Attackers are actively exploiting CVE-2026-60004, a critical code injection flaw in Gitea that can let authenticated users run arbitrary shell commands on vulnerable servers. Because default Gitea installations allow open registration, unauthenticated attackers can create accounts and repositories to abuse the flaw, prompting CISA to order urgent patching and Gitea to release version 1.27.1. #Gitea #CVE-2026-60004 #CISA
Microsoft is testing new Windows 11 privacy controls that let users manage camera, microphone, and precise location access for individual desktop apps. The company is also preparing smartphone-style permission prompts to improve transparency, consent, and user control over sensitive resources. #Windows11 #Microsoft
Google released Chrome 152 with fixes for 327 vulnerabilities, including 10 critical flaws and 61 high-severity issues, most of which were found internally using AI. External researchers also uncovered important bugs, including a critical vulnerability tracked as CVE-2026-79282, but Google did not report any in-the-wild exploitation. #Chrome152 #CVE-2026-79282 #Goodluck #Google…
MFA is essential, but it only proves control of authenticators at a point in time, not that the person is truly the legitimate identity. Attackers can exploit enrollment, recovery, help desks, session theft, and authenticator replacement to pass MFA while remaining impostors. #NISTDigitalIdentityGuidelines #IdentityThreatDetection #SessionHijacking…
CISA says more than 100 internet-exposed water and wastewater systems were targeted in July, with the attacks linked to Iranian threat actors and aimed at disrupting OT environments. The agency is urging critical infrastructure operators to reduce exposure of PLCs and other ICS devices, especially those reachable through cellular modems or…
Paylogix, a U.S.-based employee benefits management platform, said hackers stole sensitive personal data including Social Security numbers, financial details, health information, and passport numbers. The attack occurred between November 13 and November 18 and was later claimed by the Akira ransomware group in January 2026. #Paylogix #Akira
SC PaderTeG Cabluri Electrice in RO was targeted by the Qilin ransomware group, which encrypted files and disrupted operations. The ransomware claim indicates impact to systems in #Romania
Chaos ransomware has targeted Central Ohio Primary Care (copcp.com), with management in China failing to engage in dialogue following the breach. The “Countdown to Publication” indicates the attackers will proceed with disclosure as leadership remains unresponsive, impacting China#China
A forum user named GordonFreeman is advertising what is claimed to be the complete Chilean electoral roll from SERVEL, covering 13,737,519 citizens in a 3.35 GB .DB file. The post is unverified, includes a 500,000-record sample, and exposes sensitive fields such as RUT, addresses, and polling-place details. #SERVEL #GordonFreeman #Chile…
Nutex Health Inc. disclosed that unauthorized attackers accessed its network, exfiltrated files from some servers, and may have taken confidential information tied to patients, employees, providers, business operations, finances, and intellectual property. The company said it does not currently believe the incident will materially affect its business, while warning that the…
CYFIRMA’s report shows how identity compromise, delegated SaaS access, agentic infrastructure, and data-theft objectives can combine into composable attack surfaces across cases like Vercel/Context.ai, Salesloft/Drift, Taiwan, and EchoLeak. It emphasizes that the Policy/Authorization Control Plane and non-human identity governance are high-leverage defenses, while standards such as AIMS and Cross App Access are emerging to close the gap. #Vercel #Contextai #Salesloft #Drift #EchoLeak #AIMS #CrossAppAccess
The ransomware claim targets MS Walker (mswalker.com), a US-based organization, and blames the Chaos threat actor for the breach with a “countdown to publication” threat. Management’s refusal to engage is cited as the reason for proceeding, ending with the impacted country: #UnitedStates
The ransomware incident involving chaos targeted parkderochie.com in the Netherlands, with Park de Rochie management failing to engage in constructive dialogue regarding the breach. Threat actor chaos issued a countdown to publication amid their refusal to respond, warning of further disclosure affecting the Netherlands. #Netherlands
In February 2024, the ransomware claim targeted industry.airliquide.kr in South Korea, with the threat actor safepay alleging access to systems used by Air Liquide, a longtime provider of essential gases and related technologies to major industries. Air Liquide has operated in South Korea for several decades, and the incident is reported to impact #SouthKorea
CISA’s dual red team assessments showed that both organizations could be fully compromised in AD, cloud, and sensitive business systems, but only Organization B detected and contained the activity quickly. The advisory highlights misconfigured ADCS and MAQ settings, excessive permissions, exposed credentials, and weak cloud token and application controls as the…