Category: Cyber Security News

The European Commission is investigating a security breach after a threat actor accessed at least one Amazon cloud account used to manage its infrastructure and claims to have stolen over 350 GB of data, including multiple databases. The attacker provided screenshots, said it will not extort the Commission but plans to leak the data, and the Commission’s incident response team is probing the incident amid related Ivanti EPMM vulnerabilities that have affected other European institutions. #EuropeanCommission #IvantiEPMM

Agentic GRC automates and replaces manual operational tasks—evidence collection, control testing, remediation and audit workflows—rather than merely accelerating them. This transition frees GRC professionals to apply human judgment to set risk appetite, define what “remediated” means, and translate business context into compliance logic. #Anecdotes #AgenticGRC

The Dutch National Police (Politie) confirmed a phishing attack that had a limited impact and said citizens’ data and investigative information were not exposed. The Security Operations Center detected and blocked the intrusion quickly, and a criminal investigation is underway while authorities continue probing, including a prior 2024 breach linked to a state actor. #DutchNationalPolice #stateactor

Microsoft released preview cumulative update KB5079391 for Windows 11 24H2 and 25H2, delivering 29 non-security changes including Smart App Control and several display and reliability fixes. The optional March 2026 update lets users toggle Smart App Control without reinstalling and adds support for >1000 Hz refresh rates, native USB4 monitors, and other stability improvements. #KB5079391 #SmartAppControl

Bearlyfy, a pro‑Ukrainian group, has been tied to more than 70 cyberattacks against Russian companies since early 2025, evolving from small intrusions using LockBit 3 and Babuk encryptors to high‑value extortion and sabotage. Since March 2026 the group has deployed a proprietary Windows ransomware called GenieLocker and used modified PolyVice components…

CISA has warned U.S. organizations about a critical deserialization vulnerability in PTC’s Windchill and FlexPLM products that can allow remote, unauthenticated attackers to execute arbitrary code. PTC has not released patches yet but has provided mitigations and IoCs, while German authorities’ unprecedented physical alerts suggest exploitation may be imminent. #CVE-2026-4681 #Windchill…

Ransomware attacks against the global energy sector surged in 2025, with 187 confirmed incidents causing system encryption, data theft, operational disruptions, and multimillion-dollar losses. Organized ransomware groups and access brokers exploited legacy OT, IT‑OT convergence, and slow patching—examples include FrostyGoop, RansomHub, and Zerosevengroup. #FrostyGoop #RansomHub #Zerosevengroup #Halliburton #ABB_ASPECT…

The European Union, through ENISA, is moving to bolster and diversify support for the Common Vulnerabilities and Exposures (CVE) program after a contracting scare involving MITRE exposed reliance on a single U.S. government contract. Lawmakers and industry experts are pushing for clearer governance, continuity measures, and higher-quality, machine-readable vulnerability records to…

Apple is requiring iPhone and iPad users in the UK to confirm they are adults before accessing certain services and 18-plus apps as part of the iOS 26.4 update to meet legal requirements. Verification can use existing account data, a linked credit card, or scanning a government ID, and the change…

Researchers disclosed “ShadowPrompt,” a vulnerability in Anthropic’s Claude Chrome extension that allowed any website to silently inject prompts by chaining an overly permissive (*.claude.ai) origin allowlist with a DOM-based XSS in an Arkose Labs CAPTCHA component. The flaw risked exposing access tokens, conversation history, and enabling actions like sending impersonated emails;…

Most teams have security tools and signals that appear healthy, but few consistently test whether those defenses would stop a real attack. The webinar Exposure-Driven Resilience explains how to automate continuous testing driven by real attacker behavior and threat intelligence, with a live demonstration from Jermain Njemanze and Sebastien Miguel. #ExposureDrivenResilience…

Resecurity has identified Nasir Security, a likely Iranian-aligned threat actor that targets vendors and contractors supporting Middle East energy firms to conduct supply chain attacks and psychological operations. By compromising third parties and releasing limited samples while overstating exfiltration volumes, the group amplifies perceived impact and collects authentic infrastructure documents that…

The European Commission has opened a formal DSA child protection investigation into Snapchat to assess whether its age-assurance, default settings, content moderation, and reporting tools adequately protect minors. The probe, part of broader DSA enforcement including actions against adult sites, could lead to remedial measures, commitments, or fines of up to…

A long-running China-nexus campaign attributed to Red Menshen has implanted kernel-level sleeper cells inside telecom networks to conduct espionage against government and subscriber systems. The actor leverages stealthy tools—most notably the Linux backdoor BPFDoor that abuses Berkeley Packet Filter functionality, hides trigger packets in HTTPS, and supports SCTP to monitor telecom…