Find what you’re looking for
Browse everything
6,838 results in Threat Reports
ShinyHunters Administrator Detained: FBI Cooperation Signals Major Cybercrime Crackdown
In September 2026, Jordanian authorities detained Saif al-Din Khader, known online as 'Rey,' a suspected administrator of the ShinyHunters cybercrime group. Rey has reportedly been cooperating with the FBI to identify other group members, marking a significant breakthrough in law enforcement's pursuit of the prolific data extortion collective. This follows the recent arrest of a 24-year-old Dutch national connected to ShinyHunters operations, indicating an intensified international crackdown on the group responsible for breaching over 140 organizations and extracting at least $70 million in extortion payments since 2025. This development highlights the evolving landscape of cybercriminal prosecution where traditional jurisdictional boundaries are dissolving, and cooperative international law enforcement is achieving unprecedented success against previously untouchable threat actors operating across multiple countries and digital platforms.
ShinyHunters Takedown: Key Lessons for Cloud Security in 2026
In October 2026, Jordanian authorities detained Saif al-Din Khader, known as 'Rey,' a key member of the ShinyHunters cybercrime group who is now cooperating with the FBI to identify other group members. This arrest follows ShinyHunters' September 2026 breach of FBI systems using an alleged Oracle PeopleSoft zero-day vulnerability, where the group claimed to steal 2-3TB of sensitive data including employee information and medical records. The detention is part of an international law enforcement crackdown that previously resulted in arrests in the Netherlands and represents a significant disruption to one of the world's most prolific data theft and extortion operations. This case highlights the escalating sophistication of cybercriminal organizations and law enforcement's evolving international cooperation strategies. ShinyHunters' focus on cloud SaaS environments and third-party integrations represents a growing trend in modern cyber threats, making this incident particularly relevant for organizations evaluating their cloud security posture and third-party risk management programs.
DTU Breach Exposes Critical Gaps in University Identity Management Security
In October 2026, the Technical University of Denmark (DTU) suffered a significant data breach when attackers used compromised credentials to access DTUBasen, the university's identity and access management system. The attackers downloaded a substantial amount of data potentially affecting up to 200,000 current and former users, including nearly 40,000 active users and around 160,000 former users. Exposed information included Danish civil registration numbers (CPR), full names, home addresses, profile pictures, work details, and next of kin information spanning over two decades of university records. This incident highlights the growing threat of credential-based attacks targeting educational institutions' identity management systems. As universities increasingly digitize their operations and store extensive historical data, they become attractive targets for cybercriminals seeking personal information for identity fraud and sophisticated phishing campaigns.
RemoteThreat Launches AI-Powered Red Team Platform to Counter Frontier AI Threats
RemoteThreat, a new offensive cybersecurity startup founded by Chris Thompson and Shawn Jones, emerged from stealth in 2025 with $7 million in pre-seed funding to revolutionize red team penetration testing. The platform leverages AI to help organizations test their defenses against increasingly sophisticated threats, moving beyond traditional three-week assessment models to provide scalable, real-time security validation. RemoteThreat builds custom tooling from scratch for each engagement, bypassing Tier 1 EDR solutions to simulate how nation-state actors and advanced ransomware groups operate in real environments. This development reflects the urgent evolution of offensive security testing as frontier AI models enable both defenders and attackers to operate at unprecedented speed and sophistication, fundamentally changing how organizations must approach cybersecurity validation.
CISA's Own Malcolm Platform Exposed: 15 Critical Vulnerabilities Threaten Infrastructure Monitoring
The Cybersecurity and Infrastructure Security Agency (CISA) disclosed 15 critical vulnerabilities in Malcolm, a network traffic analysis platform widely deployed across critical infrastructure sectors including energy, IT, and water systems. The vulnerabilities, ranging from cross-site scripting to OS command injection and authentication bypasses, affect versions prior to v26.06.0 released in September 2026. These flaws could allow unauthenticated attackers to execute arbitrary code, authenticated users to escalate privileges, and malicious actors to manipulate stored security data, potentially compromising the integrity of network monitoring in critical infrastructure environments. Organizations are urged to immediately update to the latest version and implement additional security controls, particularly for certificate validation in distributed deployments.
Critical ABB PCM600 Vulnerabilities Expose Energy Infrastructure to Privilege Escalation Attacks
ABB's Protection and Control IED Manager PCM600 version 2.14 and earlier contains two critical vulnerabilities (CVE-2026-15952 and CVE-2026-15953) that enable privilege escalation and path traversal attacks. CVE-2026-15952 allows attackers with local access to exploit the Scheduler Service running under LocalSystem to gain elevated privileges, while CVE-2026-15953 permits malicious project archive files to write content outside intended directories through insufficient path validation. These vulnerabilities impact energy sector critical infrastructure worldwide, potentially allowing attackers to gain system control or deploy malicious files in sensitive industrial control environments. These vulnerabilities highlight the growing threat to operational technology (OT) environments as attackers increasingly target industrial control systems. With energy infrastructure becoming a prime target for nation-state actors and ransomware groups, securing ICS/SCADA systems against privilege escalation and file manipulation attacks has become critical for maintaining grid stability and preventing operational disruptions.
