Spain’s Cybercrime Numbers Need Context
Compare crime reports, operational incidents and breach notifications without creating a misleading total. Keep definitions and reporting periods visible.
Security
Vulnerabilities, defensive security, architecture and operational security.
Mean Time to Exploit Just Went Negative: The Patch Window Is Gone
Mandiant’s M-Trends 2026 report, published 23 March 2026, puts a number on something defenders have felt for a while: the mean time to exploit (MTTE) a vulnerability is now an estimated -7 days. Exploitation is routinely happening before a patch…
The AssuranceAmerica Breach Affected Nearly Seven Million People
A breach reported by AssuranceAmerica affected 6,998,886 people and included driver-licence information. The long-term risk is identity abuse, not only an immediate phishing campaign. US motor insurer AssuranceAmerica began notifying people after an incident affecting 6,998,886 individuals. Public notices and…
1.4 Million Sites Were on the List. 25,195 Had Evidence of Compromise.
WP-SHELLSTORM's exposed server showed how target lists, validated compromises and active webshells are different measures of a mass-exploitation operation.
Alicante’s Recovery Began With Shutdown
Recovery planning should prioritise the work people must complete. Test dependencies, reconnection decisions and acceptance evidence.
JADEPUFFER Compresses a Ransomware Intrusion into Minutes
Sysdig describes JADEPUFFER as the first documented end-to-end agentic ransomware operation. Its speed changes how defenders should think about containment and AI infrastructure exposure. Sysdig reported an operation it calls JADEPUFFER on 1 July. The attacker exploited an internet-facing Langflow…
Six CVSS 10 Flaws Hit ColdFusion. One Was Already Being Exploited.
Adobe fixed 13 ColdFusion vulnerabilities, including six CVSS 10 code-execution flaws. One path-traversal issue was already under attack.
WebDialer Was Optional. On Cisco Unified CM, It Became a Path to Root.
Cisco confirmed active exploitation of a Unified CM WebDialer flaw that let unauthenticated attackers write files and work toward root.
Malicious JetBrains AI Plugins Stole Developer API Keys
At least 15 JetBrains plugins posed as AI assistants while stealing provider credentials. The campaign shows why developer tooling needs central governance and short-lived secrets. Security company Aikido reported a coordinated set of malicious plugins in the JetBrains Marketplace. The…
The Classified Network Held. The Mobile Layer Still Mapped Belgium’s Intelligence Service.
Attackers reportedly breached Belgium's civilian intelligence service through Ivanti EPMM, exposing mobile identity, location and relationship data while the classified network remained sealed.