BeyondMachines :verified:

https://infosec.exchange/@beyondmachines1

Enabling Good Cybersecurity for Everyone:
Automated cybersecurity tools, learning and expert guidance for individuals and companies of all sizes.
Because cybersecurity shouldn't be an enterprise feature.

Sometimes a bot, sometimes not.

Website: https://beyondmachines.net
Linkedin: https://www.linkedin.com/company/73905832/
GitHub: https://github.com/BeyondMachines

Public Key

npub1k0e4qe43k60xwvqduvnhntmw8p3aa8sfrg46pw4ja4jc8gqt3vgqmufvzu

NIP-05 Address

[email protected]

Profile Code

nprofile1qqst8u6sv6cmd8n8xqx7xfme4ahrsc77ncy352aqh2ew6evr5q9ckyqpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0ds9qrrc2

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub1k0e4qe43k60xwvqduvnhntmw8p3aa8sfrg46pw4ja4jc8gqt3vgqmufvzu

Show more details

Last Notes

2026-09-22 10:01:13 GMT

Ransomware Attack on DataHub Infrastructure Forces Nepal Stock Exchange Trading Halt
Nepal's stock exchange halted trading after a ransomware attack on third-party provider DataHub Pvt Ltd compromised the systems of 72 brokerage firms. The breach affected trading management, clearing, and payment systems, prompting an investigation by the Securities Board of Nepal into the market's infrastructure resilience.
****
#cybersecurity #infosec #incident #ransomware
https://beyondmachines.net/event_details/ransomware-attack-on-datahub-infrastructure-forces-nepal-stock-exchange-trading-halt-2-w-2-c-y/gD2P6Ple2L

2026-09-22 08:15:53 GMT

War going Agile
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/313/692/323/998/705/original/9de77f207a709960.png

2026-09-20 11:01:13 GMT

ShinyHunters Breaches Clop Ransomware Leak Site in Retaliatory Cyberattack
ShinyHunters breached and defaced the Clop ransomware gang's leak site by exploiting a Grav CMS file upload vulnerability, allegedly stealing Tor private keys and system logs. The attack is a retaliatory move in an ongoing feud over a stolen Oracle E-Business Suite exploit.
****
#cybersecurity #infosec #incident #ransomware
https://beyondmachines.net/event_details/shinyhunters-breaches-clop-ransomware-leak-site-in-retaliatory-cyberattack-5-m-2-7-h/gD2P6Ple2L

2026-09-20 09:01:12 GMT

CrowdSec Source Code Leak Linked to TanStack npm Supply Chain Attack
CrowdSec suffered a source code leak after attackers exploited a TanStack npm supply chain vulnerability to steal a former employee's GitHub credentials. The breach exposed 170 private repositories and personal data for 134 users and investors.
****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/crowdsec-source-code-leak-linked-to-tanstack-npm-supply-chain-attack-6-u-i-d-6/gD2P6Ple2L

2026-09-11 10:01:13 GMT

Nick Scali Discloses Cyberattack Affecting Operations and Customer Information
Nick Scali disclosed a cyberattack in August 2026 that disrupted sales and warehouse operations and exposed customer contact and delivery information. The Australian furniture retailer notified federal authorities and is contacting affected customers and restoring impacted systems.
****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/nick-scali-discloses-cyberattack-affecting-operations-and-customer-information-v-c-u-m-h/gD2P6Ple2L

2026-09-11 08:01:13 GMT

Check Point Patches Critical VPN Certificate Flaws Enabling Unauthenticated RCE
Check Point patched two critical 9.8-rated vulnerabilities in its VPN certificate handling that allow unauthenticated remote code execution. The flaws affect Security Gateways, Management Servers, and Spark Firewalls across multiple versions.
**If you use Check Point Quantum Gateways, Security Management Servers, or Spark Firewalls, patch them ASAP. Don't assume you're safe because VPN is switched off, since the flaw can still trigger if certificates exist. If you can't patch right away, disable implied VPN rules and restrict UDP ports 500 and 4500 to your known peer IPs only. Start planning replacement of any end-of-support R80.x/R81.x devices. Those will not be patched.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/check-point-patches-critical-vpn-certificate-flaws-enabling-unauthenticated-rce-w-l-o-8-e/gD2P6Ple2L

2026-09-07 14:01:31 GMT

Healing Paper Data Breach Exposes Medical Data of 220,000 Gangnam Unni Users
Healing Paper confirmed a data breach affecting approximately 220,000 Gangnam Unni users after attackers gained unauthorized access through the platform’s APIs. The exposed information includes personal details, consultation photos, treatment records, and payment-related information. Healing Paper also launched a verification tool so users can check whether their data was affected.
****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/healing-paper-data-breach-exposes-medical-data-of-220000-gangnam-unni-users-n-o-w-b-2/gD2P6Ple2L

2026-09-07 11:01:32 GMT

Mathspace Data Breach Impacts Over 1 Million Users in Australia and New Zealand
Mathspace confirmed a data breach affecting 1,079,819 individuals after attackers exploited an unpatched vulnerability in its self-hosted Metabase reporting system. The company took the compromised reporting system offline, notified Australian and New Zealand authorities, and began alerting affected users.
****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/mathspace-data-breach-impacts-over-1-million-users-in-australia-and-new-zealand-y-1-w-d-f/gD2P6Ple2L

