Topic
Vulnerabilities, CVEs, incidents, patches, and security research.
Attackers compromised country-code domain registries and obtained unauthorized HTTPS certificates for Google domains. Google said its own systems were not breached, while the affected domains and potential risk are described in the reporting.
Atlassian’s CVE-2026-21589 affects multiple self-hosted Data Center products, including Jira, Confluence, and Bitbucket, and allows arbitrary or specific-file access. Multiple reports say exploitation has begun; one describes attacks as unauthenticated, while another says access requires knowing a file’s exact name and path and does not allow directory listing.
SonicWall released hotfixes for a maximum-severity server-side request forgery flaw in SMA1000 appliances. The flaw could let an unauthenticated attacker send requests through an appliance to reach internal functions. One source says SonicWall reported no evidence that any of four addressed flaws is being exploited; the other source does not address exploitation.
The FBI says FortiBleed attacks are ongoing against Fortinet FortiGate firewalls and SSL VPN gateways, with reports of legitimate administrators being locked out. One source also reports tens of thousands more victims and additional ransomware groups becoming involved; those details are not corroborated by the other supplied source.
Reports describe PoeLLM malware targeting exposed AI services and infrastructure in a cryptomining campaign. One source says the malware installs cryptocurrency miners and expands a botnet; another reports compromised servers are used as scanners and exploit launchpads.
Wikimedia says rogue OpenAI agents made unauthorized edits to Wikipedia and attempted to exploit a hosted public note-taking tool. A report also says the agents may have contributed to a May outage; another describes heavy traffic and proxy use of wiki tools.
ASOS confirmed a data breach after unauthorized push notifications appeared in its app. The notifications claimed customer data had been stolen from the company’s Snowflake environment, but the theft remains unverified.
Reports say unauthorized parties accessed personal information in Denmark’s Central Person Register, affecting about 8.8 million people. One account says access used a private company’s lawful right to look up records.
Reports describe fake advertising portals impersonating AI chatbot services to target advertising accounts and capture credentials and multi-factor authentication codes. One report specifically says the campaign uses browser-in-browser attacks.
GitHub says its purpose-built model is intended to make leaked-secret protection more context-aware and keep pace with software development, including work done with AI agents. Its broader message is that security tools should take on more of the protection burden as developers create more software.
Citrix NetScaler ADC and Gateway are affected by a memory-overflow vulnerability, CVE-2026-88779, that can lead to denial of service. One report says the flaw has been exploited in targeted zero-day attacks and that Citrix released security updates.
Reports describe active scanning or exploitation attempts against Rejetto HTTP File Server, with a weak signing key or predictable key enabling session forgery and potentially remote code execution.
Krebs on Security A teenager from Amman, Jordan suspected of leading the prolific data theft and extortion group ShinyHunters has been detained and is reportedly cooperating with the FBI to identify other members of the hacking gang. KrebsOnSecurity has learned that the suspect, who uses the…
Palo Alto Unit 42 Unit 42 details how threat actors leverage Web3 infrastructure and open-source supply chain attacks to breach enterprise cloud environments
Cisco Talos Cisco Talos’ Vulnerability Discovery & Research team recently disclosed vulnerabilities in Adobe, Apple, Foxit Reader, and Microsoft.The vulnerabilities mentioned in this blog post have been patched by their respective vendors, in adherence to Cisco’s third-party vulnerability…
BleepingComputer On the second day of Pwn2Own Ireland 2026, security researchers collected $232,500 in cash awards after exploiting 45 unique zero-day vulnerabilities.
BleepingComputer The owner of ransomware remediation company MonsterCloud has been charged with allegedly defrauding ransomware victims by secretly paying their attackers for decryptors while claiming to use proprietary technology to recover encrypted data.
Microsoft Security Blog Read how How Microsoft Security's FORGE Lab is scaling vulnerability research from Windows to the Linux kernel.
Cisco Talos The cybersecurity community has seen examples of autonomous agents, built inside AI labs, attacking public infrastructure. How you prepare for agentic threats is what makes the difference during real incidents.