Data & infrastructure
-
Trivy emerges as source of 2,500-org exposure
New analysis indicates that most organisations in a 2,500-plus exposure dataset were caught through the earlier Trivy compromise rather than the short-lived malicious LiteLLM releases.
-
Beacon breach reaches sensitive charity records
A UK charity has confirmed that records potentially copied from the Beacon CRM breach include medical and financial information, widening the downstream consequences of the supplier incident.
-
Threema outage exposes hosting split
A sustained DDoS campaign disrupted Threema and its colocation provider, while customers running the messaging platform on their own infrastructure remained available.
-
Fortinet patches two authentication weaknesses
Fortinet has fixed separate authentication weaknesses in FortiWeb and FortiManager, including a configuration-dependent FortiWeb administrator bypass and a FortiManager device-impersonation flaw.
-
Ivanti fixes remotely reachable Endpoint Manager flaws
Ivanti has patched three high-severity Endpoint Manager vulnerabilities, including an unauthenticated agent denial-of-service flaw and a credential exposure requiring a man-in-the-middle position.
-
Adobe patches critical Commerce authorisation flaw
Adobe has fixed a critical unauthenticated authorisation vulnerability in Commerce and Magento Open Source that can allow privilege escalation without administrator access or user interaction.
-
Dutch NCSC confirms macOS Screen Sharing attacks
The Dutch NCSC has observed attackers exploiting CVE-2026-65400 against internet-reachable Macs, gaining root access and installing cryptomining software.
-
VMware vCenter flaw moves into active exploitation
Incident responders have linked successful compromises across 47 countries to the critical VMware vCenter flaw CVE-2026-59310, only days after Broadcom disclosed and patched it.
-
Guest access campaign targets Salesforce and ServiceNow
Researchers are tracking a campaign extracting information from exposed Salesforce and ServiceNow portals through legitimate guest-access mechanisms rather than vulnerabilities in either SaaS platform.
-
SharePoint exploitation follows public PoC
Honeypots recorded attempts to exploit a patched SharePoint authentication bypass shortly after public PoC code appeared, while a second flaw completes an unauthenticated remote-code-execution chain.