Lansing Community College is only now notifying 174,307 people that their personal data was exposed in a February 2025 breach — more than a year after the fact. The college spotted the intrusion within about a week, but the letters have taken until now. Hackers used compromised credentials to get in, reaching names, addresses, dates of birth, driver's license details and Social Security numbers.
LCC says there's no evidence the data was removed or misused, that other information it holds may also have been caught up, and that what was exposed varies by individual. The Michigan college is offering 24 months of free credit monitoring and identity protection, and says it has tightened its security practices since. No ransomware group has claimed responsibility.
Source: SecurityWeek
Lansing Community College is only now notifying 174,307 people that their personal data was exposed in a February 2025 breach — more than a year after the fact. The college spotted the intrusion within about a week, but the letters have taken until now. Hackers used compromised credentials to get in, reaching names, addresses, dates of birth, driver's license details and Social Security numbers.
LCC says there's no evidence the data was removed or misused, that other information it holds may also have been caught up, and that what was exposed varies by individual. The Michigan college is offering 24 months of free credit monitoring and identity protection, and says it has tightened its security practices since. No ransomware group has claimed responsibility.
Source: SecurityWeek
CISA added CVE-2022-0492 to its Known Exploited Vulnerabilities catalog on 2 June after confirming active exploitation in the wild — a four-year-old Linux kernel privilege escalation flaw, public for roughly three years, that attackers have only now started using. Kaspersky reported the exploitation a day before CISA's alert, without naming the attackers or victims.
The flaw (CVSS 7.8) targets the cgroups v1 release_agent feature, allowing attackers to execute arbitrary commands with root-level access — and potentially break out of containerized environments entirely. It's especially dangerous in cloud-native setups where containers rely on cgroups for resource isolation.
The federal remediation deadline was 5 June. Everyone else should move fast too: update the kernel, disable unprivileged user namespaces where you can, and audit container configurations for suspicious cgroup activity.
Source: Cybersecurity News
CISA added CVE-2022-0492 to its Known Exploited Vulnerabilities catalog on 2 June after confirming active exploitation in the wild — a four-year-old Linux kernel privilege escalation flaw, public for roughly three years, that attackers have only now started using. Kaspersky reported the exploitation a day before CISA's alert, without naming the attackers or victims.
The flaw (CVSS 7.8) targets the cgroups v1 release_agent feature, allowing attackers to execute arbitrary commands with root-level access — and potentially break out of containerized environments entirely. It's especially dangerous in cloud-native setups where containers rely on cgroups for resource isolation.
The federal remediation deadline was 5 June. Everyone else should move fast too: update the kernel, disable unprivileged user namespaces where you can, and audit container configurations for suspicious cgroup activity.
Source: Cybersecurity News
CISA added a critical vulnerability in the Mirasvit Full Page Cache Warmer extension for Magento 2 to its Known Exploited Vulnerabilities catalog on 3 June, giving federal agencies until 6 June to patch. The flaw, CVE-2026-45247, carries a near-perfect CVSS score of 9.8 and requires no authentication to exploit.
Attackers inject malicious PHP objects through the CacheWarmer cookie, which deserializes them without class restrictions and escalates to full remote code execution on Magento and Adobe Commerce servers. Imperva reports active exploitation began shortly after public disclosure on May 26.
Thousands of stores are at risk — any running a version before 1.11.12 should update immediately. Given exploitation started over a week ago, also check your logs for CacheWarmer cookies carrying base64-encoded serialized objects, which typically begin with "Tz," "Qz" or "YT."
Source: SecurityWeek
CISA added a critical vulnerability in the Mirasvit Full Page Cache Warmer extension for Magento 2 to its Known Exploited Vulnerabilities catalog on 3 June, giving federal agencies until 6 June to patch. The flaw, CVE-2026-45247, carries a near-perfect CVSS score of 9.8 and requires no authentication to exploit.
Attackers inject malicious PHP objects through the CacheWarmer cookie, which deserializes them without class restrictions and escalates to full remote code execution on Magento and Adobe Commerce servers. Imperva reports active exploitation began shortly after public disclosure on May 26.
Thousands of stores are at risk — any running a version before 1.11.12 should update immediately. Given exploitation started over a week ago, also check your logs for CacheWarmer cookies carrying base64-encoded serialized objects, which typically begin with "Tz," "Qz" or "YT."
Source: SecurityWeek
CISA added a high-severity SolarWinds Serv-U flaw, CVE-2026-28318 (CVSS 7.5), to its Known Exploited Vulnerabilities catalog on June 5, 2026 — the same day SolarWinds shipped the fix — with a remediation deadline of June 19 for federal agencies.