2026-09-07 10:01:31 GMT

Partnership HealthPlan of California Reports Data Breach Affecting 1,500 Members
Partnership HealthPlan of California reported a data breach affecting 1,526 members after welcome packets containing sensitive personal information were mailed to incorrect recipients. The incident exposed names, dates of birth, and member identification numbers but did not involve financial or medical records.
****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/partnership-healthplan-of-california-reports-data-breach-affecting-1500-members-i-9-l-p-o/gD2P6Ple2L

2026-09-07 09:01:31 GMT

Natural Resources Wales Accidentally Publishes Sensitive Employee Diversity Data
Natural Resources Wales inadvertently published a spreadsheet on its public website containing sensitive diversity and equality data for employees who worked there between 2013 and 2018. The organization removed the file and notified the Information Commissioner’s Office.
****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/natural-resources-wales-accidentally-publishes-sensitive-employee-diversity-data-r-i-6-o-w/gD2P6Ple2L

2026-09-07 08:01:31 GMT

Microsoft Reports Nine Cloud Identity and AI Vulnerabilities Out of Patch Tuesday, Two Max Severity
Microsoft issued an out-of-band update on September 3, 2026, fixing nine cloud-platform vulnerabilities (eight critical, including two CVSS 10.0 flaws in Azure AD B2C and Azure AI Language Authoring), with the most consequential being two Entra ID bypasses. All were patched server-side with no customer action needed. The exposure duration is not clear.
**Microsoft already fixed all nine flaws on their side, so there's nothing for you to patch. Since attackers may have had a window before the fix, review your Entra ID and Azure sign-in logs and check for any unexpected new admin roles, app registrations, or service principals over the past few months. Don't assume your identity provider is safe by default: turn on alerting for unusual logins and privilege changes, and cut back permissions on service principals and apps to only what they actually need.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/microsoft-s-september-identity-batch-proves-the-authentication-gap-is-not-an-open-source-problem-n-h-9-a-h/gD2P6Ple2L

2026-09-06 14:01:31 GMT

MikroTik Patches Critical "MikroTrick" Exploit Chain Under Active Attack
MikroTik has patched six vulnerabilities, including the "MikroTrick" exploit chain, which allows unauthenticated attackers to gain full administrative control over RouterOS devices. CERT Polska confirmed active exploitation of these flaws. Attackers are creating unauthorized accounts and establishing persistent network tunnels.
**If you use MikroTik routers, first make sure the device is isolated from the internet and reachable only from trusted networks. Block SSH, WebFig, and bandwidth-test access from outside. Then install the fixed RouterOS version (7.23.4, 7.24.2, or 6.49.21 and newer) from the official MikroTik download page, check whether the device is Flagged as compromised, and delete any accounts you didn't create, such as one named "ops".**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/mikrotik-patches-critical-mikrotrick-exploit-chain-under-active-attack-8-j-y-e-y/gD2P6Ple2L

2026-09-06 12:01:31 GMT

Bennett College Reports Data Breach Affecting 30,000 Individuals
Bennett College suffered a network intrusion in late 2025 that exposed the sensitive personal and financial data of 30,000 individuals. The college isolated its systems and is providing credit monitoring services to the affected by the breach.
****
#cybersecurity #infosec #incident #ransomware
https://beyondmachines.net/event_details/bennett-college-reports-data-breach-affecting-30000-individuals-i-b-4-9-r/gD2P6Ple2L

2026-09-06 11:01:31 GMT

Plex Urges Immediate Updates After Patching Multiple Undisclosed Security Flaws
Plex has issued an urgent security update for Plex Media Server and Plex Desktop to address multiple undisclosed vulnerabilities. The company is urging for immediate updates across all platforms, including manual installations for NAS devices.
**Update your Plex server and desktop app to the latest version right now. Plex rarely emails users about security, so this update likely fixes a very serious problem that could let hackers into your home network.**
#cybersecurity #infosec #advisory #databreach
https://beyondmachines.net/event_details/plex-urges-immediate-updates-after-patching-multiple-undisclosed-security-flaws-3-l-y-8-k/gD2P6Ple2L

2026-09-06 10:01:30 GMT

Postgres MCP Pro Restricted-Mode Bypass Allows Arbitrary Host File Disclosure
Postgres MCP Pro version 0.3.0 contains a critical restricted-mode bypass (CVE-2026-85620) that allows unauthenticated attackers to read arbitrary files from the database host. The flaw is caused by an incomplete SQL validation in the Abstract Syntax Tree parser, enabling the execution of dangerous functions through FROM clauses.
**If you're running Crystal DBA's Postgres MCP Pro (version 0.3.0 or earlier), don't rely on its restricted mode to keep your AI agents in check. It can be bypassed to read files off your server, including passwords and private keys. Change the database account the MCP server uses to a least-privilege role, strip its superuser status and `pg_read_server_files` permission, and keep it off the internet until an official fix ships.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/postgres-mcp-pro-restricted-mode-bypass-allows-arbitrary-host-file-disclosure-t-6-8-7-8/gD2P6Ple2L

