Sweden’s IMY fined Miljödata $183,000 after finding that inadequate security measures contributed to a 2025 breach affecting 2.2 million people and exposing highly sensitive personal data. The attack, attributed to the “Datacarry” threat actor, disrupted services across more than 200 regions and is now linked to further investigations into affected municipalities and one region. #Miljödata #IMY #Datacarry #GDPR

Varonis Threat Labs developed TrustSink, an attack that abuses Microsoft Entra’s external MFA provider model to steal passwords during a normal sign-in flow. The technique requires a previously compromised highly privileged account and can persist until the rogue provider is removed, even if victims reset their passwords. #TrustSink #MicrosoftEntra #VaronisThreatLabs #MFA

Microsoft disrupted EvilTokens, an AI-powered phishing service that helped criminals automate account compromise, inbox analysis, and fraud targeting. Working with U.K. police and multiple partners, Microsoft seized infrastructure, enabled arrests, and said the platform had affected thousands of email accounts worldwide. #EvilTokens #Microsoft #MetropolitanPoliceService #HealthISAC #Cloudflare #Coinbase #TheShadowserverFoundation #TRMLabs…

Canada’s Privacy Commissioner Philippe Dufresne has launched an investigation into IDScan.net after reports that attackers accessed company databases and stole personal data, including scans of 153 million driver’s licenses. The probe will examine IDScan’s security practices and whether its customer notifications complied with Canada’s federal private-sector privacy law. #IDScan.net #PhilippeDufresne #BrianKrebs…

A malicious npm package named tw-pkgprobe-7731 disguised itself as a Twilio security research tool while attempting to collect environment data and sensitive credentials from developers. Later versions expanded to target Twilio account SIDs and Auth Tokens, exposing Twilio-related hosts and AWS metadata in the process. #tw-pkgprobe-7731 #Twilio #HackerOne #AUTH_TOKEN #ACCOUNT_SID…

Elsevier’s main website and two portals were briefly redirected to a page branded “LAPSUS$ GROUP, Chapter II,” which included a taunting statement and a countdown to another alleged victim. Researchers say the incident likely involved a DNS or CDN edge change, but Elsevier has not yet explained how it happened or confirmed whether user data was exposed. #Elsevier #LAPSUS$

Volexity found the Chinese threat group UTA0565 exploiting a chain of zero-day vulnerabilities in Chrome and Microsoft products across multiple phishing campaigns. The group used fake websites, spoofed domains, and a previously undocumented malware family called CLEANGULP to target Asian government entities and other organizations. #UTA0565 #CVE-2026-85046 #CVE-2026-87491 #CVE-2026-85880 #CLEANGULP #Chow_Hang-tung

Rep. Josh Gottheimer introduced the AI Cyber Defense Act to create a CISA test program that would give critical infrastructure operators free access to frontier AI models for defending their systems. The bill is aimed at helping water and other essential facilities detect, test for, and remediate vulnerabilities, with priority for nonprofit, publicly owned, rural, and small organizations. #AICyberDefenseAct #CISA #JoshGottheimer

Check Point Software released emergency hotfixes for CVE-2026-93616, a critical path traversal flaw in Security Management Server products that allowed unauthenticated attackers to upload and run arbitrary scripts. The company said the issue is being exploited in the wild and urged customers to patch immediately or apply temporary mitigations while checking for signs of compromise. #CheckPoint #CVE-2026-93616 #SecurityManagementServer #SmartConsole

Shadow IT creates visibility gaps when unmanaged endpoints, unapproved software, and devices outside standard monitoring escape notice, and network discovery alone often fails to reveal them. Wazuh closes this blind spot by collecting endpoint inventory, supporting agentless monitoring, and correlating asset data with vulnerabilities and policy to uncover unauthorized applications and monitoring gaps. #Wazuh

ClosedQuorum is a new Windows malware that uses Google Gemini, DeepSeek, Qwen, and Mistral AI to autonomously choose post-compromise actions without human operator commands. Cisco Talos says it can steal credentials, inject shellcode, or persist on infected hosts, and that stolen data is exfiltrated through a Discord webhook. #ClosedQuorum #GoogleGemini #DeepSeek #Qwen #Mistral #CiscoTalos

ShinyHunters claims it breached FBI systems by exploiting an unpatched Oracle PeopleSoft zero-day, then moved into FBI-managed AWS GovCloud infrastructure and stole sensitive employee and applicant data. The group also says it defaced the FBI Jobs site, targeted additional organizations with the same flaw, and framed the intrusion as retaliation over an FBI FLASH report. #ShinyHunters #OraclePeopleSoft #FBI #AWSGovCloud #KashPatel

WordPress has patched CVE-2026-87902, a critical core flaw that could let an unauthenticated attacker load a PHP file from outside a theme folder and, on some servers, potentially execute code. Site owners running any affected version from 4.7.0 through 7.1.1 are urged to update immediately to the fixed releases, including WordPress…