1,437 articles
Cyber AttackInjectable drug packaging leader West Pharmaceutical Services files SEC Form 8-K Item 1.05 disclosing data exfiltration and systems encryption halting global manufacturing.
Deep DiveThe European Union enacts NIS2 Directive enforcement, establishing mandatory 24-hour incident notifications, personal C-suite liability, and strict supply chain audits.
Threat IntelCloudflare and OpenNext patch high-severity flaw CVE-2026-3125, where path normalization bypasses allow attackers to trigger SSRF and extract private Next.js cache assets.
RansomwareDigital healthcare firm iRhythm Holdings files SEC Form 8-K Item 1.05 following social engineering compromise of cloud apps and extortion threats over patient cardiac data.
OT / SCADASiemens and CISA issue advisory ICSA-26-258-07 for CVE-2026-58113 in Teamcenter PLM, where reflected XSS in authentication redirects allows remote attackers to hijack CAD sessions.
AWS CloudAWS resolves high-severity vulnerability CVE-2026-18394 in Strands Agents Tools, where indirect prompt injection forces AI agents to exfiltrate bearer credentials via malicious proxy parameters.
Cyber AttackBiotechnology giant Amgen files SEC Form 8-K Item 1.05 after unauthorized actors infiltrated third-party cloud environments and exfiltrated sensitive patient PHI and clinical research data.
Data BreachThe Reserve Bank of India mandates accelerated 6-hour incident disclosures, board-level oversight, and strict third-party cloud risk controls across banks and financial institutions.
AWS CloudAWS patches medium-severity flaw CVE-2026-89090 in AWS SDK for Go v2, where malformed event stream response frames trigger unrecovered runtime panics and service crashes.
Cyber AttackDental healthcare provider Park Dental Partners files SEC Form 8-K Item 1.05 following unauthorized network intrusion risking patient clinical records and sensitive PII.
Threat IntelCISA advisory ICSA-26-260-01 details hardcoded MQTT credentials across Bransys ELD telematics units, allowing remote adversaries to eavesdrop on live freight telemetry.
Active ExploitZyxel patches actively exploited stack buffer overflow flaw CVE-2026-7273 in GS1900 smart switches, enabling unauthenticated LAN attackers to execute arbitrary code.
Threat IntelCritical path traversal vulnerability CVE-2026-37007 in CrewAI FileWriterTool allows autonomous agents to be manipulated into executing arbitrary code on host systems.
Threat IntelOracle's Critical Security Patch Update fixes maximum-severity CVSS 10.0 flaw CVE-2026-83021 in WebLogic Server Core enabling unauthenticated remote takeover.
MicrosoftMicrosoft patches important command injection flaw CVE-2026-83948 in Azure CLI, requiring customer updates to prevent remote code execution in CI/CD pipelines.
Data BreachOncology medical technology leader Novocure files SEC Form 8-K Item 1.05 disclosing an unauthorized intrusion compromising clinical data and IT infrastructure.
OT / SCADACISA and Rockwell Automation issue advisory ICSA-26-244-03 for ControlLogix and CompactLogix PLCs where CIP message parsing flaws trigger fatal controller crashes.
Threat IntelSecuronix uncovers TASK#STOMP campaign leveraging Living-off-the-Land VBScript stagers, masqueraded Scheduled Tasks, and resilient dual-PowerShell backdoors.
Threat IntelCritical code validation bypass flaw CVE-2026-0768 in Langflow AI orchestration platform allows unauthenticated remote attackers to execute arbitrary system commands.
Check PointHigh-severity vulnerability CVE-2026-50195 in containerd allows privileged containers to poison the host image cache via CRI Checkpoint API tar archive injection.
OT / SCADASiemens issues advisory SSA-330084 for Desigo CC building management systems where improper input validation in graphics files allows arbitrary script execution.
AWS CloudAWS patches vulnerabilities CVE-2026-87912 and CVE-2026-87913 in DevSecOps security agents and Model Context Protocol servers where predictable bucket names permit source code theft.
Cyber AttackBoston Scientific files SEC Form 8-K Item 1.05 disclosing a material cybersecurity incident that caused global manufacturing halts and disrupted medical device supply chains.
Threat IntelCritical CVSS 9.1 flaw CVE-2026-48746 in vLLM allows unauthenticated remote attackers to bypass API key verification and access model completions due to URL normalization defects.