2026-09-06 09:01:31 GMT

Manning Regional Healthcare Center Reports Data Breach Affecting Patient Information
Manning Regional Healthcare Center reported a data breach to federal authorities after unauthorized access compromised the protected health information of 746 individuals. The breach involved sensitive patient data including medical records and insurance information.
****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/manning-regional-healthcare-center-reports-data-breach-affecting-patient-information-i-l-q-p-1/gD2P6Ple2L

2026-09-05 20:01:31 GMT

LHC Group Vishing Attack Exposes Protected Health Information
LHC Group suffered a data breach after an employee fell victim to a voice phishing attack, allowing the hackers to steal credentials and access patient files on a third-party platform. The breach exposed protected health information for thousands of individuals, including over 16,000 residents in Texas.
****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/lhc-group-vishing-attack-exposes-protected-health-information-n-w-d-k-x/gD2P6Ple2L

2026-09-05 09:01:31 GMT

Resource Center of Dallas Reports Data Breach Affecting 12,490 Individuals
The Resource Center of Dallas reported a data breach affecting 12,490 individuals after attackers accessed its network in February 2026.
****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/resource-center-of-dallas-reports-data-breach-affecting-12490-individuals-3-s-s-k-c/gD2P6Ple2L

2026-09-05 08:01:31 GMT

Google Patches Actively Exploited V8 Zero-Day in Chrome Update
Google released security updates for Chrome to patch 12 vulnerabilities, including an actively exploited V8 zero-day (CVE-2026-85046) that allows remote code execution.
**This one is urgent, because Chrome is being actively attacked. Update your Chrome and Chromium based browsers ASAP. This is not a time to delay the patch. All your tabs reopen.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/google-patches-actively-exploited-v8-zero-day-in-chrome-update-v-d-c-m-k/gD2P6Ple2L

2026-09-04 20:01:31 GMT

City of Roanoke Discloses Data Breach Three Months After Unauthorized Network Access
The City of Roanoke disclosed a data breach three months after an unidentified actor accessed sensitive departmental data, including Social Security and passport numbers. The city has engaged security experts and the FBI to investigate the five-day intrusion and strengthen its network architecture.
****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/city-of-roanoke-discloses-data-breach-three-months-after-unauthorized-network-access-l-6-3-s-r/gD2P6Ple2L

2026-09-04 10:01:31 GMT

HPE Patches Critical Remote Code Execution Flaw in ArubaOS-CX Switches
HPE patched 34 vulnerabilities in ArubaOS-CX, including a critical buffer overflow (CVE-2026-73749) that allows unauthenticated remote code execution. The update also addresses multiple high-severity flaws enabling command injection, authentication bypass, and unauthorized file writes.
**If you run HPE Aruba CX switches (10000, 6400, 8325, 6000 series), first make sure their management interfaces are not reachable from the internet and only accessible from a dedicated management VLAN on trusted networks. Then update the switches to AOS-CX 10.18.1002, 10.17.1030, 10.16.1060, 10.13.1190, or 10.10.1181, and change any factory-set passwords while you're there.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/hpe-patches-critical-remote-code-execution-flaw-in-arubaos-cx-switches-7-8-k-r-6/gD2P6Ple2L

2026-09-03 08:01:29 GMT

Attackers Exploit Critical Sangoma Switchvox Flaw to Deploy Reverse Shells
Sangoma patched 12 vulnerabilities in Switchvox, including a critical unauthenticated SQL injection (CVE-2026-9586) that attackers are currently using to gain remote code execution and steal authentication keys.
**If you run Sangoma Switchvox, first make sure it isn't reachable from the internet and can only be accessed from trusted networks, then update immediately to version 8.4.0.2. Anything on version 8.3 or earlier is being actively attacked. Because attackers have been stealing keys, tokens and user data, also check /var/log/switchvox/db-quirks.log for signs of SQL injection, block the IP 176.65.148.184, and reset passwords and signing keys if you find anything suspicious.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/attackers-exploit-critical-sangoma-switchvox-flaw-to-deploy-reverse-shells-b-w-f-y-c/gD2P6Ple2L

2026-09-02 13:01:31 GMT

Nephrology Associates Data Breach Exposes Sensitive Health Records of 24,000 Patients
Nephrology Associates, M.D., P.A. suffered a data breach affecting over 24,000 patients after unauthorized actors maintained network access for three months. The incident, claimed by multiple ransomware groups, resulted in the theft of Social Security numbers and sensitive medical treatment information.
****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/nephrology-associates-data-breach-exposes-sensitive-health-records-of-24000-patients-q-h-u-6-5/gD2P6Ple2L

2026-09-02 08:01:30 GMT

Attackers Exploit Critical JFrog Artifactory Flaw to Mint Admin Tokens
JFrog Artifactory is facing active exploitation of a critical authentication bypass (CVE-2026-82329) that allows unauthenticated attackers to mint administrator tokens and compromise software supply chains.
**If you run self-managed JFrog Artifactory, update to version 7.161.20 ASAP. Attackers are already exploiting this flaw to take full admin control. Primary systems at risk are internet facing self-hosted Artifactory instances. Cloud-hosted instances managed by JFrog are not affected.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/attackers-exploit-critical-jfrog-artifactory-flaw-to-mint-admin-tokens-f-g-f-4-3/gD2P6Ple2L

