A critical flaw in Yellow.ai’s chatbot allowed malicious code injection and cookie theft, putting support agent accounts at risk. The vulnerability has been patched.

Termite claims to have exfiltrated News-Press & Gazette data, posting screenshots that show a U.S. passport and employee contact records, heightening identity-theft concerns.

FBI warns that UNC6040 and UNC6395 are exploiting Salesforce through OAuth abuse and stolen tokens to steal corporate data, extort victims, and pivot into cloud ...

ShinyHunters claims to sell 160 million CIC credit records from Vietnam. Researchers verified samples; authorities confirm a breach and opened an investigation.

Retina Group of Florida and Hampton Regional Medical Center disclosed breaches exposing protected health information for approximately 153,000 patients; investigations, notifications, and monitoring are underway ...

ShinyHunters claims 160 million Vietnam credit records stolen from CIC; samples verified by ReSecurity include PII, credit histories, and government IDs with recent timestamps.

Everest ransomware gang claims Allegis Group documents and client lists were taken; screenshots show spreadsheets of 135,000 and 426,000 lines, researchers warn of phishing risks.

Apple has warned users in over 150 countries of mercenary spyware attacks using zero-days and zero-click exploits, urging Lockdown Mode and emergency security assistance.

Microsoft will roll out real-time malicious link warnings for Teams chats in September 2025, adding another security layer to protect enterprise users from phishing and ...

National Cyber Director Sean Cairncross calls for a unified cyber strategy, urging CISA 2015 reauthorization, IT modernization, and stronger deterrence measures to shift risk onto ...

The U.S. Treasury sanctioned 19 Southeast Asian cybercrime networks tied to forced labor, trafficking, and scams that stole over $10 billion from Americans in 2024.

Temu will pay $2 million to settle FTC and DoJ claims it violated the INFORM Consumers Act by failing to disclose seller details and suspicious ...

A major data privacy lapse has rattled the New South Wales (NSW) health system after confidential records of nearly 600 ...

Attackers targeting exposed Docker APIs have upgraded their tools, enabling persistent access, lateral movement, and self-replication—laying the groundwork for a potential large-scale botnet campaign.

Dynatrace confirmed customer data exposure in the Salesforce supply chain breach via Salesloft Drift, joining Cloudflare, Google, and others hit by the Scattered LapSus$ Hunters ...

Wealthsimple confirmed a third-party data breach exposing account numbers, government IDs, and SINs of 30,000 clients. No funds stolen, but identity theft risks remain significant.

External Attack Surface Management gives CISOs continuous visibility into internet-facing assets, prioritizes risks by context, and enables proactive remediation—shrinking exposure before attackers exploit vulnerabilities.

The U.S. charged Ukrainian national Volodymyr Tymoshchuk for administering LockerGoga, MegaCortex, and Nefilim ransomware, linked to hundreds of corporate breaches and millions in damages worldwide.

A major security breach at Salesloft has compromised sensitive information from more than 700 companies, marking one of the largest ...

NSW Health exposed passports, medical credentials, and IDs of nearly 600 doctors, sparking outrage and raising serious risks of identity theft, fraud, and professional impersonation.