observed exploiting a recently disclosed maximum-severity security flaw in SimpleHelp to deliver two previously unreported malware families, TaskWeaver and Djinn Stealer. The intrusion involves the exploitation of CVE-2026-48558 (CVSS score: 10.0…
Uma vulnerabilidade crítica no Gemini CLI, ferramenta de linha de comando do Google voltada a desenvolvedores, pode permitir que invasores executem comandos em ambientes automatizados de desenvolvimento, especialmente em fluxos do GitHub Actions. A falha foi identificada como CVE…
Kali Linux 2026.2, the second release of the year, is now available for download, featuring 9 new tools and numerous Kali NetHunter improvements. [...]
The Blackfield ransomware gang is asking for a $2 million ransom from Nidec Corporation, a large Japanese manufacturer of electronic components for automotive and computing applications. [...]
Two researchers have found six security flaws in AirDrop and Quick Share, the wireless features that beam files between nearby devices with no cables or shared network. An attacker within wireless range, with just a laptop and no prior connection, can crash the sharing service o…
CISA confirmed on Monday that ransomware gangs are now exploiting a Microsoft Defender privilege escalation vulnerability, dubbed BlueHammer, that has previously been abused in zero-day attacks. [...]
Washington Dept. Health & Social Services Insider Breach Affects 8,600 Individuals The HIPAA Journal
The Washington Department of Social and Health Services (DSHS) has identified an insider data breach involving unauthorized access to the protected […] The post Washington Dept. Health & Social Services Insider Breach Affects 8,600 Individuals appeared first on The HIPAA Journal.
Convince an AI browser that it is playing a game, and it can hand over your login details. That is the finding behind BioShocking, a technique from security firm LayerX that tricked six AI browsers and assistants into copying a user's credentials and sending them to an attacker. …
A critical vulnerability in Progress Kemp LoadMaster can let an unauthenticated attacker execute arbitrary commands as root on the appliance by sending a crafted request to its API. The flaw, tracked as CVE-2026-8037, carries a CVSS score of 9.8 according to ZDI. A patch is avai…
A critical security flaw impacting Oracle E-Business Suite has come under active exploitation in the wild, according to Defused Cyber. The vulnerability, tracked as CVE-2026-46817 (CVSS score: 9.8), refers to an improper privilege management and authentication flaw in Oracle Pay…
Pesquisadores da 0din.ai demonstraram um ataque que explora agentes de codificação baseados em IA, como o Claude Code, para obter acesso remoto a máquinas de desenvolvedores, utilizando um repositório aparentemente inofensivo. O estudo de caso, publicado no dia 25 de junho, mostr…
O ataque à Jaguar Land Rover (JLR) em setembro do ano passado, que paralisou a produção por semanas e gerou prejuízos de 550 milhões de euros para a montadora, foi uma operação de ransomware avançado que explorou vulnerabilidades em sistemas legados, de acordo com reportagem do T…
A Defused, empresa de cibersegurança, identificou exploração ativa de uma vulnerabilidade crítica no Oracle E-Business Suite, conforme publicação do site Security.nl no dia 29 de junho. A falha, registrada como CVE-2026-46817, afeta o componente Oracle Payments e permite que um a…
Operation by two Russia-state groups has been ongoing since at least March.
The infostealer was delivered via CVE-2026-48558, a critical authentication bypass vulnerability in SimpleHelp, targeting credentials linking development and admin environments to wider enterprise systems.
Researchers spotted 212 new domains registered after Venezuela's earthquake, warning donors of donation scam risks and urging them to verify relief sites first.
One critical vulnerability, among many discovered by a researcher, could have allowed anyone to walk in and take over a national government portal.
Nissan is warning that it suffered a data breach affecting current and former employees after threat actors exploited an Oracle PeopleSoft vulnerability in data theft attacks previously linked to the ShinyHunters extortion group. [...]