2026-09-01 12:01:41 GMT

State of (in)security - Week 35, 2026
Week 35 of 2026 saw 21 advisories and 20 incidents, with breaches affecting roughly 21.7 million people. The largest incident is being ShinyHunters' leak of 12.9 million Carhartt accounts, part of a broader ShinyHunters campaign also hitting McKesson and Baxter. Attacks were driven mainly by unauthorized access, ransomware, phishing, and third-party compromise (mostly in manufacturing, government, and healthcare). Critical vulnerabilities were patched in widely used software like Chrome, Next.js, Apache Tomcat, ServiceNow, Keycloak, and several WordPress plugins.
**Update Chrome/Chromium browsers and start patching WordPress plugins. This week is heavy on WordPress issues.**
#cybersecurity #infosec #knowledge #weeklyreport
https://beyondmachines.net/event_details/state-of-in-security-week-35-2026-z-p-t-j-x/gD2P6Ple2L

2026-08-29 08:01:41 GMT

ServiceNow Patches Three Critical 10.0 Severity Flaws in AI Platform
ServiceNow released emergency patches for three critical vulnerabilities (CVSS 10.0) and one high-severity flaw in its AI Platform that allow unauthenticated remote code execution and SQL injection. These flaws put sensitive enterprise data and connected corporate systems at risk of full takeover.
**If you self-host ServiceNow, apply the vendor patches ASAP: Xanadu Patch 11, Yokohama Patch 12/13, or Zurich Patch 7-12. Cloud-hosted instances are already fixed. Then check your logs for unusual GraphQL requests or unexpected admin account changes. If possible limit which ServiceNow interfaces are reachable from the internet.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/servicenow-patches-three-critical-10-0-severity-flaws-in-ai-platform-l-6-r-p-l/gD2P6Ple2L

2026-08-28 14:01:41 GMT

Manchester Airports Group Cyberattack Exposes Data of 8.7 Million Customers
Manchester Airports Group suffered a ransomware attack that exposed the personal data of 8.7 million customers across three major UK airports. The breach affected booking and Wi-Fi registration systems but did not disrupt flight operations or compromise payment information.
****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/manchester-airports-group-cyberattack-exposes-data-of-8-7-million-customers-6-h-o-9-3/gD2P6Ple2L

2026-08-26 17:01:20 GMT

CISA Reports Actively Exploited Gitea Critical RCE Vulnerability
Gitea patched a critical remote code execution vulnerability (CVE-2026-60004) that attackers are actively exploiting to install crypto-miners on self-hosted instances. The flaw allows users with write access to inject malicious Git hooks via the diffpatch API, potentially exposing database credentials and system secrets.
**Update self-hosted Gitea instances to version 1.27.1 immediately. Now it's urgent, since hackers are actively attacking you. If you can't patch right away, disable public registration to prevent new outsiders from obtaining repository write access. This does not protect against existing users who already have the required permissions.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/cisa-reports-actively-exploited-gitea-critical-rce-vulnerability-2-1-9-j-5/gD2P6Ple2L

2026-08-26 10:01:42 GMT

Zscaler Patches Critical Unauthenticated RCE in Client Connector for Windows
Zscaler fixed a critical vulnerability (CVE-2026-59568) that allowed unauthenticated remote code execution and privilege escalation as well as three other flaws in its Client Connector for Windows
**If you use Zscaler Client Connector on Windows, update every endpoint to the latest patched version. Anything released before June 2026 (including 4.7.0.364, 4.8.0.232/284/291, and 4.9.0.448/455) is at risk of remote takeover. Don't assume your automated update policy reached every machine; manually verify the version on all devices. Check endpoint logs for odd processes launched by Zscaler components or unexpected new listening services.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/zscaler-patches-critical-unauthenticated-rce-in-client-connector-for-windows-x-x-2-j-a/gD2P6Ple2L

2026-08-24 15:01:16 GMT

Critical Keycloak Password Reset Flaw Allows Unauthenticated Account Takeover
Red Hat and Keycloak patched a critical vulnerability (CVE-2026-18963) that allows unauthenticated attackers to bypass email verification and take over any account via the password reset flow. The update also addresses over 20 other security flaws, including account-linking bypasses and administrative permission leaks.
**If you run Keycloak or Red Hat Build of Keycloak, update immediately to Keycloak 26.7.2 or RHBK 26.4.15 / 26.6.6 since the older versions let anyone reset the password of any account, including admins. If you cannot patch right away, turn off the "Forgot password" option in every realm (Realm settings → Login → Forgot password) until the update is applied.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/critical-keycloak-password-reset-flaw-allows-unauthenticated-account-takeover-p-n-m-j-1/gD2P6Ple2L

2026-08-21 17:01:16 GMT

Mon Health Medical Center Discloses Phishing Breach Affecting Patient Data
Mon Health Medical Center reported a data breach affecting 2,173 individuals after a phishing attack allowed unauthorized access to internal email mailboxes. The hospital is providing two years of credit monitoring and has notified federal authorities.
****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/mon-health-medical-center-discloses-phishing-breach-affecting-patient-data-0-1-l-j-f/gD2P6Ple2L

