Cybersecurity researchers have called attention to an active “widespread email-driven phishing campaign” that employs adversary-in-the-middle (AitM) techniques to take control of Microsoft 365 accounts with an aim to identify key personnel involved in financial workflows and gather related email. “The… Read More "Microsoft 365 AitM Phishing Hijacks Accounts to Collect Payroll and Finance Emails"
Fixing is not the same as securing Instead of simply checking whether the fixed code compiled or passed automated tests, 1Password said it reviewed every generated fix for complete elimination of the vulnerability, preservation of application behavior, and avoidance of… Read More "Human oversight is still critical as AI patching tools miss security risks"
The BlackFile extortion group, which targets its victims through vishing scams, has rebranded. According to an analysis by Google Threat Intelligence Group (GTIG), despite BlackFile (UNC6671) having announced the retirement of its brand in 2026, it had now rebranded to… Read More "Google Links Redact Extortion Group to BlackFile Rebrand"
Black Hat — The National Motor Freight Traffic Association (NMFTA) says a 2024 safety recall for Bendix’s EC80 heavy-truck brake controller quietly fixed a set of serious vulnerabilities, including a wirelessly reachable remote code execution flaw, alongside the memory corruption… Read More "Truck Brake Controller’s Safety Recall Doubled as Hidden Security Fix"
Ravie LakshmananAug 06, 2026Vulnerability / Enterprise Security A newly patched security flaw impacting on-premise versions of JetBrains TeamCity has come under active exploitation in the wild, according to the U.S. Cybersecurity and Infrastructure Security Agency (CISA). The vulnerability in question… Read More "CISA Flags TeamCity CVE-2026-63077 RCE Flaw Under Active Exploitation in the Wild"
AI and ML environments blend development, research, cloud infrastructure, data access, model publishing and automation inside the same workspace. A compromised Python package in a standard web application might steal a database credential. The same attack in an AI development… Read More "Python package security in 2026"
Ransomware attacks surged by 19% in July compared to June, with finance, tech and healthcare industries heavily impacted, new analysis by Comparitech has found. The consumer service firm observed a total of 799 claimed ransomware attacks in July, making it… Read More "Ransomware Surges in July After Q2 Lull"
Unlimited Technology Systems is notifying over 3.8 million individuals that their personal information was stolen in a data breach. Based in Montgomery, Ohio, Unlimited provides advanced financial and revenue cycle technology to healthcare providers and organizations. It claims to be… Read More "3.8 Million Impacted by Unlimited Technology Systems Data Breach"
Ravie LakshmananAug 07, 2026Cybercrime / Vulnerability A new analysis has uncovered that the threat actor tracked as TeamPCP has been active on the cybercrime scene as far back as 2020, indicating the group has been compromising internet-facing infrastructure for years… Read More "TeamPCP Linked To Redis Attacks Dating Back To 2020 And Later Supply Chain Campaign"
The attackers could have simply extracted or manipulated data through SQL injection, but instead, they expanded the exploit to include long-term persistence and remote command execution. Huntress warned that this is a dangerous evolution. Features such as Oracle’s embedded JVM,… Read More "Attackers hid malware inside Oracle Database after SQL injection breach"
