ls ./category/security --page 5
Breaches, vulnerabilities, malware and the patches that matter.
A joint CISA, FBI and HHS advisory puts Medusa past 500 US critical infrastructure organisations as of April 2026, up from 300-plus in March 2025. The number that explains the growth is not the victim count: it is the $100 to $1 million the operation pays initial access brokers.
CVE-2026-33824 is a double free in the Windows IKE Service Extensions, reachable by anyone who can send a UDP packet to port 500 or 4500. Microsoft fixed it in April without flagging exploitation. CISA added it to the exploited catalogue on 18 August and set a three-day patch deadline, which is not what that directive normally allows.
CVE-2026-19478 is a CVSS 9.4 in GitLab CE and EE: under certain conditions an unauthenticated user could modify or delete public projects and user data through a GraphQL directive. Patches landed on 17 August outside the normal release train. GitLab.com is already covered; self-hosted is not.
Reco has tracked a single IP walking Salesforce and ServiceNow customer portals across telecoms, banks, software vendors and government. No exploit was involved: the guest user on those public sites could already read more than the site needed to show. One target logged over 560,000 events from that one address.
Microsoft Defender Experts has tied 30-plus domains to MacSync, a macOS stealer delivered by getting people to paste a command into Terminal. It takes the Keychain, SSH keys, AWS credentials and Kubernetes configs. The build token changes every deployment; the API key does not, which is the whole detection.
CVE-2026-12569 in PTC Windchill and FlexPLM is in CISA's exploited catalogue, and ReliaQuest has pulled apart the JSP implant Clop is dropping through it. One command decrypts the LDAP manager password out of the keystore, which turns a PLM compromise into a directory compromise.
Ransom Busters says it has spent three years breaking into ransomware operators' servers and can get your files back. GuidePoint responded to two of these incidents and found the same backdoor password, the same attacker hostname and the same toolkit in both — which points somewhere much less heroic.
Hudson Rock reported on 16 August that a seller calling himself TheHatman is offering Entra directory exports from McDonald's, TCS, Vodafone, HCL and five others. TCS says it found no credible evidence and the data is at least four years old. Gap says the same. Nobody has independently authenticated any of it — and the records would still be useful to an attacker if every word of the denials is true.
CVE-2026-69414 bypasses July's patch for RoguePlanet using a different technique entirely: a user-mode callback that swaps file contents mid-scan through the Cloud Filter API. Microsoft says a fix is coming. There is no patch, the proof of concept is public, and the only mitigation is turning off the thing doing the protecting.
Fortinet has tracked Evooo1Bot since July 2026 across Alcatel, NETGEAR, Tenda, Mitsubishi Electric, Telesquare and D-Link gateways. It picks one of twelve builds to match your CPU, clears Bash history, and turns the device into a SOCKS5 node.
Cameron Curry emailed dozens of Brightly Software employees demanding $2.5 million in crypto, with a $100,000 monthly escalation. The company paid $7,540 before reporting it. He got two years.
Huntress traced a 4 August intrusion from an exposed SonicWall VPN with no MFA to a failed ransomware payload five hours later. The files were already in the attacker's S3 bucket. Defender quarantined akira.exe after the reboot, too late to matter.
AmnesiaStealer clones a Mac user's Chromium profile and streams the session back at 3fps. SpecterOps' Windows technique switches on Chrome's debugging protocol inside the running process. Neither needs your credentials, and neither is stopped by MFA.
The viral advice is recovery codes and a backup email. That covers losing your own account. It does nothing about someone buying your dead employer's domain and inheriting your Slack, or about accounts an admin cannot deprovision at all.
UNC6671 runs four extortion brands off one set of domains. The pretext is a security upgrade — FIDO2 enrolment, MFA migration — and the payoff is an adversary-in-the-middle portal. Average settled payment: $750,000.
The technique needs SYSTEM on the ADFS host and touches neither LSASS nor the running service. It works because manual certificate rotation leaves the database pointing at a ghost while the real key sits in the machine DPAPI store.
Attackers took over Instagram accounts using photos from the target's own public profile, a public deepfake generator and a VPN. Better liveness detection would not have stopped it, because the bot could be talked into the rest.
Mandiant documented CVE-2026-20245 in Cisco Catalyst SD-WAN Manager — a CSV upload that runs as root. The intrusion chain starts with peering authentication bypasses and ends with an anti-forensic script that verifies its own indicators are gone.
Infoblox tracked Sable Squirrel across 10,000-plus domains, including former General Electric, Procter & Gamble and Sony developer addresses. 31,000 malware samples talked to the infrastructure. Roughly 65,000 expired domains are re-registered every day.
Three crises are being bundled into one story about a company cracking. The suit against OpenAI is real and names a Chief Hardware Officer. The 630GB of iPhone 18 Pro files came out of Tata Electronics. And Siri is not still broken — Apple bought a way out for about $1bn a year.
Shai-Hulud's second wave hit somewhere between 600 and 800 packages depending on who counted. The packages were pulled within days. The credentials it published to public GitHub repos are what produced breaches months later — including Suno's.
The claim is everywhere and the argument behind it is good. The number is not a measurement. It comes from a single blog post in May 2026 describing a local experiment on React, and the industry statistics stacked around it come from different vendors counting different things.
The 'AI slop' story says quality collapsed. HackerOne's own figures say the confirmed-exploitable rate held at about 25% through a record surge, and the share of critical and high findings went up. The problem is not slop. It is that finding got cheap and fixing did not.
Two law firms, an equine hospital, a mental health charity and three metal companies, published in batches with a two-day gap between attack and leak. It shares a name with Microsoft's Storm-1175, which is a different actor entirely.