2026-08-21 13:01:26 GMT

Citrix NetScaler Flaws Under Active Attack Following Exploit Release
Citrix NetScaler ADC and Gateway appliances are being exploited via a critical SAML memory overflow vulnerability (CVE-2026-8452) that allows pre-authentication remote code execution. Attackers are targeting perimeter devices to gain unauthorized access to internal corporate networks following the release of public proof-of-concept code.
**If you run Citrix NetScaler ADC or Gateway, patch immediately to version 14.1-72.61 or 13.1-63.18 (or the matching FIPS builds). Attackers are already exploiting these appliances and a public exploit PoC is available. If you can't patch right away, restrict the management interface to trusted internal networks only, review your SAML configuration, and check logs for unexpected admin logins or config changes.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/citrix-netscaler-flaws-under-active-attack-following-exploit-release-e-x-8-8-4/gD2P6Ple2L

2026-08-21 09:01:12 GMT

Critical Zimbra RCE Vulnerability Exploited in Global Attacks
Zimbra patched nine vulnerabilities in its Collaboration Suite, including a critical RCE flaw (CVE-2026-73570) that attackers are currently exploiting to take control of mail servers. Organizations should update to version 10.1.20 and check logs for signs of compromise.
**If you run Zimbra Collaboration Suite, update to version 10.1.20 ASAP. Attackers are already exploiting this to take over mail servers, and everything older is vulnerable. Because this flaw is being actively exploited, also check for signs of breach: look for unexpected files in `/opt/zimbra/jetty/webapps/` and `/tmp/`, and review `/var/log/zimbra.log` for services restarting on their own.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/critical-zimbra-rce-vulnerability-exploited-in-global-attacks-p-1-4-k-y/gD2P6Ple2L

2026-08-20 09:01:03 GMT

BitBox Patches Firmware Flaws
BitBox released the Dixence update to fix three firmware vulnerabilities, including a bootloader flaw and memory corruption, that could allow attackers to steal funds or execute code.
**If you own a BitBox02 or BitBox02 Nova hardware wallet, update it to firmware 9.26.5 right away using only the official BitBoxApp downloaded from bitbox.swiss, and verify the app's signature before installing. Never enter your recovery words into any computer or phone, and if you used Silent Payments recently, double-check your funds arrived at the right address before sending more.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/bitbox-patches-firmware-flaws-g-w-8-m-a/gD2P6Ple2L

2026-08-20 08:01:03 GMT

Ray Framework Remote Code Execution Vulnerability Under Active Exploitation
CISA warned that attackers are exploiting a remote code execution vulnerability in the Ray framework to target machine learning developers. The flaw allows attackers to bypass browser security checks and run arbitrary commands on developer machines and internal networks.
**If you use the Ray framework, update it to version 2.52.0 or later ASAP. Attackers are actively exploiting CVE-2025-62593 to run commands on developer machines. Also make sure Ray is never reachable from the internet and only accessible from trusted networks, and watch for unusual traffic between developer laptops and your internal compute clusters.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/ray-framework-remote-code-execution-vulnerability-under-active-exploitation-y-u-w-h-s/gD2P6Ple2L

2026-08-19 14:01:23 GMT

Cameron Regional Medical Center Disclosed Ransomware Attack
Cameron Regional Medical Center disclosed a ransomware attack involving potential unauthorized access to sensitive patient information. The Anubis ransomware group claimed responsibility and alleged it stole patient and employee data. CRMC continues to investigate the scope of the incident.
****
#cybersecurity #infosec #incident #ransomware
https://beyondmachines.net/event_details/cameron-regional-medical-center-disclosed-ransomware-attack-3-1-b-n-p/gD2P6Ple2L

2026-08-19 08:01:23 GMT

Attackers Exploit a Critical MLflow Vulnerability
Attackers are actively exploiting a critical flaw in MLflow (CVE-2026-64849) to steal cloud credentials and gain remote code execution.
**If you run MLflow, update it to version 3.15.0 or later ASAP, and make sure the server is not reachable from the internet. Then check your audit logs for any odd requests to cloud metadata services. If you see any (or aren't sure), rotate your cloud credentials and keys as a precaution.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/attackers-exploit-a-critical-mlflow-vulnerability-3-u-3-k-6/gD2P6Ple2L

2026-08-18 11:01:46 GMT

GitLab Issues Emergency Patch for Critical GraphQL Flaw Allowing Remote Project Deletion
GitLab issued an emergency security update to fix a critical GraphQL code injection vulnerability (CVE-2026-19478) that allows unauthenticated attackers to remotely delete or modify public projects and user data.
**If you run a self-managed GitLab server (version 18.2 through 19.2.3), update it ASAP to 19.2.4, 19.1.6, 19.0.8, or 18.11.11. The patch is quick and won't take your system offline. Before you patch, check your logs for unusual GraphQL activity so you know nobody has already deleted or altered your projects or user data.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/gitlab-issues-emergency-patch-for-critical-graphql-flaw-allowing-remote-project-deletion-k-u-c-h-x/gD2P6Ple2L

2026-08-17 20:01:45 GMT

Terry J. Dubrow Plastic Surgery Practice Reports Long-Term Data Breach
Terry J. Dubrow, MD, A Medical Corporation reports a data breach where an attacker accessed patient records including Social Security numbers and medical images over an eighteen-month period. The practice has notified the FBI and is offering identity protection services to affected individuals.
****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/terry-j-dubrow-plastic-surgery-practice-reports-long-term-data-breach-7-3-p-d-h/gD2P6Ple2L

