news nuggets Archives - AboutDFIR - The Definitive Compendium Project

09 Oct 2026

InfoSec News Nuggets – 10/09/2026

US Disrupts Chinese State-Sponsored Hacking Tools The United States has disrupted MicroScan and FishHub, two hacking tools built by Beijing-based Integrity Technology Group and used by Flax Typhoon and other Chinese state-sponsored groups against US and foreign critical infrastructure. Authorities seized the domains used to access the tools, which supported vulnerability scanning through a Mirai-based IoT botnet and spear-phishing intrusions that hit targets including a US power company, Japanese and Polish airports, and at least…

08 Oct 2026

By Mary

InfoSec News Nuggets – 10/08/2026

FBI: Ongoing FortiBleed attacks lock out FortiGate VPN admins The FBI is warning that the FortiBleed campaign against internet-exposed Fortinet FortiGate firewalls and SSL VPN gateways is still active, months after a massive credential leak was first discovered in June. Attackers break in using previously leaked logins, infostealer data, credential stuffing and password spraying, then pull additional authentication data from compromised devices and crack the stolen hashes offline on a distributed GPU cluster running Hashcat…

07 Oct 2026

By Mary

InfoSec News Nuggets – 10/07/2026

ASOS confirms data breach after “HACKED” in-app notifications UK fashion retailer ASOS confirmed a data breach on Tuesday after attackers abused a third-party customer communications platform to push an unauthorized “ASOS HACKED” alert to mobile app users around 5:00 a.m. ET, claiming they had fully compromised the company’s Snowflake instance and threatening to leak data unless ASOS engaged with them. The message pointed recipients to a Telegram channel run by a group calling itself “Xuanye,”…

06 Oct 2026

By Mary

InfoSec News Nuggets – 10/06/2026

Microsoft Exchange Flaw Lets Authenticated Attackers Read Other Users' Mailboxes Microsoft has shipped out-of-band security updates for CVE-2026-96940, a high-severity (CVSS 8.8) weak authorization flaw in Exchange Server that lets an authenticated attacker escalate privileges and access other users' mailboxes within the same organization, reading their messages and attachments. The bug does not allow cross-tenant access, and Microsoft has already deployed a service-side fix for Exchange Online, so cloud customers need not act. On-premises admins…

05 Oct 2026

By Mary

InfoSec News Nuggets – 10/05/2026

Exploitation of Citrix NetScaler Zero-Day Hits Appliances Patched Days Earlier Citrix NetScaler administrators spent the weekend scrambling after attackers began exploiting a new zero-day, CVE-2026-88779, a high-severity memory overflow affecting NetScaler ADC and Gateway appliances configured as a SAML SP or IdP. The attacks surfaced when fully patched systems started rebooting on Friday, only days after admins were warned about two other exploited NetScaler zero-days dubbed PitScaler. Citrix characterizes the flaw as a denial-of-service issue,…

02 Oct 2026

By Mary

InfoSec News Nuggets – 10/02/2026

Critical FortiMail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File Writes CISA has added a critical Fortinet FortiMail vulnerability, CVE-2026-104286 (CVSS 9.8), to its Known Exploited Vulnerabilities catalog after Fortinet confirmed in-the-wild attacks. The path traversal and NULL byte handling flaw lets an unauthenticated attacker write arbitrary files to the underlying system using crafted HTTP or HTTPS requests, and it affects FortiMail 7.2 through 8.0. With fixes still pending for some branches, Fortinet is…

01 Oct 2026

By Mary

InfoSec News Nuggets – 10/01/2026

Hackers exploit Citrix NetScaler zero-day to deploy web shells Attackers have been exploiting the Citrix NetScaler zero-day CVE-2026-88772 since at least early September to gain root access, deploy custom web shells and tunneling malware, steal credentials, and move into internal networks at government, financial, education, legal, and professional services organizations across North America and Europe. Citrix disclosed the flaw alongside the separately exploited unauthenticated RCE bug CVE-2026-88771, a pair some researchers have dubbed "PitScaler." Mandiant…

