Blog

Cybersecurity

187 articles

All articles tagged Cybersecurity.

Infinite Campus Breach Exposes 137,000 School Staff Records

The ShinyHunters extortion gang breached Infinite Campus through its Salesforce instance in March, stealing names, emails, phone numbers, and support tickets from K-12 staff accounts. The EdTech company serves 3,200 school districts and manages data for 11 million students across 46 states.

Manaal Khan·15 Jun 2026

Cybersecurity·5 min

Ex-IT Worker Gets 21 Months for 21-Month Cyberattack on Iowa School

Ezekiel Dean Potter, a former IT specialist at Iowa's Saydel Community School District, received a 21-month prison sentence for systematically attacking his former employer's systems after his termination. The attacks deleted accounts, disabled device management, and disrupted classroom operations for over a year and a half.

Manaal Khan·14 Jun 2026

Cybersecurity·6 min

Chinese Hackers Hid Inside Isolated Network for 10 Years

The Velvet Ant threat group compromised a critical infrastructure network with no direct internet connection and maintained access from 2016 to 2026. Sygnia researchers discovered the attackers hijacked authentication systems, turning the organization's own security tools into espionage platforms.

Manaal Khan·13 Jun 2026

Cybersecurity·4 min

Maine Shuts Down Breach Portal After Fake Discord, VRChat Filings

The Maine Attorney General's Office has disabled public access to its data breach notification database after discovering fraudulent disclosures impersonating Discord and VRChat. The fake filings, which claimed millions of users were affected, exposed a critical flaw: submitted notices were automatically published without verification.

Manaal Khan·13 Jun 2026

Cybersecurity·4 min

Novo Nordisk Breach Exposes Clinical Trial Patient Data

The Danish pharma giant behind Wegovy and Ozempic confirmed attackers accessed pseudonymized patient information from clinical trials. Healthcare professionals' contact details were also compromised, prompting phishing warnings.

Huma Shazia·12 Jun 2026

Cybersecurity·5 min

French Govt Tchap Breach Exposes 73,000 Civil Servant Accounts

A threat actor compromised France's official encrypted messaging platform through a social engineering attack, accessing names, emails, and 13.5GB of documents from unencrypted public chat rooms. The breach affects less than 9% of Tchap's 825,000 registered users but raises questions about training and platform design.

Huma Shazia·12 Jun 2026

Cybersecurity·4 min

Fake Data Breach Reports Posted to Maine's Official Portal

Maine's official data breach notification portal published fraudulent reports about VRChat and Discord without verifying their authenticity. The state confirmed that anyone can submit breach notifications that go live immediately, exposing a significant flaw in the public transparency system.

Manaal Khan·12 Jun 2026

Cybersecurity·5 min

South Korea Fines Coupang $409M: Largest Privacy Penalty Ever

South Korea's data regulator has imposed a record 624.6 billion won ($409 million) fine on e-commerce giant Coupang after a breach exposed 37.55 million customer records. The penalty comes alongside findings of obstruction, delayed reporting, and interference with the company's data protection officer.

Manaal Khan·11 Jun 2026

Cybersecurity·5 min

Nottingham University Breach Exposes 454,600 Students' Data

ShinyHunters extortion gang claims responsibility for stealing 40GB of student records from the University of Nottingham, including passport numbers, payment details, and personal information across UK, Malaysia, and China campuses.

Manaal Khan·11 Jun 2026

Cybersecurity·5 min

Ivanti Sentry Exploit Goes Live: Most Exposed Gateways Backdoored

A maximum severity vulnerability in Ivanti Sentry is being actively exploited just one day after patches were released. Shadowserver reports that most internet-exposed Sentry gateways are already compromised, with attackers gaining root access through trivial command injection.

Huma Shazia·11 Jun 2026

Cybersecurity·6 min

npm v12 Blocks Install Scripts by Default to Stop Supply-Chain Attacks

GitHub will ship npm v12 next month with a secure-by-default posture. The update disables automatic execution of preinstall, install, and postinstall scripts. It also blocks Git and remote URL dependencies unless developers explicitly approve them.

Manaal Khan·11 Jun 2026

Cybersecurity·5 min

ShinyHunters Steals Data From 100+ Organizations via PeopleSoft

The ShinyHunters extortion gang is exploiting Oracle PeopleSoft servers using a chain of old and zero-day vulnerabilities. The group claims to have compromised 300 instances across more than 100 organizations, with the education sector hit hardest.

