ShinyHunters claims it extracted roughly 3.65 TB of data from Instructure’s systems, affecting about 275 million people across nearly 9,000 institutions. This was not simply a broken Canvas instance: investigators say the attackers used compromised Salesforce credentials and API keys tied to Instructure’s SaaS stack, turning a single vendor compromise into a global extortion campaign. […]
Two critical Ivanti EPMM zero-days (CVE-2026-1281 and CVE-2026-1340) are being exploited in the wild to achieve unauthenticated remote code execution. Interim RPM patches stop the immediate attacks, but they must be re-applied after upgrades; a permanent fix is scheduled for EPMM 12.8.0.0 in Q1 2026. Observed exploitation and its immediate effects Attackers are sending simple, […]
Mozilla’s early access work with Anthropic’s Mythos model turned up 271 vulnerabilities in Firefox 150 — more than ten times the 22 issues Anthropic’s Opus 4.6 flagged in Firefox 148 — demonstrating a sharp jump in discovery rate that has immediate operational consequences for maintainers and defenders. What Mythos actually revealed in Firefox Mythos autonomously […]
A sophisticated, operator-run phishing campaign is using Google Ads to position Adversary-in-the-Middle (AiTM) pages in front of ManageWP and Google Ads users — a step beyond “simple” phishing that routinely defeats 2FA and abuses ad platform trust. What the attackers actually achieve and why a basic reading is wrong Rather than generic mass phishing, operators […]
A critical PAN-OS zero-day, CVE-2026-0300, is being actively exploited but only when Palo Alto Networks’ User-ID Authentication Portal is reachable from untrusted networks. Patches begin rolling out on May 13, 2026; until your appliances are updated, restricting or disabling the portal is the practical defense that changes your immediate risk profile. Portal-exposed versus default deployments: […]
Instructure’s Canvas platform has suffered a large-scale data theft that ShinyHunters says totaled 3.65 terabytes of information tied to roughly 275 million people at nearly 9,000 schools. The central signal: attackers repeatedly exploited third‑party integrations and cloud CRM access, not exposed passwords or direct financial systems. How attackers leveraged integrations and CRM access Security researchers […]
Deniss Zolotarjovs, a Latvian member of the Karakurt ransomware gang, was sentenced to 8.5 years in a U.S. federal prison after pleading guilty to coordinating ransom negotiations and running extortion strategies. His arrest in Georgia in late 2023, mid‑2024 extradition to the United States, and guilty plea in July 2025 mark the first U.S. conviction […]
A critical unauthenticated RCE in Weaver E‑cology 10.0 (CVE‑2026‑22679) was actively exploited in mid‑ to late‑March 2026 after the vendor released a patch on March 12; endpoint defenses intervened and prevented persistent compromise, leaving timely patching as the primary remediation. How the March exploitation sequence unfolded The vendor released a patch on March 12, 2026; […]
CISA’s addition of CVE-2025-60710 to the Known Exploited Vulnerabilities list makes a previously theoretical Windows Task Host privilege escalation a present operational threat: federal agencies have two weeks under BOD 22‑01 to patch, and all organizations should treat this as a priority where detection will not substitute for patching. CISA’s designation versus the bug’s mechanics […]
Microsoft’s April 2026 Windows 10 update (KB5082200) forces explicit user consent when opening .rdp files and stages new Secure Boot certificates; those are concrete, operator-level changes, but they do not make .rdp-based phishing impossible. Administrators need to treat the update as a change in control points, not a substitute for policy and training. How KB5082200 […]
Anthropic has simultaneously pushed Mythos into conversations at the highest levels of government and finance while locked in a legal fight with the Department of Defense—an unusual posture that makes Mythos a distinct governance and operational problem for banks, regulators, and infrastructure providers. What banks and financial regulators are being asked to weigh Mythos is […]
In early April 2026, a Magecart campaign used a tiny, deliberate evasion technique—embedding a base64 JavaScript skimmer in a 1×1 pixel SVG’s onload attribute—to harvest card data from nearly 100 Magento stores while exploiting the PolyShell vulnerability; official Adobe fixes remain in pre-release. What unfolded in early April and why the SVG matters Recommended Reading […]
