Collaborate Disseminate
A financially motivated threat actor is impersonating hundreds of brands on GitHub and pushing a smash-and-grab infostealer masquerading as legitimate downloads of popular software, Arctic Wolf threat researchers have warned. “The 292 impersonate… Continue reading Threat actor impersonated hundreds of brands on GitHub to push infostealer malware
Microsoft has released patches for 570+ vulnerabilities on July 2026 Patch Tuesday, including two that are being leveraged by attackers (CVE-2026-56155 and CVE-2026-56164), and one that was previouly disclosed (CVE-2026-50661). The release was once aga… Continue reading AI-driven bug hunting fuels record Microsoft Patch Tuesday
SonicWall has fixed two actively exploited vulnerabilities (CVE-2026-15409, CVE-2026-15410) affecting its Secure Mobile Access (SMA) 1000 Series appliances, and is urging customer organizations to upgrade to a fixed firmare version and search for evide… Continue reading SonicWall SMA appliances targeted in zero-day attacks (CVE-2026-15409, CVE-2026-15410)
A new approach tried out by Tracebit researchers has proven very effective at stopping AI agents from fully compromising targeted environments. What makes it notable isn’t the technique – prompt injection is old news – but the directi… Continue reading “Context bombs” can frustrate AI-driven attacks, researchers found
A “credible external security threat” targeting Progress Software’s ShareFile Storage Zone Controllers (SZC) – the on-premises, customer-managed server components where organizations store files shared via this popular enterpris… Continue reading Security threat prompts Progress to disable ShareFile accounts, tell customers to shut down servers
The Pink cyber extortion crew is tricking employees into giving them access to their Microsoft 365 accounts by faking Entra passkey enrollment requests. The attack The attack starts with a vishing call to an employee. The caller poses as IT and says it… Continue reading Extortion crew hijacks Microsoft 365 accounts via fake passkey setup
Microsoft has finally released a security update for its Microsoft Malware Protection Engine, which fixes CVE-2026-50656, the Windows Defender local privilege escalation vulnerability triggered by the RoguePlanet exploit. The vulnerability and the fix … Continue reading Microsoft releases fix for RoguePlanet Defender flaw (CVE-2026-50656)
The US Cybersecurity and Infrastructure Security Agency (CISA) is warning about yet another Langflow vulnerability (CVE-2026-55255) leveraged by attackers in the wild. The flaw was added to the agency’s Known Exploited Vulnerabilities catalog on … Continue reading Attackers using Langflow flaw for credential harvesting (CVE-2026-55255)
Accenture appears to have suffered a data breach, the extent of which is currently unknown. On Monday, a threat actor going by the handle “888” posted on the cybercrime forum PwnForums, claiming to have breached the technology consulting co… Continue reading Accenture acknowledges security incident following 35GB data theft claim
CVE-2026-48282, one of the maximum severity vulnerabilities patched in Adobe ColdFusion on June 30, 2026, has been targeted by attackers in the wild. Exploitation attempts were detected on July 2, through the honeypot sensors of cybersecurity threat-in… Continue reading Attackers exploit critical Adobe ColdFusion vulnerability (CVE-2026-48282)