The vulnerability lets unauthenticated attackers crash Serv-U file transfer software remotely by sending a malicious POST request with a Content-Encoding: deflate header — no credentials required. That zero-privilege, network-accessible attack path makes it especially dangerous for organizations with Serv-U exposed to the internet. SolarWinds' own advisory made no mention of exploitation, and it's still unclear whether the flaw was used as a zero-day.
The fix is Serv-U 15.5.4 Hotfix 1, and the affected releases — 15.4.2, 15.5 and 15.5.1 — have already reached end of life, so some organisations will need an upgrade rather than a patch. Restrict Serv-U exposure behind a firewall or VPN, and monitor logs for suspicious POST requests.
Source: Cybersecurity News
CISA added a high-severity SolarWinds Serv-U flaw, CVE-2026-28318 (CVSS 7.5), to its Known Exploited Vulnerabilities catalog on June 5, 2026 — the same day SolarWinds shipped the fix — with a remediation deadline of June 19 for federal agencies.
The vulnerability lets unauthenticated attackers crash Serv-U file transfer software remotely by sending a malicious POST request with a Content-Encoding: deflate header — no credentials required. That zero-privilege, network-accessible attack path makes it especially dangerous for organizations with Serv-U exposed to the internet. SolarWinds' own advisory made no mention of exploitation, and it's still unclear whether the flaw was used as a zero-day.
The fix is Serv-U 15.5.4 Hotfix 1, and the affected releases — 15.4.2, 15.5 and 15.5.1 — have already reached end of life, so some organisations will need an upgrade rather than a patch. Restrict Serv-U exposure behind a firewall or VPN, and monitor logs for suspicious POST requests.
Source: Cybersecurity News
A critical vulnerability in the Everest Forms Pro WordPress plugin is under active attack, with Wordfence blocking over 29,300 exploitation attempts since April 13, 2026 — 17,900 of them on a single day, May 16. The flaw, CVE-2026-3300, scores a near-perfect 9.8 on the CVSS scale and affects all versions up to 1.9.12.
The bug lives in the plugin's "Complex Calculation" feature, where user inputs are concatenated into PHP code and passed to eval() without the single quotes being escaped. Attackers don't need credentials — they just submit a crafted form field. Sites that don't use Complex Calculation aren't exposed.
Most attacks aim to create rogue admin accounts via WordPress's own wp_insert_user() function, with one common payload creating a user named "diksimarina" — the foothold for uploading webshells and planting backdoors.
A patch (version 1.9.13) has been available since March 18. Update immediately.
Source: Cybersecurity News
A critical vulnerability in the Everest Forms Pro WordPress plugin is under active attack, with Wordfence blocking over 29,300 exploitation attempts since April 13, 2026 — 17,900 of them on a single day, May 16. The flaw, CVE-2026-3300, scores a near-perfect 9.8 on the CVSS scale and affects all versions up to 1.9.12.
The bug lives in the plugin's "Complex Calculation" feature, where user inputs are concatenated into PHP code and passed to eval() without the single quotes being escaped. Attackers don't need credentials — they just submit a crafted form field. Sites that don't use Complex Calculation aren't exposed.
Most attacks aim to create rogue admin accounts via WordPress's own wp_insert_user() function, with one common payload creating a user named "diksimarina" — the foothold for uploading webshells and planting backdoors.
A patch (version 1.9.13) has been available since March 18. Update immediately.
Source: Cybersecurity News
A debug setting accidentally left enabled in production releases of six Microsoft Android apps — Word, Excel, PowerPoint, OneNote, Loop and 365 Copilot — exposed billions of users to potential account takeover. Researchers at Enclave, who named the issue FlagLeft, found the flaw disabled a security check that prevents untrusted apps from grabbing Microsoft authentication tokens.
Any malicious Android app could silently request and receive login tokens, giving attackers access to emails, Teams messages and files. Worse, the stolen tokens were long-lived FOCI (Family of Client IDs) tokens that can be refreshed indefinitely and look identical to legitimate activity in logs, making detection nearly impossible.
Microsoft has patched all six apps, assigning CVE-2026-41100, CVE-2026-41101, CVE-2026-41102 and CVE-2026-42832. There's no confirmation the flaw was exploited before it was found — but if you have any of these apps installed, update them now.
Source: Dark Reading
A debug setting accidentally left enabled in production releases of six Microsoft Android apps — Word, Excel, PowerPoint, OneNote, Loop and 365 Copilot — exposed billions of users to potential account takeover. Researchers at Enclave, who named the issue FlagLeft, found the flaw disabled a security check that prevents untrusted apps from grabbing Microsoft authentication tokens.
Any malicious Android app could silently request and receive login tokens, giving attackers access to emails, Teams messages and files. Worse, the stolen tokens were long-lived FOCI (Family of Client IDs) tokens that can be refreshed indefinitely and look identical to legitimate activity in logs, making detection nearly impossible.
