WordPress has released fixes for CVE-2026-65640, a high-severity flaw that could let authenticated attackers execute arbitrary code through malicious PostScript file uploads. The issue affects installations using Imagick and Ghostscript, and WordPress 7.0.4 plus backports to older branches now block the vulnerable file handling path. #WordPress #CVE-2026-65640 #Imagick #Ghostscript…
Hackers began exploiting a critical Adobe Commerce flaw, CVE-2026-71362, almost immediately after Adobe publicly disclosed the issue and issued a patch. Sansec says the vulnerability lets unauthenticated attackers hijack customer sessions and access private account data, affecting Adobe Commerce, Commerce B2B, and Magento Open Source. #CVE-2026-71362 #AdobeCommerce #MagentoOpenSource…
Twenty-one cybersecurity-related merger and acquisition deals were announced in July 2026, led by major moves from Bank of America, Barracuda, Cribl, CrowdStrike, Cyera, Okta, Palo Alto Networks, and Qualcomm. Many of the transactions focused on identity security, exposure management, observability, and AI-driven defense capabilities, with several acquisitions targeting Israeli startups. #MDSec…
A new White House memorandum directs the National Coordination Center to create a program allowing vetted private security firms to seek approval for limited U.S.-authorized cyber operations against foreign cybercrime groups. The initiative is meant to disrupt organizations behind ransomware, phishing, fraud, sextortion, and impersonation scams, while requiring strict legal compliance and financial safeguards. #NationalCoordinationCenter #DonaldTrump #NCC
AI coding assistants are accelerating development, but they are also introducing unvetted or hallucinated dependencies that can lead to slopsquatting and supply-chain compromise. The article argues that enterprises must govern package selection before code reaches the build stage, with ActiveState positioning its curated catalog as a way to block risky dependencies at intake. #ActiveState #PyPI #npm #react-codeshift
Trezor disclosed that nearly 14,000 customers had their personal data exposed after its shipping partner ShipMonk suffered a breach. The stolen information may be used in targeted phishing campaigns impersonating Trezor, banks, or crypto exchanges. #Trezor #ShipMonk
akira ransomware targeted CF Supply, a Texas-based construction products provider, encrypting corporate data including client information (projects, personal data), contracts, and agreements. The incident impacted the United States #UnitedStates
D & J Beverage Service (US) reported a ransomware incident attributed to the Qilin threat actor, resulting in disruption of its systems and potential encryption of data. The company’s services were impacted in #UnitedStates.
dragonforce ransomware targeted GB Group S.A in PL, seeking to disrupt the firm’s operations. The claim involves impact on Haiti through the conglomerate’s activities across multiple industries, #Haiti
President Donald Trump signed a national security memorandum that would let vetted private sector companies support U.S. law enforcement in offensive cyber operations against foreign cyber-enabled transnational criminal organizations. The plan creates a federally overseen program tied to the Department of Justice and Department of Homeland Security, while still requiring compliance with existing laws like the Computer Fraud and Abuse Act. #DonaldTrump #DepartmentOfJustice #DepartmentOfHomelandSecurity #ComputerFraudAndAbuseAct
Waterfall’s OT Cyber Threat Report 2025 shows that physical-consequence OT attacks continued to rise in impact, with a 146% increase in affected sites and 76 incidents in 2024. The report highlights growing nation-state activity, persistent ransomware pressure, and new ICS-capable malware such as FrostyGoop, IOControl, and Fuxnet, with #Sandworm #VoltTyphoon #SaltTyphoon #FrostyGoop #IOControl #Fuxnet #CrowdStrike #Halliburton #Keytronic #StoliGroupUSA.
Fortinet released patches for eight vulnerabilities across FortiWeb, FortiManager, FortiClient for Windows, FortiOS, and FortiSIEM, including high-severity authentication flaws. The company also published guidance on CVE-2026-49975, the HTTP/2 Bomb attack affecting Apache HTTP Server, and noted no signs of active exploitation. #FortiWeb #FortiManager #FortiClient #FortiOS #FortiSIEM #ApacheHTTPServer #CVE-2026-26035 #CVE-2026-70468 #CVE-2026-70465 #CVE-2026-49975…
Team8 announced it has raised $365 million in new capital, including $265 million for its third Team8 Capital fund and $100 million for follow-on investments in top portfolio startups. The firm, known for backing enterprise technology and cybersecurity companies such as Talon, Dig, and Koi, says its latest focus is on…
WhatsApp has started rolling out an optional Scam Alert feature that uses an on-device machine learning model to warn users about likely scam messages without sending message content off the device. The feature is being tested in a limited beta and is part of WhatsApp’s broader effort to protect users from fraud, device-linking scams, and spyware threats. #WhatsApp #ScamAlert #Pegasus #NSOGroup
AiLock ransomware targeted Yaomasa, a Japanese supermarket chain founded in 1919 that also operates TSUTAYA and BOOKOFF franchise stores, encrypting or disrupting its IT environment to extort payment. The incident affected services in #Japan