News

Security

ShieldBreak Shows Why “Patched” Is Not the Same as Fixed

ShieldBreak is now CVE-2026-69414, a Microsoft Defender elevation-of-privilege vulnerability assessed as exploitation more likely and still awaiting a verifiable fix. This update separates it from RoguePlanet CVE-2026-50656, explains the different CFAPI attack path, conflicting Windows 11 reproduction results, affected-build uncertainty, and the operational controls security teams should use instead of treating patch deployment as proof that exposure is fixed.

Rob Nidschelm
15 Aug 2026

Security

France’s Tax Systems Have Been Breached Again. The Bigger Problem Is What Comes After the Data Theft

Tax and identity records escape from a French government data vault into impersonation networks

France has described three DGFiP data leaks involving tax correspondence, cadastral records and inheritance-related requests. The attack also shows how low-rate extraction can stay below detection thresholds.

Rob Nidschelm
14 Aug 2026

Security

Cl0p Did Not Target 50 Companies. It Targeted One Vulnerability They All Shared

A single compromised enterprise software hub sends attack paths into companies around the world

Cl0p’s Windchill campaign is not primarily a story about a list of famous victims. It is a warning about what happens when dozens of enterprises expose the same high-value software weakness at the same time. Cl0p says it stole data…

Rob Nidschelm
14 Aug 2026

AI, Security

An Agentic Attack Framework Was Managing 23,800 Stolen Secrets

Autonomous workflow paths carry abstract secret tokens from cloud systems into a central credential vault.

Google found an agentic attack framework managing more than 23,800 harvested secrets. In a separate operation, another framework built and launched a credential campaign in under six hours.

Rob Nidschelm
14 Aug 2026

Security

Belgium’s Digital ID Trust Layer Was One Download Away From RCE

Belgian flag beside an eID smart card and browser-extension attack chain

Researchers found that Belgium’s widely used Connective signing extension could expose eID and Maestro card data, recover PINs and execute attacker-controlled code through its native host. The flaws were fixed in July, but the case shows how a powerful browser extension can quietly undermine an otherwise strong national identity system.

Rob Nidschelm
13 Aug 2026

Microsoft Server, Security

SharePoint PoC Goes Live, and Attackers Start Using It Within a Day

Hostile traffic bypassing a JWT authentication boundary protecting enterprise document servers

Exploit code for CVE-2026-55040, a Microsoft SharePoint authentication bypass, was weaponised almost immediately after Rapid7 published its analysis. With thousands of SharePoint servers exposed online and a separate SharePoint flaw now tied to ransomware, administrators should treat patching, exposure reduction and compromise checks as one urgent task.

Rob Nidschelm
13 Aug 2026

Security

Salesforce and ServiceNow Are Being Probed Through the Guest Door

Salesforce and ServiceNow logos flank an open digital guest-access gate crossed by a red scanning path.

Reco has linked sustained Salesforce and ServiceNow probing to one IP and a custom Go toolset, exposing how over-permissioned guest identities become cross-platform data-extraction paths.

Rob Nidschelm
12 Aug 2026

Security

CVE-2026-68820 Turns a Windows Foothold Into SYSTEM

Red exploit path crossing a Windows network-driver layer into a privileged kernel core

Microsoft’s August 2026 updates fix a WinSock privilege-escalation flaw used by North Korea’s Lazarus group against defence, aerospace and aviation organisations. The exploit helped Operation Dream Job turn a local Windows foothold into SYSTEM access, deploy a kernel rootkit and interfere with endpoint-security controls.

Rob Nidschelm
11 Aug 2026

Security

StormEncryptor: China-linked Storm-1175 changes tactics amid N-central attacks

Microsoft has identified a new ransomware strain deployed by China-linked Storm-1175. The campaign coincides with active exploitation of N-able N-central, although the specific entry route remains unconfirmed.

Rob Nidschelm
11 Aug 2026

Security

Suisun City Cyberattack Shows Why 911 Needs a Tested Failover

Empty emergency dispatch centre with warning indicators and rerouted network paths

Malware forced Suisun City to shut down its entire IT network, disrupting 911 routing and police and fire dispatch. A county-level failover kept emergency calls and field response operating.

Rob Nidschelm
11 Aug 2026