CVE-2026-64892: Johnson Controls EasyIO Neo Debug Interface Vulnerability Exposes Building Systems
Johnson Controls disclosed CVE-2026-64892, a vulnerability in EasyIO Neo Series EC and CW Controllers that allows unauthorized access to sensitive information through exposed debug interfaces. The vulnerability affects building automation systems worldwide, including HVAC, lighting, and energy management controllers used in critical infrastructure sectors. Successful exploitation could enable attackers to gather system intelligence for follow-on attacks against operational technology environments. Johnson Controls released firmware patches (EC V3.3b64 and CW V3.3b26) and recommends implementing physical access controls and network monitoring as interim mitigations. This incident highlights the growing attack surface in IoT and OT environments, where legacy debug interfaces and insufficient access controls create persistent vulnerabilities that threat actors increasingly target to establish footholds in critical infrastructure systems.
CISA Elevates Fortinet FortiMail Path Traversal to Critical KEV Status
CISA has added CVE-2026-104286, a path traversal vulnerability in Fortinet FortiMail, to its Known Exploited Vulnerabilities (KEV) Catalog following evidence of active exploitation in the wild. This vulnerability allows attackers to bypass security controls and potentially gain unauthorized access to sensitive files and directories on affected FortiMail systems. The addition reinforces CISA's Binding Operational Directive (BOD) 26-04, which requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities that grant total control of assets post-exploitation. This incident highlights the ongoing targeting of enterprise email security solutions by threat actors, reflecting a broader trend of exploiting communication infrastructure vulnerabilities. Organizations rely heavily on email security gateways, making them attractive targets for initial access and data exfiltration campaigns.
Critical Vulnerabilities Expose Global EV Charging Infrastructure to Cyberattacks
In October 2026, CISA disclosed critical vulnerabilities in Monta's electric vehicle charging platform affecting all versions of monta.app. The vulnerabilities include missing authentication for WebSocket endpoints (CVE-2026-95102), lack of rate limiting enabling brute-force attacks (CVE-2026-97363), insufficient session management (CVE-2026-97212), and publicly exposed charging station credentials (CVE-2026-93474). These flaws allow attackers to impersonate charging stations, gain unauthorized administrative control, disrupt charging services, and potentially compromise the entire EV charging network infrastructure. The vulnerabilities affect critical energy and transportation infrastructure deployed worldwide. This incident highlights the growing cybersecurity risks in smart city and critical infrastructure as IoT devices proliferate without adequate security controls. With electric vehicle adoption accelerating globally and charging networks becoming essential infrastructure, these vulnerabilities expose systemic weaknesses in industrial control systems that could enable nation-state actors or cybercriminals to disrupt transportation and energy systems at scale.
CISA Adds Two Actively Exploited Zammad Vulnerabilities to KEV Catalog
CISA has added two critical Zammad vulnerabilities (CVE-2026-102489 and CVE-2026-102490) to its Known Exploited Vulnerabilities Catalog following evidence of active exploitation. These vulnerabilities involve session fixation and improper privilege management in Zammad's customer support platform, allowing attackers to hijack user sessions and escalate privileges. The additions reinforce BOD 26-04 requirements for federal agencies to prioritize rapid remediation of high-risk vulnerabilities that grant total system control post-exploitation. This incident highlights the growing threat landscape targeting help desk and customer service platforms, as attackers increasingly exploit these systems to gain initial access and pivot into enterprise networks. The simultaneous exploitation of multiple vulnerabilities in the same platform demonstrates sophisticated threat actor capabilities and the critical need for comprehensive vulnerability management programs.
Johnson Controls EasyIO Neo Cleartext Vulnerability Exposes Building Automation Credentials
Johnson Controls disclosed CVE-2026-64893, a medium-severity vulnerability affecting EasyIO Neo Series EC and CW Controllers used in building automation systems worldwide. The vulnerability allows attackers to intercept sensitive information including credentials and session data transmitted in cleartext over HTTP connections. Affected versions include EC Controllers V3.3b62 and V3.3b63, and CW Controllers V3.3b24 and V3.3b25, with fixes available in V3.3b64 and V3.3b26 respectively. This incident highlights the persistent security challenges in operational technology environments where legacy protocols and unencrypted communications remain prevalent. As building automation systems become increasingly connected and targeted by threat actors, the exposure of credentials through cleartext transmission represents a critical attack vector for lateral movement within enterprise networks.
MI5 Exposes Massive Chinese Academic Espionage Operation Targeting UK Universities
In September 2026, MI5 issued an unprecedented espionage alert revealing that China's Ministry of State Security (MSS) has been using the China General Technology Research Institute (CGTRI) as a front company to fund academic research. Over 100 UK-linked academics unknowingly contributed to research projects in artificial intelligence, cybersecurity, covert communications, and steganography that directly enhanced Chinese intelligence capabilities. The alert warns that continued collaboration could result in prosecution under the National Security Act 2023 for providing material assistance to foreign intelligence services. This incident highlights the evolving landscape of nation-state espionage, where traditional spying methods have been replaced by sophisticated academic infiltration programs targeting critical research areas including AI and cybersecurity technologies that can be weaponized for intelligence operations.