The Administrative Office of the US Courts (AOUSC) says a cyberattack on government contractor BAE Systems has crippled the notice system used by federal bankruptcy courts. In a news release Thursday, the Administrative Office of the U.S. Courts said the BAE Systems cyberattack also halted the creation and distribution of bankruptcy notices. “The Administrative Office … Read more
Drupal has fixed two critical vulnerabilities that could allow attackers to remotely execute code on websites running a supported version of the content management system. The security issues affect the Field UI module of the software kernel and the contributed Entity List module. Drupal issued a warning earlier this week, urging administrators to apply updates … Read more
ConnectWise has suspended customer access to its cloud backup service (formerly SkyKick Cloud Backup) after hackers accessed application identities and compromised Microsoft 365 tenants. Reports of the malicious activity first surfaced on Friday, with administrators observing unauthorized access to customer data in Microsoft 365 tenants due to a possible “SkyKick/CW breach.” Later the same day, … Read more
Microsoft says some users may have issues enabling Smart App Control after installing this month’s Windows 11 security update KB5127648. Smart App Control is a Windows 11 security feature that leverages Microsoft’s App Intelligence Services and Code Integrity features, working with Microsoft Defender and SmartScreen to block potentially malicious apps or binaries. According to the … Read more
Article written by Vakaris Noreika, Vice President of Product Research and Development at NordLayer Monday morning you’re managing an organization’s security, and suddenly your security tools report private ChatGPT usage on a managed laptop, even though your organization pays for ChatGPT Enterprise. Wondering what the employee submitted to ChatGPT. This could be a public job … Read more
Researchers warn that hackers could soon exploit a maximum severity vulnerability (CVE-2026-103849) affecting Magento and Adobe Commerce that could potentially allow them to execute arbitrary PHP code on store servers. According to e-commerce security firm Sansec, no attacks exploiting the vulnerability called BlockStrap have been observed so far, but threat actors are expected to find … Read more
The Candiru spyware was delivered to Al Jazeera Media Network’s devices via targeted online advertisements in a zero-click attack that only required the malicious ads to be displayed on the victim’s device. Citizen Labs researchers who investigated the attacks called the technique AdFection and noted that their report was the first public technical confirmation of … Read more
Burger King Japan, the Japanese subsidiary of global fast food giant Burger King, reported a major data breach after attackers accessed a server containing 11.18 million customer details. Founded in Florida in 1953, Burger King is now a multinational fast food chain with nearly 20,000 locations worldwide, including 350 in Japan. In a news release … Read more
BeyondTrust warned customers on Thursday to fix a critical flaw in its Remote Support (RS) that has been exploited in zero-day attacks since late August. Remote Support is the company’s enterprise-wide support solution that helps IT service desks, help desks and customer support teams resolve issues remotely. Tracked as CVE-2026-102764actively exploited this Authentication bypass The … Read more
Threat actors are exploiting a critical command execution flaw, now tracked as CVE-2026-110447, in the Collabora Online – Built-in CODE Server app (richdocumentscode) for Nextcloud. Multiple administrator reports indicate that the attacks began in mid-September, about a month before the official event Security bulletinThe GitHub AdviceAnd CVE publication. CVE-2026-110447 affects Richdocumentscode versions before 26.4.303 and … Read more