⌛
Loading…
Curated news, CVE analysis, and threat reports from the world's top cybersecurity sources.
Researchers have uncovered an AI-assisted exploit chain targeting on-premises Microsoft SharePoint servers, combining an authentication bypass (CVE-2026-55040, CVSS 9.1) with a remote code execution flaw (CVE-2026-63520, CVSS 8.1) to achieve unauthenticated RCE. The bypass allows an attacker to impersonate any known user by SID or UPN, while the RCE flaw in Business Connectivity Services executes code as the SharePoint service account. The attack chain affects SharePoint Server 2016, 2019, and Subscription Edition, but not SharePoint Online.
DeadLock ransomware leverages decentralized infrastructure, including Polygon smart contracts and Session messaging, to enhance operational resilience.
Valve warned Steam hardware buyers about fake delivery scams following a cyberattack on shipping partner CEVA Logistics. The breach exposed names, addresses, phone numbers, and order details for European customers who purchased hardware in the past three months.
Amazon Web Services successfully completed the 2025-26 NHS Data Security and Protection Toolkit assessment, achieving a 'Standards Exceeded' status. This assessment measures performance against the National Data Guardian's 10 data security standards for organizations accessing NHS patient data.
A video game called Drone Battle: Ukraine is linked to Russia's Alabuga Special Economic Zone, which produces attack drones used in the war against Ukraine. Investigators say the game serves as a lure in a broader recruitment campaign that uses social media platforms to attract young people globally.
Wesco, a global supply chain and distribution giant, has confirmed it is investigating a cybersecurity incident after the threat actor ExfilSquad claimed to have stolen data. The company provided a statement to BleepingComputer acknowledging the ongoing investigation.