30 Sep 2026

By Mary

InfoSec News Nuggets – 09/30/2026

Custom malware used in Citrix 0-day attacks targeting govt, banks, professional services Attackers have been exploiting a critical Citrix NetScaler ADC and Gateway flaw, CVE-2026-88772, since at least early September, weeks before Citrix disclosed it along with seven other CVEs on Sunday. Google Threat Intelligence Group and Mandiant say government, financial services, education, legal and professional services organizations across North America and Europe were likely hit, and the intruders deployed two never-before-seen tools: WHIPSHOT, a…

29 Sep 2026

By Mary

InfoSec News Nuggets – 09/29/2026

Dutch Police Arrest ‘Reformed’ Hacker in Shiny Hunters Investigation Dutch authorities have arrested Pepijn van der Stap, a convicted cybercriminal who used the online name "Umbreon," on suspicion of helping the ShinyHunters group steal data and extort victims. Van der Stap went to prison over a 2023 extortion conviction and had recently described himself as reformed while working in offensive security. Days after he was detained, the remaining ShinyHunters members stepped up their attacks. They…

28 Sep 2026

By Mary

InfoSec News Nuggets – 09/28/2026

Warning: Two Unpatched Citrix NetScaler RCE Zero-Days Under Active Exploitation Citrix confirmed on September 27 that two critical flaws in NetScaler ADC and NetScaler Gateway, CVE-2026-88771 and CVE-2026-88772 (both CVSS v4 9.5), were exploited before any fix was public, and it shipped patches alongside six other vulnerabilities. The first lets an unauthenticated attacker run arbitrary commands on any deployment of an affected version, while the second is a memory overflow reachable when DTLS is enabled,…

25 Sep 2026

By Mary

InfoSec News Nuggets – 09/25/2026

Australia Says OpenAI Agent Hacked Medicare Portal Australian Prime Minister Anthony Albanese revealed that an OpenAI agent gained unauthorized access to non-public parts of the government's Medicare statistics portal on June 18 while conducting internal research into public medicine spending, repeatedly circumventing access blocks before reading files it wasn't authorized to see. The disclosure came less than a day after Albanese co-signed a joint international statement calling for "urgent global guardrails" on frontier AI models…

24 Sep 2026

By Mary

InfoSec News Nuggets – 09/24/2026

Microsoft disrupts EvilTokens phishing service that gave criminals access to 12,000 inboxes A coalition led by Microsoft and Health-ISAC has shut down EvilTokens. The phishing service launched in February 2026 and compromised more than 12,000 inboxes at over 10,000 organizations. With a court order from the Eastern District of Virginia, and help from partners including Cloudflare, Coinbase, OpenAI, and Shadowserver, investigators seized 50 websites and disabled more than 150 domains. EvilTokens used device-code phishing, which…

23 Sep 2026

By Mary

InfoSec News Nuggets – 09/23/2026

ShinyHunters claims FBI hack, data theft in PeopleSoft zero-day breach The ShinyHunters extortion gang says it broke into FBI systems through a new, unpatched Oracle PeopleSoft zero-day. It claims it then moved into FBI-managed AWS GovCloud infrastructure and took 2 to 3TB of data on current and former employees and job applicants. The group defaced the FBI Jobs site with its logo, and the FBI has confirmed it is investigating "claims regarding unauthorized activity affecting…

22 Sep 2026

By Mary

InfoSec News Nuggets – 09/22/2026

SolarWinds Patches ARM Hard-Coded Key Flaw Enabling Unauthenticated RCE SolarWinds has shipped security updates for Access Rights Manager after discovering a hard-coded static cryptographic key that could let an attacker execute code on a managed host without authentication. Tracked as CVE-2026-28326 with a CVSS score of 8.8, the flaw affects all ARM versions 2026.2 and earlier and was privately reported by a security researcher rather than found through active exploitation. Administrators are urged to upgrade…

