They Did Not Steal Passwords. They Stole the Map of Who to Attack Next.
Alleged Entra directory theft exposed organisational maps rather than passwords. Treat bulk directory reads as a high-impact identity event.
A Failed WordPress Login Could Become Code Execution.
WordPress fixed a pre-auth reflected XSS that can be chained to server-side code execution when a logged-in administrator is drawn into the attack. The chain is contextual, but the update is urgent.
The Private Keys Were Safe. The Address of the Person Holding Them Was Not.
SafePal says private keys and funds were not exposed, but order records linked wallet ownership to names, contact details and home addresses.
They Never Became Customers. Their Identity Data Was Still in the Breach.
A Heights Finance cloud-platform breach reached borrowers, applicants and people who only enquired. Data retention turned a past interaction into a present risk.
The Exploit Did Not Just Steal $3 Million. It Ended the Blockchain.
A flaw in BounceBit Chain's inherited Evmos authorisation logic let an attacker move 286.5 million BB. The response will permanently retire the Layer 1 and reissue BB on BNB Chain.
The Rust Crates Were Removed in Under Two Hours. The Build Hosts Still Need Incident Response.
The malicious crates and the new video-call campaign are separate incidents. They meet at the same target: the people and credentials trusted to publish Rust packages.
The Fake Lock Screen Stole the Password. The Proxy Made the Login Look Internal.
SynkLoader used a fake Teams help desk, an Azure-hosted installer, a counterfeit Windows lock screen and an internal proxy to turn one user action into hands-on-keyboard corporate access.
The Login Was Legitimate. Russia-Linked Operators Turned OAuth and WhatsApp Linking Into Initial Access.
The login pages were real. The QR codes were real. The device-linking requests were real. That did not make them safe. Google Threat Intelligence Group has documented three suspected Russian cyber-espionage clusters that repeatedly turn legitimate authentication features into initial-access…
The “Safe” Expression Language Could Spawn a Shell. Three JSONata Flaws Turned Queries Into Code Execution
Three critical JSONata vulnerabilities let crafted expressions escape into Node.js code execution. The PoCs are public, but exploitation requires control of the expression, not ordinary JSON data.
The Router’s Firewall Took Commands From the Internet. Calix Has Not Shipped a Fix.
A critical Calix GigaSpire flaw lets an unauthenticated internet caller create persistent port-forwarding rules to devices inside a home network. No vendor patch was available at disclosure.
Microsoft Retracted the Entra ID Exploitation Claim. CISA Still Lists the CVE as Known Exploited.
Update, 22 August 2026: Microsoft has told BleepingComputer that it mistakenly marked a maximum-severity Microsoft Entra ID vulnerability as exploited in the wild. The correction removes the strongest public claim behind the first version of this article. It does not…
The Prison Kiosk Was Built for Untrusted Users. It Still Reached Government Data.
Investigators are examining how inmates used restricted prison terminals to reach shared government folders containing personal and operational data.