threat-intel Hackers Exploit AnySign4PC via Hacked Korean Sites to Install Backdoors Without Prompts A state-sponsored threat group, potentially linked to Lazarus and operating between 2025 and 2026, exploited vulnerabilities in AnySign4PC, a certificate-based electronic signature software, to install backdoors on targe… The Hacker News · Jul 30, 2026 High CVE-2020-7882SOwatering holebuffer overflowremote code execution
threat-intel FTC sues Hims & Hers for allegedly sharing patient information with third-party platforms The Federal Trade Commission (FTC) is suing Hims & Hers, a telehealth company, for allegedly sharing sensitive patient information with third-party advertising platforms, despite claiming to prioritize patient privacy. T… The Record · Jul 29, 2026 Medium data-breachprivacytelehealth
threat-intel IR Trends Q2 2026: Phishing and weaponized remote management tools drive attack chains This quarter, phishing, particularly QR code phishing leveraging trusted infrastructure, dominated initial access methods for attackers, with a significant increase in authentication abuse. The threat actor UAT-11764 con… Cisco Talos · Jul 28, 2026 High phishingauthenticationransomware
vulnerability Unpatched Fastjson Vulnerability Exploited in Attacks A critical remote code execution (RCE) vulnerability in Fastjson, a popular Java JSON processing library, has been actively exploited by threat actors. The vulnerability, tracked as CVE-2026-16723, allows attackers to ex… SecurityWeek · Jul 28, 2026 Critical CVE-2026-16723USSGCArcejsonspring boot
vulnerability ISC Stormcast For Tuesday, July 28th, 2026 https://isc.sans.edu/podcastdetail/10026, (Tue, Jul 28th) The ISC Stormcast highlighted a significant vulnerability in the latest version of Apache ActiveMQ, potentially allowing attackers to execute arbitrary code. This could lead to widespread disruption and data compromise a… SANS Internet Storm Center · Jul 28, 2026 Critical rceapacheactivemq
threat-intel FBI: Breaking Affiliate Trust Sped Along LockBit's Takedown The FBI, in collaboration with international law enforcement agencies, successfully dismantled LockBit, one of the most prolific ransomware-as-a-service (RaaS) groups, through Operation Cronos. The operation focused on b… Dark Reading · Jul 27, 2026 High UNRUransomwareraasoperation cronos
threat-intel Health system in South Carolina, Georgia closes offices after malware affects networks AnMed Health, a multi-state healthcare system in South Carolina and Georgia, has been forced to temporarily close numerous facilities due to a malware attack. The system is working to restore operations and ensure patien… The Record · Jul 27, 2026 High cyberattackhealthcaremalware
threat-intel Cruciferra Crypter Uses BYOVD and Process Ghosting to Hide Windows Malware The China-linked cybercrime group behind tax-themed phishing campaigns is utilizing a sophisticated crypter service called Cruciferra to deliver a wide range of malware, including remote access trojans and information st… The Hacker News · Jul 27, 2026 High CNcrypterransomwarephishing
data-breach DentaQuest Data Breach Potentially Impacts Over 23 Million People DentaQuest, a major dental and vision benefits administrator, experienced a significant data breach potentially impacting over 23 million people. Hackers gained access to sensitive information including Social Security n… SecurityWeek · Jul 27, 2026 High data breachsocial securityhealthcare
data-breach MCBS Data Breach Affects 1.2 Million Individuals A data breach at MCBS, a medical business management company, exposed the personal information of over 1.2 million individuals. The attack was attributed to the PEAR ransomware group, who also claimed responsibility for… SecurityWeek · Jul 27, 2026 High data breachransomwarephishing
vulnerability Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patched Available A critical Remote Code Execution (RCE) vulnerability in Fastjson 1.x, a Java JSON library by Alibaba, is being actively exploited. Attackers are leveraging a type-resolution path to execute arbitrary code in Spring Boot… The Hacker News · Jul 25, 2026 High CVE-2026-16723USSGCArcejsonjava
threat-intel DevMan RaaS Portal Centralizes Payload Builds, Victim Management, and Affiliate Payouts The DevMan ransomware-as-a-service (RaaS) operation has significantly upgraded its affiliate portal, transitioning from a chat-based system to a centralized platform for managing victims, payouts, and team operations. PR… The Hacker News · Jul 25, 2026 High USCISEransomwareraasdevman
vulnerability Rockwell Patches Code Execution Flaws in Arena Simulation Software Rockwell Automation has released a patch to address four critical vulnerabilities in its Arena Simulation software, preventing attackers from executing arbitrary code on affected systems. These flaws stem from improper d… SecurityWeek · Jul 25, 2026 Critical CVE-2026-8085CVE-2026-8312CVE-2026-8313otsimulationmemory corruption
threat-intel Andy Burnham signals continuity on UK cyber policy, reappoints minister despite scrapping ministry Following a government reshuffle, UK cybersecurity minister Liz Lloyd has been reappointed to her role, maintaining continuity on the Cyber Security and Resilience Bill. The government has reorganized departments, splitt… The Record · Jul 24, 2026 Medium UKcybersecurityukcyber policy
threat-intel In Other News: Dolphin X AI-Powered Malware, Car Anti-Theft Device Hack, 400 Linux Kernel Flaws This week’s cybersecurity news highlights a range of threats, including a new AI-powered malware (Dolphin X), a data breach affecting Abbott, widespread internet outages in Maine, zero-day vulnerabilities in Siemens swit… SecurityWeek · Jul 24, 2026 High CVE-2025-40948CVE-2025-40947CVE-2025-40949GERUUNzero-dayvulnerabilityransomware
vulnerability Multiples vulnérabilités dans MongoDB (24 juillet 2026) Multiple vulnerabilities have been discovered in MongoDB, allowing an attacker to cause a denial of service and potentially exploit a security policy bypass. These vulnerabilities affect various versions of MongoDB Compa… CERT-FR · Jul 24, 2026 High CVE-2026-13055CVE-2026-13056CVE-2026-13057mongodbvulnerabilitysecurity
data-breach Major Australian energy supplier confirms customer data compromised Origin Energy, a major Australian energy provider, has confirmed a data breach impacting nearly 5 million customers. The breach exposed sensitive data including account details, credit card information, and personal iden… The Record · Jul 23, 2026 Medium AUdata breachcybersecurityaustralia
threat-intel China-Nexus JadeProx Uses New TriBack Loader in Government and Healthcare Attacks A China-nexus operation, tracked by Group-IB, dubbed JadeProx, is using a new loader called TriBack Loader to target government, healthcare, and education organizations across Asia and Latin America. The operation levera… The Hacker News · Jul 23, 2026 High CVE-2018-11511CVE-2021-24139CVE-2021-31755CHHOVIloaderspear-phishingvulnerability
vulnerability Multiples vulnérabilités dans Oracle PeopleSoft (23 juillet 2026) Multiple vulnerabilities have been discovered in Oracle PeopleSoft, allowing an attacker to cause a denial-of-service, lead to data confidentiality breaches, and compromise data integrity. These vulnerabilities are part… CERT-FR · Jul 23, 2026 High CVE-2025-55130CVE-2025-55131CVE-2025-55132oraclepeoplesoftvulnerability
vulnerability Multiples vulnérabilités dans Oracle MySQL (23 juillet 2026) Multiple vulnerabilities have been discovered in Oracle MySQL, allowing an attacker to cause a denial-of-service, compromise data confidentiality, and damage data integrity. These vulnerabilities are present across vario… CERT-FR · Jul 23, 2026 High CVE-2025-68161CVE-2026-46936CVE-2026-47008mysqloraclevulnerability
