Threats & incidents
-
ShinyHunters bypasses PeopleSoft WAF controls
Google says ShinyHunters has renewed mass exploitation of a PeopleSoft vulnerability after modifying requests to evade web application firewall rules used as a temporary mitigation.
-
Citrix patches exploited NetScaler flaws
Citrix says attackers have exploited two critical NetScaler vulnerabilities, including an unauthenticated remote-code-execution flaw affecting all ADC and Gateway deployments covered by the bulletin.
-
Welsh police probe staff data exposure
Dyfed-Powys Police says a cyber incident disrupted non-emergency systems and may have exposed staff information, while emergency response and public personal data appear unaffected.
-
Poland orders inspection after Medyc breach
Poland’s data protection regulator will inspect Qbusoft following an attack on its Medyc healthcare software, while authorities work to establish the wider scale of patient-data exposure.
-
Renfe traces breach to compromised Adif servers
Renfe says technical evidence points to previously compromised Adif servers interconnected with its systems, with names and email addresses potentially accessed but rail services unaffected.
-
AI agents used in live retail attacks
Gambit Security says a financially motivated operator used three open-source AI harnesses to automate vulnerability discovery, exploitation, and campaign orchestration against online retailers.
-
SharePoint flaw moves into active exploitation
Canada’s Cyber Centre has warned that attackers are exploiting CVE-2026-65660, a SharePoint code-injection flaw Microsoft patched in August.
-
Check Point confirms exploitation of two flaws
Check Point has confirmed exploitation of two critical pre-authentication vulnerabilities affecting its gateway and management products, including a management flaw used before disclosure.
-
Ransomware affiliate moves across four criminal brands
Microsoft says one ransomware affiliate has retained largely consistent post-compromise tradecraft while deploying Qilin, DragonForce, Anubis, and BERT ransomware.
-
Latvia arrests suspect over company cyberattacks
Latvian police have arrested a man suspected of attacks against at least two companies involving alleged unauthorised database access, personal-data extraction, and attempted extortion.