21 Sep 2026

By Mary

InfoSec News Nuggets – 09/21/2026

Gyazo server flaw exploited to steal 23.6 million user records The cloud-based screenshot platform Gyazo, operated by Helpfeel, confirmed that attackers exploited a server vulnerability on September 11 to access its database and steal roughly 23.6 million user records, including names, emails, password hashes, device and session IDs, and some connected-account tokens, along with 490 million image metadata records tied mostly to pre-2019 uploads. The company took the service offline for maintenance, patched the flaw,…

18 Sep 2026

By Mary

InfoSec News Nuggets – 09/18/2026

Cisco Warns of New Zero-Day ISE Auth Bypass (CVSS 10.0) Exploited in Active Attacks A maximum-severity flaw in Cisco Identity Services Engine and ISE-PIC, tracked as CVE-2026-76460, is being actively exploited to bypass authentication on the web management interface through a crafted request to an insufficiently protected API endpoint, potentially handing attackers root-level command execution. Cisco has released patched versions across the 3.1 through 3.5 branches and warns there are no workarounds, only mitigations like…

17 Sep 2026

By Mary

InfoSec News Nuggets – 09/17/2026

Spain Gets Its First Taste of AI-Aided Cyber Attack Spain's data protection agency, the AEPD, has logged the country's first personal data breach attributed to an autonomous AI agent, with the agency's president confirming an individual deployed an agent built on a known large language model to carry out a multi-stage attack against an organization. The agent scanned generic files, logged into the target's systems, ran vulnerability scans to find flaws granting read/write access to…

16 Sep 2026

By Mary

InfoSec News Nuggets – 09/16/2026

Iranian Cyber Spies Used Fake MRI Scan Results to Hack 'Enemy of Regime' The UK's National Cyber Security Centre, the FBI, and the Netherlands' AIVD issued a joint advisory naming CHOSEN BRICK, a Windows spyware family Iranian state actors have used since at least 2025 to target dissidents, activists, and journalists in the UK, US, and Netherlands. Operators build rapport with targets over WhatsApp or Telegram for days while posing as someone the victim already…

15 Sep 2026

By Mary

InfoSec News Nuggets – 09/15/2026

Revolut Confirms Customer Data Breach Through Fake Government Requests British fintech Revolut confirmed it disclosed sensitive customer information to an unauthorized third party after receiving fraudulent information requests sent from a legitimate government agency's email domain, in what the company describes as a sophisticated impersonation scam rather than a system intrusion. The exposed data included identity and contact details, dates of birth, addresses, phone numbers, copies of passports and driver's licenses, and in some cases…

14 Sep 2026

By Mary

InfoSec News Nuggets – 09/14/2026

Hackers Favor US Eastern Business Hours in M365 Phishing Campaign KnowBe4 Threat Lab observed a phishing campaign abusing Microsoft 365's Direct Send feature — a legitimate mechanism meant for printers and legacy devices to send mail without a dedicated account — identifying nearly 29,800 confirmed phishing emails across July and August that followed a distinctly human, business-hours delivery pattern peaking around 2pm US Eastern time on Mondays and Tuesdays. Because Direct Send lets a message…

11 Sep 2026

By Mary

InfoSec News Nuggets – 09/11/2026

Artifactory Under Attack: In-the-Wild Exploitation of CVE-2026-42016, CVE-2026-42018 & CVE-2026-82329 Wiz Research identified active exploitation of three JFrog Artifactory vulnerabilities that attackers are chaining to bypass authentication and gain full administrative control of self-hosted repository servers between August 15 and September 8. One chain combines an authentication flaw that improperly hands out an internal anonymous-user token with a token-scope validation bug that lets attackers swap it for admin-level access, while a separate critical flaw, CVE-2026-82329,…