2026-08-17 19:01:46 GMT

State of (in)security - Week 33, 2026
During week 33 of 2026 (Aug. 10–17), there were 9 advisory/vulnerability events and 42 incidents affecting roughly 39.5 million people, a sharp rise from the prior week. Unauthorized access, ransomware/malware, and third-party compromises were leading causes, and healthcare, government, and IT hit hardest. Major items included Poland's medical data breach affecting 19 million citizens, actively exploited flaws in Magento, VMware vCenter, SharePoint, GeoServer and SAP, and large patch releases from Microsoft (421 fixes), SAP, Siemens, Adobe and Zoom.
**Update your Mac and Zoom today, both have flaws attackers are already using to take over machines with no password and no clicks from you. If you run servers, patch anything internet-facing first: vCenter, SharePoint, Adobe Commerce/Magento, and SAP Commerce Cloud are all under active attack right now. Then push the regular Windows update.**
#cybersecurity #infosec #knowledge #weeklyreport
https://beyondmachines.net/event_details/state-of-in-security-week-33-2026-v-m-1-n-l/gD2P6Ple2L

2026-08-17 18:01:46 GMT

Shell Investigates 89 GB Data Theft Claim by Cl0p Ransomware Group
Shell is investigating a security incident after the Cl0p ransomware group claimed to have stolen 89 GB of internal company data. The incident appears connected to a wider campaign targeting PTC Windchill and FlexPLM systems.
****
#cybersecurity #infosec #incident #ransomware
https://beyondmachines.net/event_details/shell-investigates-89-gb-data-theft-claim-by-cl0p-ransomware-group-3-m-n-0-x/gD2P6Ple2L

2026-08-17 10:01:48 GMT

Ollie’s Place Investigates Ransomware Attack on Point-of-Sale System Claimed by The Gentlemen
Australian kidswear retailer Ollie’s Place is investigating a ransomware attack after a point-of-sale system was rendered unusable. The Gentlemen group listed the company on its dark web leak site and claimed responsibility for the attack.
****
#cybersecurity #infosec #incident #ransomware
https://beyondmachines.net/event_details/ollies-place-targeted-in-ransomware-attack-claimed-by-the-gentlemen-l-1-x-2-f/gD2P6Ple2L

2026-08-16 11:01:08 GMT

Apple Patches Actively Exploited macOS Screen Sharing Vulnerability Used in Crypto Mining Attacks
Apple patched a macOS Screen Sharing vulnerability (CVE-2026-65400) that allows remote attackers to bypass authentication and gain root access. Attackers are actively exploiting the flaw to install Monero crypto miners on systems with port 5900 exposed to the internet.
**If you use a Mac, update macOS now to Tahoe 26.6.1, Sequoia 15.7.9, or Sonoma 14.8.9 to fix CVE-2026-65400, which attackers are already using to take full control of Macs without a password. Also turn off Screen Sharing when you don't need it and make sure port 5900 is not reachable from the internet.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/apple-patches-actively-exploited-macos-screen-sharing-vulnerability-used-in-crypto-mining-attacks-n-5-j-v-1/gD2P6Ple2L

2026-08-16 08:01:08 GMT

London Metropolitan Police Accidentally Exposes Email Addresses of 143 Al-Fayed Abuse Victims
The London Metropolitan Police accidentally disclosed the email addresses of 143 sexual abuse complainants by failing to use the BCC function in a monthly update email. The force notified the Information Commissioner's Office and is reviewing its communication processes to prevent future privacy breaches.
****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/london-metropolitan-police-accidentally-exposes-email-addresses-of-143-al-fayed-abuse-victims-8-v-2-b-6/gD2P6Ple2L

2026-08-15 16:01:09 GMT

Suspicious Activity Disrupts Douglas County Sheriff's Office Computer Systems
The Douglas County Sheriff's Office in Kansas is investigating suspicious activity that forced public-facing systems, including jail booking logs, offline. Emergency services are functional and forensic teams work to determine the scope of the potential breach.
****
#cybersecurity #infosec #incident #ransomware
https://beyondmachines.net/event_details/suspicious-activity-disrupts-douglas-county-sheriff-s-office-computer-systems-8-n-9-k-r/gD2P6Ple2L

2026-08-15 15:01:37 GMT

Ransomware Attack Disrupts Critical Facility Systems at Winnipeg Health Sciences Centre
Health Sciences Centre Winnipeg and Cancer Care Manitoba suffered a ransomware attack on August 10, 2026, that disabled HVAC monitoring and door access systems. Clinical operations are not affected. The hospital is investigating potential unauthorized access to employee personal information.
****
#cybersecurity #infosec #incident #ransomware
https://beyondmachines.net/event_details/ransomware-attack-disrupts-critical-facility-systems-at-winnipeg-health-sciences-centre-o-k-1-8-m/gD2P6Ple2L

2026-08-14 14:01:36 GMT

Optalis Management Solutions Discloses Data Breach Affecting Over 13,000 Individuals
Optalis Management Solutions suffered a data breach in April 2025 that exposed the protected health information and financial details of 13,723 individuals. The company completed its investigation in June 2026 and is offering credit monitoring services to those whose Social Security numbers were compromised.
****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/optalis-management-solutions-discloses-data-breach-affecting-over-13000-individuals-w-l-q-t-l/gD2P6Ple2L

2026-08-14 12:32:59 GMT

- reply

Yes. All that.
Plus the ability to change a policy and start charging for "copyright".
The AI grifters already showed they won't bat an eye doing and admitting to actual crimes.
I'll let this stand here, and time will tell.

