Emerging Threats
Anubis Ransomware Targets Adriatic Port, Exposes Maritime Security Gaps
A ransomware attack by the Anubis group on the Adriatic Port Authority exposed significant gaps in maritime security, putting sensitive employee records and critical infrastructure at risk. The breach, which occurred on December 11, 2025, resulted in the loss of around 2% of the authority's data, with some information making its way to the dark web.
Malicious Code Infiltrates WordPress Plugins, Creates Rogue Admin Accounts
Over 1.2 million WordPress sites are at risk after attackers infiltrated a trusted vendor's network, injecting malicious code into popular plugins like OptinMonster, TrustPulse, and PushEngage. This sneaky hack creates rogue admin accounts, putting sites at risk of takeover - all without ordinary visitors even noticing.
Council of Europe Probes ShinyHunters Data Breach Claims
The Council of Europe is actively investigating claims by the ShinyHunters extortion group that sensitive internal documents were stolen, and is working to assess the situation. The organization, which represents 46 European member states, has confirmed the probe but declined to provide further comment at this stage.
Microsoft 365 Copilot Flaw Exposes Sensitive Data to One-Click Attack
A single click on a seemingly trustworthy Microsoft link could have put sensitive information like emails, calendar details, and files at risk of being exposed to attackers, thanks to a flaw in Microsoft 365 Copilot Enterprise Search. This vulnerability, known as SearchLeak, highlights the importance of staying vigilant even with trusted sources.
Novo Nordisk Data Breach Exposes Clinical Trial Information
A recent data breach at Novo Nordisk exposed sensitive clinical trial information, including pseudonymized patient records and healthcare provider contact details, highlighting the importance of robust data security measures. The breach serves as a cautionary tale, reminding us that even seemingly anonymized data can be vulnerable to cyber threats.
FBI Warns of Courier-Based Crypto Scams
Don't fall victim to crypto scams: scammers are now using couriers to collect cash from unsuspecting victims at their homes or in public, often using passwords or specific dollar bill serial numbers to authenticate the pickup. This low-tech twist on investment scams adds a frighteningly personal touch.
Google Patches Actively Exploited Chrome Zero-Day Flaw
Google just issued an emergency patch for a major Chrome vulnerability, CVE-2026-11645, that's already being exploited by hackers - and it's urging users to update their browsers ASAP to stay safe. This latest fix is part of a massive update that tackles 74 Chrome vulnerabilities, including a high-severity zero-day flaw.
Maine Data Breach Portal Disabled After Hoax Reports Flood System
The Maine Attorney General's office has temporarily disabled its data breach portal due to an influx of false reports, which were later confirmed to be hoaxes submitted by an unknown entity. The office is now reviewing its internal procedures to prevent similar abuse in the future.
Chinese hackers breach medical research servers with custom malware
Malicious hackers linked to China breached a North American medical research institution, hiding undetected for over a year and gaining access to sensitive research areas. The attackers used custom malware, known as Infinitered, with broad capabilities to siphon off valuable intel from September 2023 to November 2025.
Arch Linux Cracks Down on Malicious Commits in User Repository
Malicious hackers have launched a massive assault on the Arch User Repository, compromising over 1,500 user-submitted packages and forcing the Arch Linux team to temporarily halt new account signups to contain the damage. The attack has been mitigated, but not before highlighting the vulnerability of community-run package repositories.
Chinese Spies Exploit Medical, Military Networks for Over a Year
Google's Threat Intelligence Group uncovered a sneaky espionage campaign by Chinese spies that infiltrated medical and military networks in North America for over a year, making off with a treasure trove of sensitive data. The group, tracked as UNC6508, targeted top medical providers, academic centers, and military organizations, leaving no stone unturned in their quest for classified information.
Microsoft 365 Copilot Exploited in 1-Click Data Theft Attack
A critical vulnerability in Microsoft 365 Copilot Enterprise, known as SearchLeak, could be exploited with just one click to steal sensitive data from mailboxes, OneDrive, and SharePoint. Fortunately, Microsoft has patched the flaw, CVE-2026-42824, and no user action is required to stay safe.