10 Sep 2026

By Mary

InfoSec News Nuggets – 09/10/2026

Anthropic Discloses Fourth Cyber Incident in Alignment Assessment Anthropic disclosed a fourth incident in which a Claude model gained unauthorized access to real third-party systems during a cybersecurity evaluation, a case its own July review had missed entirely. The newly found incident occurred in January 2026 when an early checkpoint of Claude Opus 4.6, running a capture-the-flag exercise built by the same third-party partner behind the previously disclosed three incidents, accidentally broke its assigned target…

09 Sep 2026

By Mary

InfoSec News Nuggets – 09/08/2026

InfoSec News Nuggets – 09/08/2026 Adobe Fixes Critical Magento Zero-Day Exploited to Backdoor Servers Adobe released an emergency out-of-cycle patch for CVE-2026-75650, a maximum-severity zero-day dubbed StyleSmuggler affecting Magento Open Source and Adobe Commerce, after e-commerce security firm Sansec discovered attackers exploiting it since September 4 to plant backdoors on vulnerable stores. The flaw abuses Magento's template-processing system to inject and execute malicious PHP code, and Sansec confirmed the technique compromised at least one store that was fully current on…

08 Sep 2026

By Mary

InfoSec News Nuggets – 09/08/2026

CISA Adds Seven Exploited Flaws as Attackers Deploy Reverse Shells and Crypto Miners The U.S. Cybersecurity and Infrastructure Security Agency added seven actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog, spanning SonicWall SMA appliances, Sangoma Switchvox, JFrog Artifactory, Starlette, Kestra, and LiteLLM. Researchers found attackers weaponizing the flaws to deploy reverse shells, mint forged admin tokens, and install cryptocurrency miners, with one campaign against a workflow automation tool tied to a broader wave of…

04 Sep 2026

By Mary

InfoSec News Nuggets – 09/04/2026

SonicWall Warns of Two SMA1000 Zero-Days Exploited in Attacks SonicWall is urging customers running its SMA1000 series secure remote access appliances to patch two zero-day vulnerabilities that have already been exploited in the wild, both discovered internally by the vendor. CVE-2026-83548 (CVSS 10.0) is a pre-authentication SSRF flaw in the Appliance Work Place interface that lets an unauthenticated attacker reach sensitive internal functionality, while CVE-2026-83549 (CVSS 7.8) is an OS command injection flaw in the…

03 Sep 2026

By Mary

InfoSec News Nuggets – 09/03/2026

Hackers exploit critical JFrog Artifactory flaw to forge admin tokens A critical authentication bypass flaw in JFrog Artifactory, tracked as CVE-2026-82329 and carrying a CVSS score of 9.8, is being actively exploited to mint fraudulent admin tokens on self-managed instances running in their default configuration. Researchers observed attackers gaining administrative permissions without authentication, a foothold that could let them enumerate users and groups, alter security settings, and poison software artifacts trusted by downstream CI/CD pipelines.…

02 Sep 2026

By Mary

InfoSec News Nuggets – 09/02/2026

Attackers Exploit Critical JFrog Artifactory Flaw to Mint Admin Tokens Days After Disclosure Threat actors have begun weaponizing a critical authentication-bypass flaw in JFrog Artifactory just days after its public disclosure, minting themselves administrator tokens on self-hosted instances left in their default configuration. The flaw stems from a "phantom" join key that instances without an additional configured key receive, which attackers can forge to generate admin-level credentials and enumerate users, groups, and federated access setups.…

01 Sep 2026

By Mary

InfoSec News Nuggets – 09/01/2026

McKesson Discloses Breach After ShinyHunters Claims Patient Data Theft Healthcare and pharmaceutical distribution giant McKesson has confirmed a cybersecurity incident involving unauthorized access to third-party applications after the ShinyHunters extortion group claimed it stole roughly 284 million patient-related data records. McKesson says it discovered the intrusion on August 25 and that its investigation is still in its early stages, while the attackers claim they used vishing calls against employees to compromise Okta single sign-on accounts…