2026-08-14 11:54:30 GMT

Watermarking the theft.
Like cattle rustlers branding the stolen cattle.
Oh, wait. They weren't given investments....
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/093/710/063/991/926/original/9d9bcf65da5f891e.png

2026-08-14 08:01:37 GMT

TeamPCP Supply Chain Attack on LiteLLM Has Exposed Secrets of 2,500 Organizations
The TeamPCP threat group executed a massive supply-chain attack against LiteLLM by exploiting a vulnerability in the Trivy scanner to steal PyPI publishing credentials. The breach exposed 195TB of cloud keys, repository tokens, and AI API keys belonging to over 2,500 organizations worldwide.
**Assume anything you pull from a public registry can turn hostile overnight: pin dependencies and CI actions to an exact verified hash, never let build pipelines install tools "latest" from a package manager, and keep build machines on short-lived, least-privilege credentials so a poisoned package steals little and only briefly. Then rehearse the recovery: know which secrets each pipeline can reach, be able to rotate them all in hours rather than weeks, and watch your build systems for outbound connections and new persistence just as closely as you watch production.**
#cybersecurity #infosec #knowledge #awareness
https://beyondmachines.net/event_details/teampcp-supply-chain-attack-on-litellm-has-exposed-secrets-of-2500-organizations-a-x-8-y-c/gD2P6Ple2L

2026-08-13 20:01:36 GMT

Yorkshire's Brain Tumour Charity Affected by Third-Party Beacon CRM Data Breach
Yorkshire's Brain Tumour Charity disclosed a data breach involving third-party service provider Beacon CRM after attackers used compromised credentials to access customer database backups. The incident potentially exposed supporter information, including health and donation data.
****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/yorkshire-s-brain-tumour-charity-affected-by-third-party-beacon-crm-data-breach-8-w-3-d-u/gD2P6Ple2L

2026-08-11 17:01:28 GMT

Polish CHP Plant Disrupted Through Private Cellular Network Attack
Attackers breached a Polish CHP plant by moving laterally through a private cellular network, shutting down a steam turbine and process-water treatment system. The attack did not disrupt heat or electricity supplies to customers.
****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/polish-chp-plant-disrupted-through-private-cellular-network-attack-6-l-m-i-d/gD2P6Ple2L

2026-08-11 11:31:42 GMT

#AI rules to live by
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/076/647/360/723/238/original/462d4933caaee882.png

2026-08-10 20:01:25 GMT

Valve Customer Data Exposed by Cyberattack at CEVA Logistics
CEVA Logistics suffered a cyberattack that allowed hackers to steal shipping information for European Valve Steam hardware. The breach exposed names, addresses, and contact details.
****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/valve-customer-data-exposed-by-cyberattack-at-ceva-logistics-t-e-9-2-o/gD2P6Ple2L

2026-08-10 09:01:51 GMT

Guardian Credit Union Data Breach Exposes Social Security Numbers and Financial Data
Guardian Credit Union disclosed a data breach involving Social Security numbers, driver’s license information, and financial account information after detecting suspicious activity. The credit union is offering 24 months of complimentary credit monitoring and identity protection services to affected individuals.
****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/guardian-credit-union-data-breach-exposes-social-security-numbers-and-financial-data-x-d-w-7-o/gD2P6Ple2L

2026-08-09 15:01:07 GMT

Hacktivists Breach TrueConf Servers to Deploy Trojanized Client Backdoors
TrueConf video conferencing servers were breached by hacktivist group to distribute trojanized client installers containing the PhantomCore and PhantomGraph backdoors. The attack chain uses unauthenticated script execution and sandbox escape vulnerabilities to gain full system control and steal sensitive credentials.
**If you run TrueConf, update your server right away to version 5.3.9, 5.4.9, or 5.5.5 and make sure every client is on version 8.5.3 or later. Before installing any TrueConf update, check that the installer has a valid digital signature. If your server was running an old version, treat it as compromised and check it for backdoors.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/hacktivists-breach-trueconf-servers-to-deploy-trojanized-client-backdoors-e-j-f-q-g/gD2P6Ple2L

2026-08-09 13:31:04 GMT

What is your recruitment process?
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/065/792/382/065/664/original/04ec261fbfb587f5.png

2026-08-09 12:01:07 GMT

Third-Party Breach at ING's Logistics Partner Exposes Customer Data From ING Punten Orders
ING has reported a breach at a third-party logistics partner, widely linked in Dutch media to CEVA Logistics. Attackers may have accessed contact details and order data of customers who redeemed ING Punten for physical goods. ING's own systems, accounts, payment data and credentials remained untouched.
****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/third-party-breach-at-ing-s-logistics-partner-exposes-customer-data-from-ing-punten-orders-k-p-2-v-5/gD2P6Ple2L

