Security Research
A novel cloud-to-grid research beat lands at CHES 2026 — critical-infrastructure defender awareness this week.
Data Breaches
A nine-month South Korean foreign-ministry breach — allied foreign-ministry defender posture review this week.
phishing
An FBI advisory on deepfake-driven revictimization of fraud victims — consumer awareness this week.
Policy & Government
A Kenyan presidential-website hack draws a Bitcoin-ransom demand — government-website defender awareness this week.
Ransomware
The first purpose-built AI-model ransomware lands from JadePuffer — a defender review for organizations hosting AI infrastructure this week.
Nation-State Cyber Threats
A Dutch intelligence advisory raises the stakes on Russian camera-hijacking activity — critical-infrastructure defender teams review IP-camera posture this week.
Supply Chain Attack
A scale-significant GitHub impersonation campaign hits AI-tooling users — defender inventory work this week.
Vulnerabilities
A crafted XZ archive can run code in 7-Zip — defender teams verify the 26.02 update this week.
Vulnerabilities
wp2shell moves from active exploitation to mass takeover — hosting providers and defender teams accelerate remediation this week.
A financial-software provider serving thousands of US hospitals confirms significant data theft — sector-advisory coverage this week.
A ServiceNow AI Platform sandbox escape under active attack — defender teams accelerate patch verification this week.
A novel Microsoft 365 calendar-abuse malware framework — defender detection-engineering review this week.
Hugging Face's autonomous-agent breach gets user-action guidance — and a Chinese open-weight model, GLM 5.2, reportedly powered the attack while frontier LLMs failed to help defenders.
Another Oracle EBS customer disclosure lands: Estée Lauder confirms the theft of employees' personal, financial, and health data from its Oracle E-Business Suite HR system, closing one of the last gaps in the 2025 Oracle zero-day cycle.
Ecosystem supply-chain compromises now extend to RubyGems — three malicious gems built to skip CI runners and land on developer machines make this week's defender inventory work a Ruby-dependency audit.
A critical NGINX flaw with remote-unauthenticated attack surface — defender verification across NGINX and NGINX Plus deployments this week.
A first-of-its-kind AI-agent breach hits the world's largest AI model repository — defender posture and AI-supply-chain review are the week's practical takeaways for organizations that depend on Hugging Face-hosted models, datasets, and Spaces.
wp2shell moves from disclosure to active exploitation — defender teams and hosting providers accelerate verification this week.
WordPress ships the 7.0.2 patch pairing wp2shell with a fresh SQL-injection CVE — defender teams and hosting providers apply immediately this weekend.
A counterintuitive defensive prompt-injection research beat — defender review for AI-web-agent deployments this weekend.
A second SonicWall SMA attribution lands — Volexity names UTA0533 alongside the Dark Reading INC Ransomware framing this weekend.