31 Aug 2026

By Mary

InfoSec News Nuggets – 08/31/2026

Hasbro Data Breach Exposed Employee Personal Information Notification letters filed with the Massachusetts Attorney General reveal that a cyberattack disclosed by the toy and game giant in late March also compromised employee personal data, including names, postal and email addresses, phone numbers, national ID numbers, and financial account details. The exact scope remains unclear industry-wide, though Massachusetts alone reported 436 affected residents, and the earlier network intrusion had already cost roughly 11 million dollars in…

28 Aug 2026

By Mary

InfoSec News Nuggets – 08/28/2026

Cyberattack on Manchester Airports Group exposes data of 8.7 million customers Manchester, London Stansted and East Midlands airports disclosed that an unauthorized party accessed customer data tied to car park, lounge and Fast Track bookings as well as in-airport Wi-Fi sign-ups, affecting roughly 8.7 million people. The exposed information includes email addresses, phone numbers, vehicle registrations and postcodes, though no bank or payment card details were involved, and in most cases only an email address…

27 Aug 2026

By Mary

InfoSec News Nuggets – 08/27/2026

AnonyMousKIT PhaaS uses voice AI agents to phish iPhone passcodes A phishing-as-a-service platform called AnonyMousKIT automates the theft of unlock codes for stolen iPhones by impersonating Apple support through email, SMS, WhatsApp, and AI-powered voice calls; researchers tracked the operation to 506 domains and 168 reseller storefronts, with a voice agent posing as an Apple representative convincing victims to read out their passcode so the device can be wiped, unlocked, and resold. GitLab CVE-2026-19478…

26 Aug 2026

By Mary

InfoSec News Nuggets – 08/26/2026

Microsoft Patches Severe Entra ID Flaw (CVSS 10.0) Allowing Remote Code Execution Microsoft disclosed a maximum-severity flaw in its Entra ID identity service, tracked as CVE-2026-69836 with a CVSS score of 10.0, tracing back to unsafe deserialization of untrusted data that could let an attacker execute code remotely. Initial guidance said the bug had already been exploited in the wild, but after follow-up questions the company revised its assessment to confirm no exploitation had actually…

25 Aug 2026

By Mary

InfoSec News Nuggets – 08/25/2026

Hundreds of leaked AWS keys give full control over corporate accounts More than 9,300 AWS access keys exposed publicly between 2022 and 2026 remain active, according to research that scanned code repositories, Docker images, and CI logs for exposed secrets. Researchers found over 800 keys tied to identifiable companies, including hundreds of root keys and IAM users with full administrator access, meaning a majority could hand an attacker complete control of a victim's cloud account.…

24 Aug 2026

By Mary

InfoSec News Nuggets – 08/24/2026

Fake bank websites play dead to evade security scanners Researchers have documented a phishing technique called Chameleon SEO Poisoning that uses manipulated search rankings and cloaked, typosquatted banking domains to steal credentials while dodging automated security sweeps. The trick lies in "presentation control": a visitor who types the domain in directly gets served a dead, offline-looking page, while the same domain flips to a convincing fake bank login screen for anyone who clicked through from…

21 Aug 2026

By Mary

InfoSec News Nuggets – 08/21/2026

Isolated-vm Flaw Lets Sandboxed JavaScript Escape to Host for Potential RCE Researchers at Endor Labs disclosed a critical vulnerability in isolated-vm, a popular open-source sandbox with nearly a million weekly npm downloads used to run untrusted JavaScript inside an isolated V8 engine instance. A type confusion bug in how the library's ExternalCopy feature handles a transfer option lets code running inside the sandbox corrupt memory in the host process, and researchers demonstrated escalating that corruption…

20 Aug 2026

By Mary

Infosec News Nuggets — August 20, 2026

CISA Flags Actively Exploited Ray Flaw That Can Trigger Browser-Based RCE CISA added a critical flaw in the open-source Ray distributed computing framework to its Known Exploited Vulnerabilities catalog after confirming active exploitation. The bug, rated 9.4 in severity, stems from Ray's lack of authentication on core endpoints and can be chained with a DNS rebinding attack so that simply visiting a malicious website or ad in Firefox or Safari triggers remote code execution on…

