Threats & incidents
-
CERT-FR finds simple attack techniques behind nearly 200 web application data breaches
France’s national cyber incident response service followed nearly 200 web application data breaches in 2025, finding that many involved relatively simple attacker actions rather than exploitation of software vulnerabilities.
-
Zeabur details credential failures and database access in October breach
Zeabur says attackers accessed its production database, stored environment variables and 101 Google Cloud dedicated servers. Its October investigation distinguishes confirmed access from uncertain database extraction and an unproven link to an earlier intrusion.
-
Compromised UpdraftCentral keys used to install WordPress backdoors
Attackers used valid UpdraftCentral management keys to install malicious plugins on two Nethemba websites and attempted a third. TeamUpdraft separately reported access to its customer site and possible exposure of remote management credentials.
-
Russian-linked espionage targets NATO defence and law enforcement networks
Broadcom researchers describe intrusions involving a naval shipbuilder, aircraft engine manufacturer, and law enforcement organisation in two NATO countries. The shipbuilder investigation documented stolen credentials, persistent access, and a loader whose final payload was not recovered.
-
Pegasus infection confirmed on Serbian university rector’s phone
Citizen Lab has confirmed Pegasus spyware on the iPhone of University of Belgrade rector Vladan Đokić. Former prosecutor Rade Bajić received Apple threat notifications, but investigators have not established that his device was infected.
-
Healthcare ransomware reports rise 40% in Q3
Comparitech recorded 306 ransomware incidents and claims involving healthcare providers and businesses in the third quarter of 2026, up 40% from the previous quarter.
-
Ransomware attackers increasingly threaten employees and families
New Semperis research suggests ransomware groups are combining AI-assisted activity, repeat attacks, and threats against employees and their families as identity recovery capabilities lag.
-
Criminal marketplaces offer identity verification bypass services
Research into underground identity fraud services describes how criminals advertise forged documents, manipulated video, and supposedly verified accounts for use against financial onboarding controls.
-
Hosting compromise exposes VMmanager control panels
A hosting provider has disclosed the compromise of VMmanager 6 infrastructure, warning that attackers accessed control-panel information and may have reached customer server environments at other providers.
-
AI agents used in large website intrusion campaign
Research into a campaign involving more than 100 websites indicates that an attacker used AI agents to automate substantial parts of intrusion activity at relatively low cost.