Tag: supply chain
1740 articles
MCP Servers Expose Enterprises to Unvetted Risks
Thousands of enterprises are unknowingly rolling out MCP servers without proper oversight, leaving them vulnerable to unchecked risks. A recent analysis of 15,465 publicly indexed MCP servers revealed a staggering lack of centralized governance, with many deployments happening fast but without any policing.
ASOS Faces Suspected Snowflake Compromise, Urges Customer Caution
ASOS customers received a chilling push notification on October 6 claiming that its Snowflake instance had been fully compromised, with the sender threatening to leak sensitive data unless the company engaged with them. The ominous message, signed 'xuanyewengateway', sparked urgent warnings for customers to exercise caution.
Asos Snowflake Instance Targeted in Data Leak Threat
ASOS customers are reporting receiving alarming messages claiming that the company's Snowflake instance has been fully compromised, with hackers threatening to leak sensitive data unless they engage with them on Telegram. The rogue notifications specifically addressed ASOS's data protection and IT teams, demanding a response to avoid a potential data breach.
Nikkei Breaches Email Accounts, Exposes Data
Nikkei suffered not one, but two email breaches in just three months, exposing sensitive contact info and leaving staff and interviewees vulnerable to phishing scams. The hacks, which hit Google Workspace and Microsoft 365 accounts, allowed attackers to send thousands of malicious emails.
Bromcom Breach Exposes Email Addresses in Legacy Sign-on System
Bromcom's legacy single sign-on system has been breached, exposing email addresses and limited information of affected users. The incident, tied to a superseded registration functionality, has prompted the UK school software provider to withdraw the vulnerable component.
Ransomware Affiliate Betrays Partners, Siphons Victim Funds
In a shocking betrayal, a rogue ransomware affiliate named Azazel secretly siphoned off victim funds and ran his own leak site, defying the standard rules of the ransomware-as-a-service partnership. This brazen move not only hurt his partners but also left victims vulnerable to further exploitation.
FBI Removes Accenture Contractor Over ShinyHunters Breach Patch Failure
The FBI has taken swift action by removing an Accenture contractor after a patch failure led to the ShinyHunters breach, exposing sensitive information of thousands of employees. A clever URL-encoding trick was used to outsmart a web application firewall, exploiting a vulnerability cataloged as CVE-2026-35273.
Atlassian Flaw Exposes File Data Across Multiple Products
A critical security flaw, rated 9.3 out of 10, has been discovered in multiple Atlassian products, allowing unauthenticated attackers to access sensitive files. This vulnerability, known as CVE-2026-21589, poses a significant risk to self-hosted Data Center products if exploited.
Boeing Secures $14.7 Billion Deal to Boost PAC-3 Seeker Production
Boeing has landed a whopping $14.7 billion deal to supercharge production of PAC-3 seekers, a move that will help the company deliver these critical components at unprecedented levels. This major contract win is a testament to Boeing's commitment to quality and execution.
Citrix NetScaler Exploited in Active Attacks Amid New 0-Day Reports
Citrix NetScaler is under active attack, with hackers exploiting a newly discovered vulnerability that can cause denial of service with just a single specially crafted request. The flaw, known as CVE-2026-88779, affects certain NetScaler deployments configured for single sign-on authentication.
Microsoft Exchange Flaw Exposes Mailboxes to Authenticated Attackers
A newly discovered flaw in Microsoft Exchange Server could put your mailboxes at risk, allowing authenticated attackers to elevate their privileges and gain unauthorized access across your network. Microsoft has urgently released a security update to patch this high-severity vulnerability, rated 8.8 on the CVSS scale.
Allies' Shipbuilding Push Sparks Coordination Challenge
Japan's government is breathing new life into its shipbuilding industry with a fund that's sparking a wave of private investment, and now other countries are taking note. The US, which currently holds a mere 0.1% of the global shipbuilding market, may need to step up its game to stay competitive.