Manaal Khan·11 Jun 2026

Cybersecurity·4 min

Microsoft Patches Exchange Server Zero-Day Used in Active Attacks

Microsoft has released security updates for a high-severity Exchange Server vulnerability that attackers were already exploiting in the wild. The flaw allows remote attackers to execute arbitrary JavaScript through Outlook Web Access with no privileges required.

Huma Shazia·10 Jun 2026

Cybersecurity·4 min

Microsoft Releases Windows 10 KB5094127 With 200 Security Fixes

Microsoft has released KB5094127 for Windows 10 Extended Security Update subscribers, patching 200 vulnerabilities including three zero-day flaws. The update also introduces Secure Boot certificate monitoring as current certificates expire this month.

Huma Shazia·10 Jun 2026

Cybersecurity·4 min

Veeam Patches Critical RCE Flaw in Backup & Replication

Veeam has patched a critical vulnerability in its Backup & Replication software that allows remote code execution on domain-joined servers. The flaw, rated 9.4 severity, can be exploited by any domain user with low privileges. Ransomware gangs have historically targeted Veeam servers to delete backups before deploying attacks.

Huma Shazia·9 Jun 2026

Cybersecurity·5 min

French Government Messaging App Tchap Breached via Hijacked Account

A threat actor used a compromised user account to breach Tchap, France's encrypted messaging platform for civil servants. The attacker claims to have scraped over 640,000 messages and exfiltrated 13.5GB of data from public chat rooms.

Manaal Khan·9 Jun 2026

Cybersecurity·4 min

CISA Orders Federal Agencies to Patch Check Point VPN Flaw by June 11

A critical authentication bypass vulnerability in Check Point VPN products is being actively exploited by Qilin ransomware affiliates. CISA has given federal agencies just three days to patch or mitigate CVE-2026-50751, which affects systems using the deprecated IKEv1 protocol.

Huma Shazia·9 Jun 2026

Cybersecurity·4 min

Google Patches Fifth Chrome Zero-Day of 2026

Google has released an emergency update to fix CVE-2026-11645, a high-severity vulnerability in Chrome's V8 JavaScript engine that attackers have actively exploited. This marks the fifth zero-day flaw patched in Chrome since January 2026.

Manaal Khan·9 Jun 2026

Cybersecurity·5 min

Gogs Patches Critical Zero-Day RCE Flaw After 90-Day Delay

Gogs released version 0.14.3 to fix a critical argument injection vulnerability that allowed authenticated users to execute arbitrary code on servers. The patch came 10 days after Rapid7 publicly disclosed the flaw, and nearly three months after the initial report. Over 2,300 internet-facing Gogs instances remain at risk until administrators upgrade.

Huma Shazia·8 Jun 2026

Cybersecurity·4 min

Oxford University Discloses Second Data Breach of 2026

The University of Oxford confirmed hackers compromised its CareerConnect platform on May 28, exposing names, emails, and encrypted passwords. This marks the second breach affecting the institution this year, following the Canvas LMS incident in early May.

Huma Shazia·8 Jun 2026

Cybersecurity·5 min

Meta AI Support Flaw Exposes 20,000 Instagram Accounts

Attackers exploited a verification gap in Meta's AI-powered account recovery system to hijack over 20,000 Instagram accounts. The flaw allowed password resets without confirming email ownership, bypassing two-factor authentication entirely.

Huma Shazia·8 Jun 2026

Cybersecurity·5 min

Chinese APT Hid in US Networks for 18 Months Using New Malware

A Chinese espionage group tracked as UNC5221 compromised an organization's network and its managed service provider, remaining undetected for at least 18 months. The attackers used previously undocumented malware called Plenet and AgentPSD alongside the Brickstorm backdoor to access Microsoft 365 environments.

Manaal Khan·6 Jun 2026

Cybersecurity·7 min

Verizon's 2026 DBIR: Vulnerability Exploits Now Top Breach Cause

Verizon's 2026 Data Breach Investigations Report shows vulnerability exploitation overtook credential theft as the leading initial access method for the first time in 19 years. The report also found that 67% of workers use AI tools via personal accounts on corporate devices, creating a shadow IT data loss pipeline invisible to traditional security tools.

Huma Shazia·5 Jun 2026

Cybersecurity·4 min

CISA Warns of Active Exploits Targeting Android, Linux Flaws

The U.S. Cybersecurity and Infrastructure Security Agency added two vulnerabilities to its Known Exploited Vulnerabilities catalog. Federal agencies must patch by June 5, 2026. The flaws affect Android 14-16 and multiple Linux kernel versions.

Manaal Khan·3 Jun 2026