All articles
-
Ransomware
UIC confirms ransomware attack on College of Medicine; Booba gang claims 344 GB of stolen data
UIC says ransomware hit parts of its College of Medicine network and attackers took some data from its servers, while the Booba gang claims 344 GB, a figure UIC has not verified.
-
Zero-Days & Exploits
Cisco Secure Email Gateway Flaw CVE-2026-76519 Exploited: Crafted Attachment Can Yield Root Access
Cisco says attackers are exploiting CVE-2026-76519 (CVSS 9.8), which lets an unauthenticated attacker gain root on a Secure Email Gateway with File Reputation enabled by sending a crafted attachment; there is no workaround, and CISA's October 17 KEV deadline has passed.
-
Ransomware
DOJ: MonsterCloud Owner Secretly Paid Ransomware Gangs $8M While Billing Victims $19M
Federal prosecutors allege MonsterCloud owner Zohar Pinhasi sold ransomware victims decryption technology he did not have, secretly paying attackers more than $8 million while billing clients more than $19 million; he has pleaded not guilty to wire fraud charges.
-
Breaches
Oracle Health Breach Tally Reportedly Nears 20 Million After Cerner's Texas AG Filing
A Cerner entry on the Texas Attorney General's breach portal lists 2,992,244 Texans, and news reports put the nationwide count for the 2025 intrusion into legacy Cerner servers at 19,929,149, a total Oracle has not confirmed.
-
Policy & Government
Senate passes health care cyber bill that would write MFA and encryption into HIPAA
The Senate passed S. 3315, the Health Care Cybersecurity and Resiliency Act of 2026, by unanimous consent, sending the House a bill that would direct HHS to require MFA, PHI encryption and penetration testing under the HIPAA Security Rule.
-
Zero-Days & Exploits
Atlassian Data Center File-Read Flaw CVE-2026-21589 Exploited After Public PoC; CISA Adds It to KEV
Attacks began within hours of a public proof of concept for CVE-2026-21589, a CVSS 9.3 unauthenticated file-read flaw in eight self-hosted Atlassian Data Center products, and CISA added it to its Known Exploited Vulnerabilities catalog on Oct 15.
-
Breaches
CenterPoint Energy tells Texas AG 1,062,060 residents hit by breach, a month after its SEC filing
CenterPoint Energy told the Texas Attorney General that 1,062,060 Texans had names, addresses, SSNs and driver's license numbers exposed, a month after an SEC 8-K that disclosed the breach without saying how many people were affected.
-
Breaches
Stolen ConnectWise Cloud Backup credential opened Microsoft 365 tenants; ConnectWise suspends three services
Attackers used a compromised ConnectWise Cloud Backup (formerly SkyKick) app credential to get app-only Graph access to at least 173 Microsoft 365 tenants, prompting ConnectWise to disable seven app identities and suspend Cloud Backup, SaaS Security and Cloud Management.
-
Policy & Government
DOJ charges 14 and FBI raids 40+ Texas laptop farms as FBI warns North Korean IT workers are changing tactics
DOJ unsealed a 14-defendant Ohio indictment over a North Korean remote IT-worker scheme that reached 70+ US employers, the FBI seized about 187 laptops and KVMs from 40+ Texas homes, and a companion FBI PSA says the workers are using more facilitators, smaller laptop farms and extortion.
-
Policy & Government
DOJ Seizes Integrity Tech's MicroScan and FishHub Domains as Joint Advisory AA26-281A Details Flax Typhoon-Linked Tradecraft
The Justice Department and FBI seized domains behind China-based Integrity Tech's MicroScan scanner and FishHub phishing tool on Oct 8, the same day as advisory AA26-281A from 10 agencies in seven countries, which lists exploited CVEs and the mitigations defenders should apply.
-
Zero-Days & Exploits
Ivanti Connect Secure zero-day CVE-2026-104935 chained for root access; third flaw still unpatched
Attackers exploited Ivanti Connect Secure auth bypass CVE-2026-104935 before disclosure, and Volexity says they chained it with a still-unpatched privilege escalation flaw to get root on a fully patched appliance. CISA added it to KEV on Oct 13.
-
Patches & Advisories
Microsoft's record October Patch Tuesday fixes more than 1,400 flaws, including an exploited Mark-of-the-Web bypass
Microsoft's October 13 Patch Tuesday fixed a record of more than 1,400 vulnerabilities. One of them, CVE-2026-96951, is a Windows Shell Mark-of-the-Web bypass that attackers were already exploiting, and CISA added it to the KEV catalog the same day.
Page 3 of 5
