Varonis Threat Labs disclosed RovoBlast, a one-click attack against Atlassian Rovo that injects attacker-controlled instructions through a crafted link and can make the assistant treat external parameters as trusted session input. The flaw can expose data across Jira, Confluence, Bitbucket, Slack, Microsoft 365, Google Workspace, and other connected systems, and Atlassian…
Unlimited Technology Systems disclosed that a breach of its commercial data center exposed personal and health-related information belonging to 3,803,750 people. The company said unauthorized access occurred for five days in October 2025, and it has not identified the attackers or any public ransomware group claiming the incident. #UnlimitedTechnologySystems
A critical unauthenticated SQL injection flaw in Metabase was actively exploited as a zero-day, giving attackers administrator access to customer instances and enabling data theft from both Metabase Cloud and self-hosted deployments. Framework, Tally, and LexisNexis all reported impacts tied to the incident, with stolen data including customer contact details, login information, and in some cases password hashes. #Metabase #Framework #Tally #LexisNexis
UNC6671 is carrying out vishing-led extortion campaigns against financial services, private equity, and professional services by impersonating IT help desk staff and stealing credentials through fake login portals. The group uses captured sessions to access Microsoft 365 and Okta, exfiltrate cloud data, and operate under multiple extortion brands including Redact, Pink,…
ClickFix-style lures are being used to deliver a Go-based macOS stealer that can harvest browser passwords, Apple iCloud Keychain data, cached credentials, and cryptocurrency holdings. The campaign also uses Aeza Group infrastructure and joins a broader wave of ClickFix attacks tied to MacSync, Atomic Stealer, Lumma Stealer, and Remus. #ClickFix #AezaGroup…
A cluster of nearly 800 malicious npm packages is being used to deliver cross-platform malware that targets Windows, macOS, and Linux through a downloader called WEL1DROPPER and a staged payload delivery process. The campaign, tracked as Flooding Dropper and possibly linked to the earlier Moika operation, also overlaps with other npm…
Genians Security Center researchers uncovered a new APT37 campaign using NarwhalRAT to steal data through keylogging, screen capturing, USB data collection, and remote code execution. The intrusion likely began with spearphishing emails and malicious LNK files, while the operators used a Korean relay server and the pCloud API in a dual C&C structure to support the attack. #APT37 #NarwhalRAT #pCloud
New research from 1Password found that ChatGPT 5.5 and Claude Opus 4.8 often fail to fully patch high-impact vulnerabilities and can introduce new bugs instead. The findings suggest AI-assisted patching still needs human review, even as models like GPT 5.5, GPT-5.6-Sol, and Anthropic’s Mythos are promoted for stronger security capabilities. #ChatGPT #ClaudeOpus #1Password #Veracode #ProjectGlasswing #Daybreak
spacebears is reported to have targeted Hitech Distribuzione Informatica S.r.l. (HTDI), a leading Italian IT solutions provider based in Rome (Via Tempio del Cielo) offering turnkey infrastructure services across design, delivery, installation, integration, and ongoing operations for corporate clients. The ransomware claim implicates HTDI as the victim in Italy’s IT services sector. #Italy
blacknevas ransomware actors claimed to have targeted OTEGROUP, a major Omani business group in Oman with operations across multiple Gulf countries, naming the victim as OTE Group (GR). The group is associated with an extensive automotive, electronics, appliances, and industrial polymer-color-concentrates portfolio, and the claim indicates impact in #Oman
LevelBlue OpsCTI identified a large-scale phishing campaign that impersonates trusted apps and services to trick victims into installing unauthorized ConnectWise ScreenConnect clients through fake update and installation flows. The campaign uses compromised sites, attacker-controlled hosts, Amazon S3, Cloudflare R2, Telegram telemetry, and reused infrastructure artifacts to deliver remote access payloads and expand hunting opportunities. #ConnectWiseScreenConnect #GoogleMeet #MicrosoftStore #AppleAppStore #TelegramBotAPI
Levi Strauss & Co. said attackers used social engineering to access three employees’ company-issued computers and exfiltrate certain corporate information. The company says its rapid response contained the incident, no consumer data was impacted, and some reports have linked the activity to UNC6671. #LeviStrauss #UNC6671
Open source is entering a new phase where enterprises will rely only on projects that can prove they are reachable, maintained, and accountable, while everything else remains open source but outside regulated use. The article argues for a practical “proof of life” model, potential stewardship and retirement paths for projects, and…
WordPress has patched CVE-2026-64638, a pre-authentication reflected XSS flaw in the login screen that affects every version of the CMS and can be chained into PHP code execution under the right conditions. Researchers at pwn.ai demonstrated the attack chain XSS2Shell, but WordPress says real-world escalation still depends on administrator interaction and…
SecurityWeek’s weekly roundup covers major cybersecurity developments, including OpenAI’s disruption of a Cambodia-based scam network, Amgen’s cloud data theft incident, and Apple’s move to limit AI-generated bug bounty noise. It also highlights supply chain compromises, router backdoors, phishing and vishing attacks, and policy efforts targeting Chinese data center components. #OpenAI #Amgen…