Microsoft has patched all six apps, assigning CVE-2026-41100, CVE-2026-41101, CVE-2026-41102 and CVE-2026-42832. There's no confirmation the flaw was exploited before it was found — but if you have any of these apps installed, update them now.
Source: Dark Reading
Bedfordshire Hospitals NHS Foundation Trust has revealed that personal data belonging to 32,927 patients was stolen and published online following the June 2024 ransomware attack on pathology supplier Synnovis. The stolen files cover patients who had laboratory or diagnostic results between 2011 and 2020, and were later posted on online forums.
The data was fragmented, incomplete and scattered across multiple documents, and it took specialists over a year to piece together — Synnovis only notified the trust in October 2025. Exposed information may include names, dates of birth, patient and NHS numbers, postcodes and test results.
The trust says there's no evidence the data has been misused. It has reviewed the material with forensic advisers, notified the Information Commissioner's Office and NHS England, and tightened its oversight of suppliers. Patients are urged not to click links or attachments in unexpected messages, and to be wary of calls or emails asking for personal information.
Source: BBC News
Bedfordshire Hospitals NHS Foundation Trust has revealed that personal data belonging to 32,927 patients was stolen and published online following the June 2024 ransomware attack on pathology supplier Synnovis. The stolen files cover patients who had laboratory or diagnostic results between 2011 and 2020, and were later posted on online forums.
The data was fragmented, incomplete and scattered across multiple documents, and it took specialists over a year to piece together — Synnovis only notified the trust in October 2025. Exposed information may include names, dates of birth, patient and NHS numbers, postcodes and test results.
The trust says there's no evidence the data has been misused. It has reviewed the material with forensic advisers, notified the Information Commissioner's Office and NHS England, and tightened its oversight of suppliers. Patients are urged not to click links or attachments in unexpected messages, and to be wary of calls or emails asking for personal information.
Source: BBC News
Kali365, a phishing-as-a-service platform the FBI warned about on 21 May 2026, has grown far more dangerous. Originally built to bypass MFA on Microsoft 365 accounts, it now impersonates AWS, Okta SSO, Xerox DocuShare, Germany's GMX, and a range of Russian platforms — Mail.ru, Yandex Disk, Odnoklassniki and MAX Messenger.
MAX Messenger is a Russian state-backed app the government has promoted as the country's national messaging service, reporting over 110 million registered users and more than 80 million daily active users as of April 2026.
Arctic Wolf researchers mapped 126 distinct malicious hosts running the same kit between 6 and 27 May. Kali365 abuses OAuth 2.0 device authorization: the attacker starts the login, then tricks the victim into approving it — so MFA is satisfied by the legitimate user and never blocks the theft.
At least 14 device code phishing kits are now circulating, including Tycoon2FA, Venom and CYB3R, and the threat is accelerating.
Defenders should restrict or disable device code flow via Conditional Access where it isn't needed, and block authentication-transfer policies. Arctic Wolf flags panel[.]securehubcloud[.]com as high-confidence C2, recommends blocking *.attachedfile[.]com as a unit, and identifies the kit by its "Preparing your secure document…" page.
Source: Dark Reading
Kali365, a phishing-as-a-service platform the FBI warned about on 21 May 2026, has grown far more dangerous. Originally built to bypass MFA on Microsoft 365 accounts, it now impersonates AWS, Okta SSO, Xerox DocuShare, Germany's GMX, and a range of Russian platforms — Mail.ru, Yandex Disk, Odnoklassniki and MAX Messenger.
MAX Messenger is a Russian state-backed app the government has promoted as the country's national messaging service, reporting over 110 million registered users and more than 80 million daily active users as of April 2026.
Arctic Wolf researchers mapped 126 distinct malicious hosts running the same kit between 6 and 27 May. Kali365 abuses OAuth 2.0 device authorization: the attacker starts the login, then tricks the victim into approving it — so MFA is satisfied by the legitimate user and never blocks the theft.
At least 14 device code phishing kits are now circulating, including Tycoon2FA, Venom and CYB3R, and the threat is accelerating.
Defenders should restrict or disable device code flow via Conditional Access where it isn't needed, and block authentication-transfer policies. Arctic Wolf flags panel[.]securehubcloud[.]com as high-confidence C2, recommends blocking *.attachedfile[.]com as a unit, and identifies the kit by its "Preparing your secure document…" page.
Source: Dark Reading
Attackers published malicious versions of 32 packages in Red Hat's @redhat-cloud-services npm scope on Monday, June 1 — all within 72 seconds, pointing to automation. Researchers traced the entry point to a compromised Red Hat employee GitHub account, with GitHub Actions OIDC credentials used to publish. The affected packages have drawn nearly 10 million downloads over their lifetime.
