CISA has issued Binding Operational Directive 26-04 to speed up patching across Federal Civilian Executive Branch agencies by setting aggressive remediation deadlines for high-risk vulnerabilities, including some as short as three days. The directive replaces older CISA patching orders and relies on exposure, KEV status, automation potential, and impact level to guide remediation priorities. #CISA #BOD2604 #KnownExploitedVulnerabilities #FCEB
Category: Cyber Security News
South Korea’s Personal Information Protection Commission fined Coupang a record 624.6 billion won after a breach exposed the personal data of about 37.55 million customers. The regulator also penalized Coupang Fulfillment Service and cited weak authentication key management, poor access controls, and multiple violations of data protection rules. #Coupang #CoupangFulfillmentService #PIPC
Siemens says patch files for Desigo CC versions 7 through 9 are being falsely detected as malware by multiple antivirus products, prompting it to work with security vendors to resolve the issue. The company says the affected files, including a PowerShell-based patchHelper component, were verified as unchanged and digitally signed, with…
Threat actors are exploiting CVE-2026-5027, a high-severity path traversal flaw in Langflow that can let unauthenticated attackers write files to arbitrary locations and potentially achieve remote code execution. VulnCheck says the bug is being used in the wild, with test files dropped on victim systems, and that thousands of internet-exposed Langflow…
OnyxC2 is a Malware-as-a-Service stealer sold on a cybercrime network with pricing tiers starting at $250 per month, with a premium option at $500 and a private purchase option for $6,000. BlackFog found that the stealer combines broad credential harvesting, stealth, persistence, and remote-access features to turn one infected workstation into…
The University of Nottingham confirmed that a cyber incident exposed a significant amount of data from its student records system, affecting current students and alumni. ShinyHunters claimed responsibility and said it stole more than 40GB of data, including personal, financial, and campus portal information from Nottingham and its Malaysia and China campuses. #UniversityofNottingham #ShinyHunters #PeopleSoft #HaveIBeenPwned
Microsoft has fixed a known issue that could cause some Windows Server 2025 devices and a subset of Windows 11 systems to boot into BitLocker recovery after installing the April 2026 security update. The bug affected specific TPM and PCR7 validation configurations, and Microsoft resolved it in KB5094125 and KB5093998 while advising admins on mitigation steps for impacted deployments. #Microsoft #WindowsServer2025 #Windows11 #BitLocker #TPM #PCR7 #KB5094125 #KB5093998
Attackers are actively exploiting CVE-2026-10520, a maximum-severity Ivanti Sentry OS command injection flaw that can grant root code execution on Internet-exposed gateways. Shadowserver says many exposed devices may already be backdoored, even though Ivanti initially reported no evidence of in-the-wild exploitation. #Ivanti #Sentry #CVE-2026-10520 #Shadowserver
Microsoft released fixes for more than 200 security flaws in its largest Patch Tuesday ever, as AI-driven vulnerability discovery accelerates the pace of disclosures. The update includes a critical wormable Windows flaw, an actively exploited Microsoft Defender bug, and a BitLocker bypass tied to the researcher known as Nightmare Eclipse. #Microsoft…
A cyberattack has disrupted Mackay Sugar’s operations in Queensland, forcing the shutdown of its Farleigh and Racecourse mills and halting sugarcane harvesting in the Mackay region. The company is working with cybersecurity experts and local authorities to restore systems safely while keeping employees, growers, and business partners informed. #MackaySugar #FarleighMill #RacecourseMill…
CISA has issued a new binding operational directive requiring federal civilian agencies to patch certain high-risk vulnerabilities within 72 hours, using four criteria that assess exposure, exploitation, automation, and attacker control. The move is designed to help agencies respond faster to threats amplified by AI, while CISA also urges state, local,…
Miasma, a credential-stealing attack framework tied to supply-chain attacks, was briefly open-sourced on GitHub after being leaked through compromised developer accounts. It evolves from Shai-Hulud, steals cloud and build credentials, and uses GitHub to spread trojanized packages across ecosystems like npm, PyPI, RubyGems, and JFrog Artifactory. #Miasma #ShaiHulud #GitHub #npm #PyPI #RubyGems #JFrogArtifactory
Attackers are exploiting CVE-2026-5027 in Langflow to write arbitrary files on exposed servers by abusing a path traversal flaw in the file upload endpoint. Researchers say unauthenticated access makes exploitation easier, and users should upgrade to the latest patched release. #CVE-2026-5027 #Langflow #Tenable #Snyk #VulnCheck #CaitlinCondon #Censys
Langflow is being actively exploited in the wild through CVE-2026-5027, a high-severity path traversal flaw that can let attackers write files to arbitrary locations and potentially achieve remote code execution. The issue affects publicly exposed Langflow instances, and exploitation activity adds to a series of recent attacks against Langflow vulnerabilities, including…
Fortinet, Ivanti, and SAP have issued urgent security updates for multiple critical flaws that could enable remote code execution, authentication bypass, and information disclosure. The affected products include FortiSandbox, Ivanti Sentry, and several SAP platforms, with no evidence yet of in-the-wild exploitation. #FortiSandbox #IvantiSentry #SAPNetWeaver #SAPCommerceCloud #SAPDataHub…