Breaches, ransomware and supply-chain compromises, with the lesson for people who run systems.
Analysis4 min read
Europol and the US Justice Department say the takedown hit three malware services, cleaned 681 infected websites and handed 6.4 million stolen credentials to breach-notification groups.
Analysis3 min read
Police seized servers behind three criminal tools and about 6.4 million stolen logins belonging to more than 40,000 victims, according to Germany's BKA.
Analysis3 min read
Trezor says an extra circuit board inside the wallets copies the recovery phrase off the screen and sends it over the mobile network to an attacker-controlled server.
Analysis4 min read
Law enforcement and industry partners dismantled servers and domains behind Gootloader, CastleRAT and StealC, with the Justice Department putting Gootloader's reach at 25,000 infected devices since 2018.
Analysis4 min read
Trezor says the added circuit board sat between the main board and display, captured recovery words and passphrases, and sent them over a cellular network. No customer has reported lost funds.
ExploitedCVE-2026-109618CVSS 9.25 min read
Check Point says attackers chained the PHP2Shell RCE bugs with a local privilege escalation to reach root, then deployed webshells, a backdoor framework and a wiper. It can't say who did it.
Analysis4 min read
Huntress says a campaign compromised at least 6 MSPs and 288 hosts across 48 organizations, with commands reaching endpoints in minutes and no matching logins. ConnectWise disabled five RMM+ family extensions across roughly 400 ScreenConnect environments.
Analysis4 min read
The cloud host says two vulnerabilities let intruders reach decrypted environment variables for at most 1.85% of workspaces, and that the fight lasted roughly 26 hours.
Brief2 min read
A sponsored report describes more than 1,000 incidents of brand-impersonating reward portals that push visitors through verification loops and carrier-billed sign-ups. No gift card is ever delivered.
Brief2 min read
The grocery giant says the incident will cut fourth-quarter net sales by €200 million to €250 million and has lowered its 2026 guidance. It still hasn't said what kind of attack it was.
Brief2 min read
Prime Minister Sanae Takaichi unveiled a 10 billion yen package with AI-assisted teams and a "cyber rescue team" after dozens of companies and government agencies reported unauthorized access and client data leaks.
Brief2 min read
The New York City library system confirmed the attack in alerts on Wednesday, after first reporting outages that afternoon. No gang has claimed it.