The malware is a variant of the "Mini Shai-Hulud" worm, carrying the internal name "Miasma: The Spreading Blight." It harvests GitHub secrets, npm tokens, cloud credentials, SSH keys, Kubernetes and Vault material and more, then exfiltrates to attacker-controlled servers. At least 210 repositories containing stolen credentials have been identified.
Attribution is open. TeamPCP released this worm's source code publicly the previous month, so researchers say it could be TeamPCP or a copycat.
Critically, the payload ran from a preinstall hook — it executed during npm install, before the package was ever imported. Whether your code called the library is irrelevant.
Red Hat has published clean versions of all 32 packages and removed the malicious ones. It says the packages were limited to internal development, never published for customer consumption, and that it found no impact to customer or partner environments.
If you installed a compromised version, treat the environment as breached. Rotate every reachable credential, check lockfiles and CI logs for the affected versions, and rebuild from clean environments rather than reusing runners, workspaces or cached node_modules.
Source: SecurityWeek
Attackers published malicious versions of 32 packages in Red Hat's @redhat-cloud-services npm scope on Monday, June 1 — all within 72 seconds, pointing to automation. Researchers traced the entry point to a compromised Red Hat employee GitHub account, with GitHub Actions OIDC credentials used to publish. The affected packages have drawn nearly 10 million downloads over their lifetime.
The malware is a variant of the "Mini Shai-Hulud" worm, carrying the internal name "Miasma: The Spreading Blight." It harvests GitHub secrets, npm tokens, cloud credentials, SSH keys, Kubernetes and Vault material and more, then exfiltrates to attacker-controlled servers. At least 210 repositories containing stolen credentials have been identified.
Attribution is open. TeamPCP released this worm's source code publicly the previous month, so researchers say it could be TeamPCP or a copycat.
Critically, the payload ran from a preinstall hook — it executed during npm install, before the package was ever imported. Whether your code called the library is irrelevant.
Red Hat has published clean versions of all 32 packages and removed the malicious ones. It says the packages were limited to internal development, never published for customer consumption, and that it found no impact to customer or partner environments.
If you installed a compromised version, treat the environment as breached. Rotate every reachable credential, check lockfiles and CI logs for the affected versions, and rebuild from clean environments rather than reusing runners, workspaces or cached node_modules.
Source: SecurityWeek
A security flaw in Palo Alto Networks' PAN-OS GlobalProtect VPN, tracked as CVE-2026-0257, is being actively exploited — and organizations running unpatched systems are at real risk. Attackers are forging authentication cookies to impersonate legitimate users and gain VPN access without valid credentials.
Palo Alto published its advisory on May 13, but Rapid7 confirmed successful exploitation across multiple customer environments as early as May 17 — including cookie authentication to the local admin account. A second wave on May 21 established working VPN tunnels with internal network access. CISA added the flaw to its Known Exploited Vulnerabilities catalog on May 29.
Palo Alto revised the CVSS score upward from 4.7 to 7.8, moving it from medium to high severity. Rapid7 argues it warrants critical-level urgency regardless — an unauthenticated admin VPN session into your internal network is serious.
Exposure is configuration-dependent: exploitation needs the authentication override feature enabled, with cookie encryption tied to a certificate an attacker can derive the public key from. If you can't patch immediately, disable authentication override or issue a dedicated certificate for it. Fixes span 10.2, 11.1, 11.2, 12.1 and Prisma Access — check the advisory for your branch.
Source: Dark Reading
A security flaw in Palo Alto Networks' PAN-OS GlobalProtect VPN, tracked as CVE-2026-0257, is being actively exploited — and organizations running unpatched systems are at real risk. Attackers are forging authentication cookies to impersonate legitimate users and gain VPN access without valid credentials.
Palo Alto published its advisory on May 13, but Rapid7 confirmed successful exploitation across multiple customer environments as early as May 17 — including cookie authentication to the local admin account. A second wave on May 21 established working VPN tunnels with internal network access. CISA added the flaw to its Known Exploited Vulnerabilities catalog on May 29.
Palo Alto revised the CVSS score upward from 4.7 to 7.8, moving it from medium to high severity. Rapid7 argues it warrants critical-level urgency regardless — an unauthenticated admin VPN session into your internal network is serious.
Exposure is configuration-dependent: exploitation needs the authentication override feature enabled, with cookie encryption tied to a certificate an attacker can derive the public key from. If you can't patch immediately, disable authentication override or issue a dedicated certificate for it. Fixes span 10.2, 11.1, 11.2, 12.1 and Prisma Access — check the advisory for your branch.
Source: Dark Reading
