Splunk’s Security Data Could Be Damaged Without a Login
An exploited Splunk Enterprise flaw let unauthenticated attackers create or truncate arbitrary files through a PostgreSQL sidecar endpoint.
The Critical Cisco ISE Flaw Needed Admin Rights. The Other One Needed None.
Cisco ISE's critical command injection required an administrator, while the lower-scored flaw exposed hashed credentials without authentication.
Australia Can Intervene in a Critical-Infrastructure Cyber Incident
Australia’s critical-infrastructure framework combines mandatory risk management and incident reporting with last-resort government powers to act during a serious cyber incident. Australia has expanded the Security of Critical Infrastructure Act in several waves. Major reforms in 2021 and 2022 broadened…
The SD-WAN Control Plane Was Exploited. Cisco Said Preserve Evidence Before Patching.
Cisco confirmed exploitation of two Catalyst SD-WAN control-plane flaws and told customers to preserve admin-tech evidence before patching or changing configuration.
The PeopleSoft Extortion Campaign Turns a Legacy ERP into an Internet-Facing Risk
The WAF Blocked the Name. The Attacker Changed the Spelling. Update, 29 September 2026: Google’s 25 September report describes renewed ShinyHunters exploitation of CVE-2026-35273 across sectors. The group changed its request paths to bypass WAF rules protecting PeopleSoft’s Environment Management…
SimpleHelp Created Technician Accounts Without the Identity Provider
A SimpleHelp OIDC bypass could create technician accounts, enrol attacker-controlled MFA and inherit remote-management permissions from a mapped group.
The WFP Gaza Data Breach Is a Safeguarding Incident, Not Only a Privacy Incident
Unauthorised access to a World Food Programme registration system exposed data associated with roughly 600,000 Gaza households. In a conflict zone, ordinary identity and location fields can create extraordinary physical risk. The World Food Programme confirmed unauthorised access to its…
June 2026 Patch Tuesday: what Security and IT teams should prioritise
June 2026 Patch Tuesday covers 110 approved patch records and 392 unique CVEs across Microsoft, Adobe and SAP.
Apple Moved Private Cloud Compute Onto Google’s Hardware. The Trust Model Had to Move With It.
Apple extended Private Cloud Compute onto Google Cloud and NVIDIA hardware, turning attestation, independent roots of trust and public verification into the privacy boundary.
Tchap’s Encryption Held. One Stolen Account Still Exposed Public Rooms Used by 73,467 Officials.
France says one hijacked Tchap account exposed public-room content associated with 73,467 officials. Private encrypted histories were not reported compromised.
A Web Page Was Enough. Chrome’s V8 Zero-Day Was Already Being Exploited.
Google patched an actively exploited V8 memory-corruption flaw reachable through a crafted web page. The fix is not complete until the browser restarts.
The VPN Bypass Came First. Qilin Ransomware Followed.
A Check Point IKEv1 authentication bypass was exploited for a month before disclosure, with at least one intrusion linked to a Qilin ransomware affiliate.