Cybersecurity researchers have flagged a new class of CI/CD workflow weakness that allows attackers to hijack workflows and compromise open-source supply chains. The "critical exploitable pattern" has been codenamed Cordyceps by Novee Security. The issue can allow full attacker …
Dados de usuários do LastPass foram expostos em um novo incidente de segurança. O vazamento ocorreu após um ataque à Klue, plataforma de inteligência de mercado utilizada pela companhia, e não comprometeu as senhas guardadas no gerenciador. 5 apps gerenciadores de senhas gratu…
Two British hackers have pleaded guilty to a cyberattack on Transport for London (TfL), one of whom also admitted to […] The post British Scattered Spider Hacker Pleads Guilty to Cyberattacks on TfL; SSM Health Care; Sutter Health appeared first on The HIPAA Journal.
Attackers can exploit the issue to disable security and integrated browser tools without needing administrator privileges or kernel exploits.
Uma prova de conceito pública foi divulgada para uma vulnerabilidade de alta gravidade no Microsoft Exchange Server, aumentando o risco de exploração contra ambientes locais que ainda não aplicaram as correções de junho de 2026. A falha, identificada como CVE-2026-45504, afeta Ex…
A campanha FortiBleed expôs credenciais de milhares de firewalls FortiGate conectados à internet, aumentando o risco de acesso não autorizado a redes corporativas em diversos países. O caso envolve uma base de dados vazada com credenciais associadas a dispositivos Fortinet. Segun…
A Bajaj Auto confirmou ter sido atingida por um ataque de ransomware que afetou sistemas internos da companhia e de sua subsidiária de tecnologia, a Bajaj Auto Technology Ltd. O incidente foi detectado por volta das 8h da manhã de 23 de junho de 2026, no horário da Índia. A empre…
We are standing at the end of an era we never thought to mourn: the era of human-speed threats. For years, cybersecurity moved to a rhythm organizations could follow. A researcher found a bug, a CVE was cataloged, a vendor navigated a patch cycle, and weeks or even months later,…
A new backdoor dubbed Mistic has been observed in financially motivated attacks targeting organizations in the insurance, education, IT, and professional services sectors. [...]
Threat actors have begun to exploit a recently disclosed critical security flaw impacting Cisco Unified Communications Manager (Unified CM) and Unified Communications Manager Session Management Edition (Unified CM SME). The vulnerability, tracked as CVE-2026-20230 (CVSS score: 8…
Order warns of national security risks if post-quantum cryptography isn't adopted in time.
A high-severity SSRF vulnerability, tracked as CVE-2026-20230, in Cisco Unified Communications Manager Server is now being exploited in attacks. [...]
Os responsáveis pela campanha FortiBleed, que comprometeu dezenas de milhares de firewalls Fortinet, instalaram nos dispositivos invadidos um sniffer personalizado para interceptar o tráfego de login de 24 protocolos diferentes, obtendo hashes e também senhas não criptografadas. …
A Cedro Textil, tradicional indústria têxtil brasileira fundada em 1872, identificou um incidente de segurança cibernética que afetou parte de seus ambientes tecnológicos e impactou a operação de determinados sistemas corporativos, de acordo com um fato relevante publicado pela c…
Tata Electronics has confirmed in a statement to BleepingComputer that it was the target of a cyberattack that impacted parts of its IT infrastructure. [...]
More victims have emerged after attackers breached application vendor Klue and used its OAuth tokens to steal customers' Salesforce data.
Healthcare technology company Xsolis says that sensitive data belonging to nearly 1.4 million individuals was compromised in a phishing attack that gave attackers access to its network. [...]
The CI/CD workflow weakness affects Microsoft's Azure Sentinel, Google's AI Agent Development Kit, Apache's Doris analytics database, Cloudflare's Workers SDK, and Python Software Foundation's Black.
A new macOS ClickFix campaign is using Terminal commands to silently download, mount, and launch info-stealing malware from malicious disk image (DMG) files. [...]
A Russian-speaking initial access broker (IAB) driven by financial gain is assessed to be behind a large-scale credential-harvesting operation known as FortiBleed that has targeted over 430,000 FortiGate firewalls globally. The campaign, active since February 2026, involves coll…