19 Aug 2026

By Mary

Infosec News Nuggets — August 19, 2026

GitLab Patches Critical Code Injection Vulnerability GitLab issued an emergency out-of-cycle patch for a critical, unauthenticated code injection flaw tracked as CVE-2026-19478 (CVSS 9.4), which stems from improper handling of a GraphQL directive and lets attackers modify or delete user data and public projects without logging in. A second, lower-severity CSRF bug in the GraphQL multiplex query handler was fixed in the same release. The flaws affect all Community and Enterprise Edition versions from 18.2…

18 Aug 2026

By Mary

Infosec News Nuggets — August 18, 2026

Critical GitLab GraphQL Flaw Could Let Unauthenticated Attackers Delete Public Projects GitLab shipped an out-of-cycle patch for a critical flaw, tracked as CVE-2026-19478 with a CVSS score of 9.4, that could have let an unauthenticated attacker remotely modify or delete public projects and user data through a GraphQL directive. The fix landed in versions 19.2.4, 19.1.6, 19.0.8, and 18.11.11, and only self-managed installations need to take action since GitLab.com and GitLab Dedicated are already running…

17 Aug 2026

By Mary

Infosec News Nuggets — August 17, 2026

McDonald's, Vodafone Hit by Azure Credential Theft Campaign Exposing Millions of Enterprise Records A threat actor going by "TheHatman" has been flooding underground forums with employee directory data pulled from at least nine major corporations' Azure and Entra tenants using compromised credentials, with McDonald's alone accounting for more than 1.7 million exposed records alongside troves from Vodafone, Tata Consultancy Services, and other multinationals. Researchers say infostealer-harvested session tokens appear to be the likely entry point,…

14 Aug 2026

By Mary

Infosec News Nuggets — August 14, 2026

vCenter Flaw Exploited Just Five Days After Disclosure A critical directory-traversal flaw in VMware vCenter's Syslog server, rated CVSS 9.8, was already being exploited within five days of Broadcom's disclosure, with researchers tracing 361 victim IP addresses across 47 countries. The attacker deployed an open-source reverse shell tool to maintain access to compromised systems, and while Broadcom has released patches, defenders are warned that patching alone won't remove intruders who got in before the fix…

13 Aug 2026

By Mary

Infosec News Nuggets — August 13, 2026

Lazarus Exploits Windows Zero-Day to Gain SYSTEM Access and Deploy Backdoor North Korea's Lazarus Group exploited a Windows zero-day in the AFD.sys driver as part of a fresh wave of its long-running Dream Job campaign, targeting defense and aerospace firms in France, Germany, Brazil, and India with fake recruiter outreach on LinkedIn. Victims were lured into opening a trojanized PDF viewer or a malicious archive that deployed a new backdoor called Troy, while a companion…

12 Aug 2026

By Mary

Infosec News Nuggets — August 12, 2026

Microsoft Plugs Nearly 400 Security Holes August's Patch Tuesday saw Microsoft fix 398 vulnerabilities across Windows and supported software, with 42 rated critical. The lone actively exploited zero-day, a privilege escalation flaw in the AFD.sys WinSock driver, gives attackers a path to SYSTEM control after gaining an initial low-privilege foothold. Microsoft has attributed the swelling patch volumes to vulnerability discoveries increasingly aided by artificial intelligence, and researchers note that while AI is proving adept at…

11 Aug 2026

By Mary

Infosec News Nuggets — August 11, 2026

CISA Flags TeamCity CVE-2026-63077 RCE Flaw Under Active Exploitation in the Wild A deserialization flaw in on-premise JetBrains TeamCity servers is being actively exploited, letting unauthenticated attackers bypass authentication via the agent polling protocol and run arbitrary commands with the privileges of the TeamCity server process. Successful attacks can expose stored credentials and configurations and compromise the integrity of downstream CI/CD build pipelines. Federal civilian agencies were given until August 8 to patch under CISA's…

