Cyber-attacks can have a significant impact on the most critical services which society relies on, and it is vital cybersecurity teams are prepared to respond when it happens. In Spring 2025, UK retailers Co-op and Marks & Spencer were both… Read More "Infosecurity Europe: Tabletop to Test Response to Major Cyber-Attack"
Two critical vulnerabilities in the popular AI code editor Cursor could lead to remote code execution on the underlying operating system, Cato Networks reports. The security defects are tracked as CVE-2026-50548 and CVE-2026-50549 (CVSS score of 9.8) and are referred… Read More "Critical Cursor AI Code Editor Flaws Could Lead to OS-Level Remote Code Execution"
Threat actors with ties to North Korea have been linked to a fresh set of malicious npm packages that masquerade as Rollup polyfill tooling to facilitate remote access and data theft. According to JFrog, the packages “rollup-packages-polyfill-core” and “rollup-runtime-polyfill-core” mimic… Read More "North Korea-Linked npm Packages Mimic Rollup Polyfills to Steal Developer Secrets"
The attacks all came from a single source, an IPv6 address range controlled by internet provider LSHIY LLC, Huntress said in a blog post. LSHIY has since terminated access for the customer using the IP addresses involved in the attack.… Read More "Microsoft 365 users fall victim to one-in-a-million password spray attack"
A critical flaw in the open-source AI platform Flowise has been disclosed, along with working proof-of-concept (PoC) code, allowing an attacker to take over a server when a logged-in user simply imports a malicious workflow file. According to new analysis… Read More "Critical Flowise Flaw Gives Attackers Full Server Control"
SecurityWeek’s cybersecurity news weekly roundup offers a concise overview of important developments that may not receive full standalone coverage but remain relevant to the broader threat landscape. This curated summary highlights key stories across vulnerability disclosures, emerging attack methods, policy… Read More "In Other News: Canadian Hacker Jailed, Open Source Zero-Days, Two Sentenced for ATM Jackpotting"
A previously undocumented threat actor known as Armored Likho has been attributed to cyber attacks targeting government agencies and the electric power sector across Russia, Brazil, and Kazakhstan. “Armored Likho blends financially motivated campaigns targeting private individuals with targeted cyber… Read More "Armored Likho Targets Government Agencies, Power Sector with BusySnake Stealer"
As an early indicator of the need for the faster rhythm, it issued two security advisories dealing with a number of critical vulnerabilities on June 30 — the fifth Tuesday of that month: APSB 26-28 and APSB26-29. It is not… Read More "Adobe premieres a second Patch Tuesday each month to deliver fixes faster"
A ransomware group and a cyber-criminal gang which specializes in stealing credentials through supply chain attacks have teamed up in a move which what has been described by cybersecurity researchers as an “unprecedented model of industrialized ransomware.” As detailed by… Read More "Warning Over “Industrialized” Cyber-Attacks by Ransomware Gang"
A dual US-Estonian citizen was extradited to the US to face charges for his alleged involvement in the activities of the infamous hacking group Scattered Spider. The individual, Peter Stokes, 19, also known as ‘Bouquet’, was arrested in Finland in… Read More "Alleged Scattered Spider Hacker Extradited to US"
