Cybersecurity

Japan's GMO urges customers to shut down PCs amid ransomware threat

The GMO Group has urged customers to disconnect their systems from the internet and shut down computers after a threat actor who breached the company's Onamae Desktop Cloud threatened to launch a ransomware attack today.

UNM Health ransomware attack disrupts patient care, surgeries

The University of New Mexico Health Sciences Center disclosed a cyberattack that caused system outages and disrupted patient care and academic activities.

Hackers hijack Convertr analytics script to steal payment card data

A credit card skimming group reportedly compromised a shared analytics script used by e-commerce platform Convertr to steal shoppers' payment data during checkout.

CyberStrikeAI Uses 44 AI Agents to Automate Hacking Operations Against Japan Targets

Cybersecurity researchers have disclosed details of three cyber attacks targeting organizations in Japan in which artificial intelligence (AI) was a key element, either in the driving seat or to assist a human operator.

Microsoft releases Windows OOB updates to distrust eMudhra certificates

Microsoft has released out-of-band (OOB) Windows updates to remove trust in certificates tied to compromised eMudhra certificate authority keys, protecting systems that do not receive automatic certificate trust updates.

Warp discloses breach exposing AI agent logs, user telemetry data

Agent decision logs and telemetry data belonging to Warp agentic development environment users were exposed in an attack on a third-party vendor in the project's infrastructure.

Day 2 of canceled classes at University of New Mexico after Health Sciences Center cyberattack

University hospitals once again accepting patients after initial ambulance diversion, but recovery to continue in phases

Tailscale Rushes Patches After Uncoordinated Disclosure of ‘Tailworm’ Flaws

Tailscale is preparing a patch for Tailscale SSH flaws whose details went public over the weekend, before any fixes had been released.

PHP2Shell: US updates Kev catalogue as exploits spread

After live exploitation of PHP2Shell was verified at the weekend, the US' Cisa cyber agency updates its vulnerability catalogue, urging organisations to prioritise their fixes.

The Huntress Tragic Quadrant: Ranking Threats Hitting Businesses Hardest

Attackers are increasingly abusing legitimate IT tools, Microsoft 365 sessions, and everyday workflows to compromise businesses without triggering traditional defenses.

Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens

Microsoft has fixed a flaw in its Authenticator app for Android that let a malicious app with no permissions pose as a trusted Microsoft app, such as Teams, and collect sign-in tokens for a victim's work account.

Apple backports CoreGraphics zero-day patches to older iPhones

​Apple has backported security patches released last month to older iPhones and iPads, addressing a zero-day bug exploited in "extremely sophisticated" targeted attacks on iOS devices.

Also: The Hacker News

CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday confirmed active exploitation of the recently patched PHP2Shell flaws by adding them to its Known Exploited Vulnerabilities (KEV) catalog.

Cybersecurity Issue Forces a Major New Mexico Hospital to Divert Patients and Close Clinics

The University of New Mexico Health System told people not to show up at its main hospital in Albuquerque and canceled appointments at more than 30 clinics.

Japanese virtual desktop cloud hacked so hard it asks to be banned

CEO admits service used for foreign exchange trading had holes company was slow to fix

University of Copenhagen data breach exposes data of 525,000 people

The University of Copenhagen in Denmark confirmed that hackers accessed one of its test environments containing personal data belonging to 525,000 people.

Former pentester used ARTEX AI to steal 8.2 million data records

South Korean police identified seven suspects linked to a cybercrime operation that breached more than 90 organizations in the country, with ARTEX AI pentesting framework used in most of the attacks.

DreamHost forces password resets in ongoing "incident"

DreamHost has forced password resets for email and FTP/SFTP users following an incident that disrupted connections to the File Manager interface.

Hackers Infect 953 Online Stores With Scanner-Evading JavaScript, Mostly on Magento

An unknown threat actor has infected 953 online stores, most of them running Magento, as part of a long-running campaign active since July 2025.

PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw

PHP has rebuilt its official Windows packages for PHP 8.2 through 8.5 to fix CVE-2026-111497, a flaw in the Brotli compression library that the packages include. The flaw can let an attacker corrupt memory and potentially run code.

Critical 'HTTP2Shell' Brotli vulnerability triggers emergency patches

A critical flaw dubbed 'HTTP2Shell' in Brotli, the C decoder library built into Node.js, could allow attackers to corrupt memory and access sensitive data.

Attackers Use Microsoft Teams IT Support Scams to Deploy Malware and Ransomware

Cybersecurity researchers are calling attention to what they say is a "recurring social engineering pattern" across hundreds of cases in which threat actors use Microsoft Teams' external chat creation feature to conduct impersonation scams…

Industrial Vendors Check Products for PHP2Shell Vulnerabilities

Siemens, Schneider Electric, ABB and others have confirmed that some of their products are affected by the PHP2Shell vulnerabilities.

Genesys Hack Exposes Customer Data From Internal Systems

The Genesys Cloud, Genesys Engage, and Genesys Engage Cloud platforms were not affected.