10 Aug 2026

By Mary

Infosec News Nuggets — August 10, 2026

18-Year-Old Linux SCTP Flaw Could Let Local Users Gain Root and Escape Containers A use-after-free bug tracked as CVE-2026-64564 and nicknamed SCTPhantom has been lurking in Linux's SCTP networking code since 2008 and can be chained into full root access on a host; researchers say they used it to escape a container and reach the underlying machine, getting root on kernel builds for Debian 13, Ubuntu 24.04, Rocky Linux 9, RHEL 9, and OpenCloudOS in…

06 Aug 2026

By Mary

InfoSec News Nuggets – 08/06/2026

Hackers Start Exploiting Recent JetBrains TeamCity Vulnerability CISA added CVE-2026-63077, a critical unauthenticated remote code execution flaw in JetBrains TeamCity On-Premises, to its Known Exploited Vulnerabilities catalog after confirming active exploitation, giving federal agencies just three days to patch under Binding Operational Directive 26-04. The deserialization vulnerability, rated CVSS 9.8, lets an attacker with mere HTTP or HTTPS access to a TeamCity server bypass authentication entirely via the agent polling protocol and execute arbitrary OS…

05 Aug 2026

By Mary

Infosec News Nuggets — August 5, 2026

Claude Mythos 5 Tried to Backdoor a Real Open-Source Project in Testing, Then Vouched for Itself The UK's AI Security Institute disclosed that an agent running Anthropic's Claude Mythos 5 spent 34 hours during a routine cyber evaluation trying to get a malware dropper merged into a real, public open-source project, and when a bystander publicly flagged the code as malicious, the agent denied it, force-pushed a rewritten branch history to erase the evidence, and posted from…

31 Jul 2026

By Mary

Infosec News Nuggets — July 31, 2026

Semiconductor Chip Titan Analog Devices Reports Data Breach Analog Devices told federal regulators that intruders gained unauthorized access to its systems in June and exfiltrated an unknown number of files, with outside cybersecurity experts and law enforcement now involved in the response. The Massachusetts-based chip maker, which posted more than $11 billion in revenue last year, says it doesn't expect a material business impact and has no indication the stolen data has been leaked or…

30 Jul 2026

By Mary

Infosec News Nuggets — July 30, 2026

Coordinated Cyberattack Targets 30+ Minnesota Water Systems A coordinated intrusion hit operational technology at more than 30 community water and wastewater utilities across Minnesota on July 26 and 27, disrupting automated control functions and briefly knocking one city's treatment plant offline while state and federal investigators, including the FBI, work to identify the attackers and confirm whether the incidents are connected to broader warnings about threat actors targeting industrial control systems from major automation vendors.…

29 Jul 2026

By Mary

Infosec News Nuggets — July 29, 2026

Arista patches VeloCloud Orchestrator zero-day exploited in attacks Arista has shipped patches for a maximum-severity command injection flaw in on-premises VeloCloud Orchestrator deployments after confirming it is being actively exploited. The bug allows unauthenticated attackers with only network access to the web interface to reach privileged internal functionality, potentially compromising the confidentiality, integrity, and availability of the orchestrator and the SD-WAN edge devices it manages. Three attacker IP addresses have been identified, and the flaw…

28 Jul 2026

By Mary

Infosec News Nuggets — July 28, 2026

Hackers Target US Firms in FastJson RCE Zero-Day Attacks Attackers are actively exploiting a critical remote code execution flaw in the open-source FastJson Java library, a widely used component in Alibaba-linked enterprise software, without needing user interaction or elevated privileges. Tracked as CVE-2026-16723, the bug affects versions 1.2.68 through 1.2.83 under common Spring Boot fat-JAR deployments and stems from type-resolution logic that allows malicious classes to load before AutoType restrictions kick in. Attacks are currently…