Vulnerabilities, defensive security, architecture and operational security.
Exploit attempts hit SAP Commerce Cloud honeypots three days after patch day, before any public proof of concept. CVE-2026-58231 shows why internet-facing enterprise systems need an incident path, not a routine patch window.
ShieldBreak is now CVE-2026-69414, a Microsoft Defender elevation-of-privilege vulnerability assessed as exploitation more likely and still awaiting a verifiable fix. This update separates it from RoguePlanet CVE-2026-50656, explains the different CFAPI attack path, conflicting Windows 11 reproduction results, affected-build uncertainty, and the operational controls security teams should use instead of treating patch deployment as proof that exposure is fixed.
France has described three DGFiP data leaks involving tax correspondence, cadastral records and inheritance-related requests. The attack also shows how low-rate extraction can stay below detection thresholds.
Cl0p’s Windchill campaign is not primarily a story about a list of famous victims. It is a warning about what happens when dozens of enterprises expose the same high-value software weakness at the same time. Cl0p says it stole data…
Google found an agentic attack framework managing more than 23,800 harvested secrets. In a separate operation, another framework built and launched a credential campaign in under six hours.
A new White House programme will let vetted U.S. security companies conduct surveillance and disruptive operations against foreign cybercrime groups under federal direction. It is a significant expansion of private-sector offensive capability, but the memorandum’s legal guardrails leave difficult questions about attribution, accountability and escalation.
Researchers found that Belgium’s widely used Connective signing extension could expose eID and Maestro card data, recover PINs and execute attacker-controlled code through its native host. The flaws were fixed in July, but the case shows how a powerful browser extension can quietly undermine an otherwise strong national identity system.
Exploit code for CVE-2026-55040, a Microsoft SharePoint authentication bypass, was weaponised almost immediately after Rapid7 published its analysis. With thousands of SharePoint servers exposed online and a separate SharePoint flaw now tied to ransomware, administrators should treat patching, exposure reduction and compromise checks as one urgent task.
What evidence should justify an identity decision? Practical review questions for remote certificate providers.
Organisations have sent hundreds of thousands of messages, credentials and attachments to addresses at domains they did not control because developers treated names such as noreply.net and deleteduser.com as harmless placeholders. Those domains were not fictional. Security researchers registered them…
