Threats & incidents
-
Swiss cyber reporting exposes enterprise attack patterns
Switzerland received 200 mandatory critical-infrastructure cyber reports in the first half of 2026, alongside rising Microsoft 365 phishing and persistent ransomware activity.
-
DDoS attack strains Norway’s shared digital services
A prolonged DDoS attack against Norway’s shared government infrastructure disrupted access to multiple digital services, again testing the resilience of systems used across the public sector.
-
Claude Code enters ransomware operations
Threat research has linked Claude Code to an active ransomware operator using AI across reconnaissance, credential theft, persistence and data-exfiltration work.
-
Power Pages exposure linked to 27m records
Researchers have linked a 27-million-record data exposure to publicly readable Microsoft Power Pages and Dataverse configurations rather than a confirmed zero-day.
-
Alation investigates unauthorised access
Enterprise data platform Alation is investigating unauthorised activity in one of its systems, with the extent of any customer or data impact still unknown.
-
DfE restores portals after data breach
The Department for Education has restored two portals after identifying a vulnerability, confirming affected personal data and notifying the Information Commissioner’s Office.
-
Manic malware targets Ukrainian mobile services
Manic Android malware is combining financial theft, surveillance and remote control while targeting Ukrainian banks, identity services and communications applications.
-
Four exploited vulnerabilities CISOs should check — now
Four vulnerabilities affecting Microsoft, VMware, and Apple products are now listed by CISA as actively exploited, putting patch status, internet exposure, and the role of affected systems under renewed scrutiny.
-
France confronts tax systems’ cyber debt
France has acknowledged ageing and vulnerable government IT after its tax breach, accelerating authentication, detection, training, and an audit due in September.
-
Clop-linked web shell targets Windchill data
A purpose-built web shell targeting PTC Windchill can decrypt stored credentials, map engineering repositories, and run additional code while operating inside the application’s own trust boundary.