Our own breakdowns of what happened
Capcom Says Intruders Took 11.7 Million CAPCOM ID Records, Warns Players of Phishing Risk
Capcom confirms a breach of its CAPCOM ID account system exposing 11.7 million email records. Passwords and card data were not taken.
Read full story →Nextcloud's Collabora Add-on and Arista VeloCloud Orchestrator Flaws Join CISA's Exploited List
Logged-In Users Can Seize Control of Arista VeloCloud Orchestrator Through Exploited SQL Flaw
Arista has patched CVE-2026-114625, an actively exploited SQL injection flaw that lets low-level VCO users gain operator control.
Read full story →PHP2Shell: Twin Flaws in PHP's Engine Put Nearly Every Web Server at Risk
PHP rushed out fixes for two 9.2-rated bugs that let unauthenticated attackers run code on servers. Scanning began within hours.
Read full story →Plex2Shell Chain Leads Six Actively Exploited Flaws on CISA's Urgent Patch List
PHP2Shell: Two Critical Engine Flaws Expose Nearly Every PHP Web Server to Remote Takeover
Ransomware Crews Turn PAN-OS GlobalProtect Bypass Into a Path to Hypervisors
Siemens Patches Software Center DLL Flaw After ClickFix Gangs Used It to Plant a Remote Access Trojan
Broadcom Wi-Fi Setup Bug Hands Routers to Nearby Attackers, With No Patch in Sight
A researcher says a Broadcom WPS flaw lets nearby attackers run code as root on millions of routers, with no CVE or fix.
Read full story →PwnEscape: Malformed IPv4 Packets Could Let a Guest Break Out of Linux KVM
Magento's BlockStrap Bug Earns Perfect CVSS 10 as Sansec Predicts Rapid Exploitation
Stolen ConnectWise Backup App Credential Opens Door to Over 170 Microsoft 365 Tenants
Attackers used a stolen ConnectWise Cloud Backup app credential to sign in to Microsoft 365 tenants, some with admin roles.
Read full story →Millions of Healthcare Customers Hit in Major Data Breach; What You Need to Know
AdaptHealth reports 4.1 million patients exposed after July cyberattack; experts warn of broader industry vulnerabilities.
Read full story →Cisco Secure Firewall Management Center Under Active Attack Following Security Flaw Discovery
Trezor Cryptocurrency Users Face New Security Threat After Email System Compromised
Hardware wallet firm Trezor alerts customers following unauthorized access to email systems, raising phishing risks.
Read full story →Hackers Are Stealing AI Service Passwords to Break Into Company Accounts
Criminals are using stolen login credentials to hijack AI tools from major providers, creating security gaps companies need to patch fast.
Read full story →Multiple Hacking Groups Exploit Same Security Flaws in Popular Software
Four different spy operations used identical vulnerabilities in Chrome and Windows within days, raising alarms about shared attack tools.
Read full story →Critical Security Flaw Discovered in Chrome Browser; Google Issues Urgent Warning
Google alerts users to an active Chrome vulnerability being used in real-world cyberattacks with no patch yet available.
Read full story →Major Bitcoin Theft Partially Reversed as Hackers Return Stolen Cryptocurrency from Exchange Platform
Cybercriminals return thousands of Bitcoin after exploiting software vulnerability, but millions remain missing.
Read full story →Microsoft Releases Historic Security Update as Critical N-able Flaw Spreads Among Businesses
Microsoft patches nearly 1,000 flaws in major update; remote access tool vulnerability already being weaponized by attackers.
Read full story →Microsoft Releases Massive Security Update Fixing Nearly 1,000 Vulnerabilities, Including Active Windows Threats
Microsoft patched 974 security holes this month, with 2 Windows flaws already being exploited by hackers in the wild.
Read full story →Attackers Breach 258 Companies Using Microsoft 365 Phishing Tool That Defeats Two-Factor Authentication
Criminal operation targeting Microsoft 365 users bypassed MFA protections at hundreds of organizations using specialized phishing service.
Read full story →Massive Passenger Database Breach Exposes 220 Million Travelers' Personal Information
A Vietnam-based aviation database containing decades of passenger records was left unprotected online, compromising millions of travelers worldwide.
Read full story →Criminals Using Fake Help Desk Calls to Steal Cloud Account Access
Security researchers warn of coordinated attacks targeting business cloud accounts through impersonation and fake login pages.
Read full story →New Browser Hijacking Tool Puts Corporate Leaders at Risk Through Fake Support Calls
Attackers use disguised browser add-ons to steal Microsoft 365 data from executives in targeted campaigns.
Read full story →HPE Releases Emergency Fixes for Major Security Flaws in Network Operating System
HPE addresses 23 critical vulnerabilities in AOS-CX software that could let hackers take over systems remotely.
Read full story →Major Security Week: Microsoft Patches Cloud Flaws While Thousands Lose Dropbox Access
Microsoft updates cloud defenses, 5K Dropbox users breached, and cybersecurity startup Guardio hits unicorn status.
Read full story →