Bromcom Breach Exposes Email Addresses in Legacy Sign-on Flaw
A major security flaw in Bromcom's legacy single sign-on system has led to a significant data breach, exposing email addresses of users across the UK's education sector. The incident, identified on September 6, affected a legacy registration mechanism still in use despite being superseded.
Dell Flaw Exposes Root Privileges to Hackers
Dell's System Update tool has a critical flaw that could let hackers gain total control of your system - and all it takes is remote access to get started. This vulnerability, tracked as CVE-2026-86360, is a serious threat that could allow attackers to execute code with root privileges.
Malicious Backdoors Infiltrate Telecoms via Email Traffic Disguise
Malicious backdoors are sneaking into telecom systems by masquerading as regular email traffic, making them nearly undetectable. Researchers at Rapid7 uncovered an implant family called AVERAT that cleverly disguises itself as legitimate mail activity on TCP port 25 and SMTP.
Citrix Warns of Targeted Attacks Via New Zero-Day Flaw
Citrix is warning of targeted attacks exploiting a newly discovered zero-day flaw, CVE-2026-88779, a high-severity memory buffer issue that could disrupt services for vulnerable NetScaler ADC and NetScaler Gateway customers. The company has urged affected users to act quickly to protect themselves from potential denial-of-service attacks.
Credential Layer Expands Faster Than Security Teams Can Contain
The software landscape is evolving at a breakneck pace, with GitHub's commit count skyrocketing from 1 billion in 2025 to 2.9 billion by August 2026 - a staggering rate that hints at an explosion of credentials and identities that need to be secured. This rapid growth leaves security teams scrambling to keep up with the expanding attack surface.
Frontline Education Breach Exposes K-12 Staff Data
A recent breach at Frontline Education, a leading provider of K-12 administration software, exposed sensitive staff data after a vulnerability in a third-party software product was exploited, allowing unauthorized access to part of its environment. The breach was discovered nearly two months after it occurred, and Frontline Education quickly sprang into action to investigate and remediate the issue with the help of a cybersecurity firm.
Citrix NetScaler Zero-Day Exploited in Targeted Attacks
A critical zero-day vulnerability, CVE-2026-88779, has been exploited in targeted attacks, causing concern for Citrix NetScaler ADC and Gateway users. This memory overflow flaw can lead to denial-of-service attacks when specific deployment conditions are met.
Google Suspends Open-Source Bug Bounty Program Amid AI-Generated Spam Surge
Google is hitting the pause button on its Open Source Software Vulnerability Rewards Program, temporarily stopping new product vulnerability submissions due to a surge in AI-generated spam. This change doesn't affect existing reports or supply chain submissions.
Citrix Disrupts Zero-Day Attacks on NetScaler with Emergency Patches
Citrix has rolled out emergency patches to shield NetScaler from zero-day attacks that can cause Denial of Service chaos, and you should update ASAP to avoid getting caught in the crossfire. The newly discovered vulnerability, CVE-2026-88779, has already been exploited in targeted attacks, earning a scary CVSS score of 8.7.
China's Military Procurement Shifts Gears
China's military procurement landscape is shifting, with a new civilian-backed contender emerging in the form of the SA218, a basic trainer aircraft that recently completed its maiden flight. This development could mark a significant step towards replacing the aging Nanchang CJ-6, a long-standing backbone of the People’s Liberation Army.
Warlock Targets SharePoint Deployments with Ransomware via Exploited Flaws
Warlock, a suspected China-linked threat actor, has launched targeted ransomware attacks on at least four organizations, including critical infrastructure operators, via exploited flaws in on-premises Microsoft SharePoint Server deployments. The victims, located in Portuguese- and Spanish-speaking countries, span across Europe, Africa, and Latin America.
MI5 Warns UK Academics Funded by China's Spy Agency
MI5 has issued a stark warning to UK academics: over 100 researchers have unwittingly contributed to projects funded by China's spy agency, which aims to boost its espionage capabilities. This alarming revelation has raised serious national security concerns in the UK.