ShinyHunters Breach Exposes 137,000 Infinite Campus Staff Accounts
A massive data breach at Infinite Campus has exposed the sensitive information of 137,000 staff members, including names, email addresses, phone numbers, and physical addresses, after the ShinyHunters extortion group hacked into the company's Salesforce instance. The stolen data has been published online, putting staff at risk of identity theft and phishing scams.
WordPress Plugins Compromised to Deploy Hidden Backdoors
Over 1.2 million WordPress sites are potentially at risk after a security breach compromised three popular plugins, allowing hackers to secretly install backdoors and gain admin access. The sneaky attack injects malicious code that only kicks in when a logged-in administrator visits the site, putting unsuspecting site owners in the dark.
Chrome Extensions Exploit User Data for Adware, Fake Traffic
Beware of Chrome extensions that seem too good to be true: 152 fake live wallpaper and new-tab add-ons have been downloaded around 105,000 times and are secretly spreading adware and fake traffic. These malicious extensions, masquerading as popular themes, have been hiding in plain sight on the Chrome Web Store.
Maine Disables Breach Database After Fake Reports Flood In
Maine's Attorney General's office has temporarily taken down its public database of data breach reports after being flooded with fake submissions, including hoax reports targeting VRChat and another company. The office is reviewing its procedures to prevent future abuse and plans to reinstate the database with enhanced safeguards.
Palo Alto Networks Warns of Active Exploitation of GlobalProtect VPN Flaw
Palo Alto Networks has warned of active exploitation of a critical GlobalProtect VPN flaw, CVE-2026-0257, which allows attackers to bypass security controls and set up unauthorized VPN connections. The company first observed exploitation attempts on May 17, 2026.
Sniper Dz Scams Target MENA Users with Fake Offers and Browser Exploits
Scammers are targeting people in the Middle East and North Africa with fake offers of free mobile internet, financial rewards, and government subsidies, using fraudulent Facebook accounts to trick victims into divulging sensitive info. These Sniper Dz scams impersonate trusted figures and organizations to lure users in with enticing deals.
FBI Disrupts AI-Powered Phishing Service with 1 Million URLs
In a major win for cyber safety, the FBI, Google, and Black Lotus Labs joined forces to dismantle Outsider Enterprise, a notorious phishing-as-a-service operation based in China that had been spreading fake text campaigns through 1 million URLs. This coordinated takedown seized key servers and accounts used by the threat actors.
Former IT Employee Sabotages School District with Prolonged Cyberattack
A former IT employee waged a relentless cyberwar against his old employer, the Saydel Community School District, launching a devastating 21-month attack that crippled the district's systems and disrupted classrooms. The attacks began just days after he left his job, with the deletion of the district's Facebook account, and continued with repeated intrusions into critical services.
Chinese Hackers Maintain Decade-Long Spy Operation in Isolated Network
Chinese hackers pulled off a stunning 10-year cyber-espionage heist, infiltrating a supposedly airtight network and gaining unfettered access to every login, command, and secret. The masterminds behind Operation Highland, linked to the Velvet Ant cluster, expertly embedded their digital fingerprints into the network's authentication process.
FBI dismantles $1.9B China cybercrime network
In a major breakthrough, the FBI, with the help of Google and Lumen Technologies, has dismantled a massive $1.9 billion China-based cybercrime network that impersonated trusted brands to scam hundreds of thousands of victims. This coordinated takedown, part of Operation Riptide, seized key infrastructure and domains used by the group.
ShinyHunters Exploits Oracle Flaw to Breach Universities
A zero-day flaw in Oracle PeopleSoft PeopleTools, known as CVE-2026-35273, has been exploited by ShinyHunters, potentially infiltrating over 100 organizations, with universities being the hardest hit. This vulnerability allows attackers to execute remote code and take over affected servers, posing a significant threat to higher education institutions.
Conti Ransomware Member Pleads Guilty to Cybercrimes
A longtime member of the notorious Conti ransomware group has pleaded guilty to cybercrimes in federal court, marking a major win for justice after the defendant's attacks caused millions of dollars in damage to people and businesses worldwide. Oleksii Oleksiyovych Lytvynenko, a 44-year-old Ukrainian national, admitted to developing malware and participating in Conti's ransomware campaign.