2026-08-09 11:01:07 GMT

Supply Chain Breach at CEVA Logistics Impacts AFC Ajax
AFC Ajax suffered a data breach after unauthorized individuals compromised systems at their logistics partner, CEVA Logistics. The incident potentially exposed customer contact and order details, leading to suspended data exchanges and an investigation by the Dutch Data Protection Authority.
****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/supply-chain-breach-at-ceva-logistics-impacts-afc-ajax-e-1-u-y-3/gD2P6Ple2L

2026-08-08 15:01:07 GMT

Beacon CRM Breach Impacts 1,500 UK Charities and Sensitive Donor Data
Beacon CRM suffered a data breach impacting 1,500 UK charities after an attacker used a compromised AWS access key to steal database backups. The exposed information includes donor names, contact details, and Gift Aid declarations.
****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/beacon-crm-breach-impacts-1500-uk-charities-and-sensitive-donor-data-o-y-2-8-z/gD2P6Ple2L

2026-08-08 13:27:27 GMT

- reply

https://infosec.exchange/@beyondmachines1/117053769189226151
#note1rqr…ymp4

2026-08-08 12:41:26 GMT

Have we reached peak #AI #Idiocracy ?
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/059/931/314/977/732/original/dab97f4392b95315.png

2026-08-08 09:01:06 GMT

Framework Computer Notifies All Customers of Data Breach Following Metabase Zero-Day Exploit
Framework Computer suffered a data breach affecting all customers after attackers exploited a critical zero-day SQL injection vulnerability in the Metabase business intelligence platform. The incident exposed personal contact details and IP addresses but did not compromise payment information.
****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/framework-computer-notifies-all-customers-of-data-breach-following-metabase-zero-day-exploit-v-k-n-7-f/gD2P6Ple2L

2026-08-08 08:01:07 GMT

Metabase Patches Critical Zero-Day SQL Injection Exploited in the Wild
Metabase patched a critical zero-day SQL injection vulnerability (GHSA-vwf4-m7j8-wcjf, CVSS 10.0) that is actively exploited to gain administrator access and steal database credentials.
**If you run self-hosted Metabase (version 1.58 or newer), this is urgent. Your Metabase is under attack. Update immediately to the patched release for your branch (0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, or 0.63.5). if you can't patch right now, block all traffic to the /api/session/reset_password endpoint as a stopgap. After patching, check your application and ingress logs for a failed password-reset POST followed straight away by a successful /api/user/current request. Tf you see it, treat the instance as breached: clear the core_session table to log everyone out, rotate all connected database passwords, and check your admin accounts for anything you didn't create.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/metabase-patches-critical-zero-day-sql-injection-exploited-in-the-wild-g-o-s-u-u/gD2P6Ple2L

2026-08-07 14:46:28 GMT

- reply

Nope. That would require an *intelligent* digital entity. Not a statistical parrot.
And even the decadence and decline of Tessier-Ashpool are not at the level of this breed of grifters.

2026-08-07 14:43:45 GMT

- reply

Are we rewriting Neuromancer?

2026-08-07 14:42:25 GMT

- reply

not even fired

2026-08-07 14:01:07 GMT

Heart of America Medical Center Discloses Ransomware Breach Affecting Patient Records
Heart of America Medical Center disclosed a data breach that exposed sensitive patient information, including Social Security numbers and medical records. The hospital is notifying affected individuals and offering 24 months of complimentary credit monitoring and fraud assistance services.
****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/heart-of-america-medical-center-discloses-ransomware-breach-affecting-patient-records-y-c-4-a-j/gD2P6Ple2L

2026-08-07 10:32:53 GMT

The state of #AI
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/053/768/550/585/906/original/4e0310fe3d499877.png

2026-08-07 09:01:07 GMT

Veeam ONE Patches Critical Remote Code Execution and SQL Injection Flaws
Veeam ONE version 13 contains six vulnerabilities, including a CVSS 10.0 critical remote code execution flaw and a high-severity SQL injection bug. These vulnerabilities allow unauthenticated attackers to take over agent hosts, read arbitrary files, and extract sensitive database information.
**If you run Veeam ONE version 13, update it to build 13.1.0.7034. One of these flaws (CVE-2026-64633) lets an attacker take over the system remotely without any login or clicks from you. While you're at it, make sure Veeam ONE is only reachable from your trusted admin network, not from the internet or the general user network.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/veeam-one-patches-critical-remote-code-execution-and-sql-injection-flaws-q-a-8-7-1/gD2P6Ple2L

2026-08-06 08:01:09 GMT

De Bijenkorf Warns of Potential Data Exposure Following Third-Party Logistics Breach
Luxury department store chain De Bijenkorf reported a data breach originating at its logistics partner, CEVA Logistics, which potentially exposed customer contact details and purchase history.
****
#cybersecurity #infosec #incident #ransomware
https://beyondmachines.net/event_details/de-bijenkorf-warns-of-potential-data-exposure-following-third-party-logistics-breach-r-g-s-v-z/gD2P6Ple2L

2026-08-05 20:01:06 GMT

Actively Exploited IBM Langflow Vulnerability Allows Unauthenticated Remote Code Execution
IBM Langflow OSS injection vulnerability (CVE-2026-9198)is actively exploited. CISA has added the flaw to its Known Exploited Vulnerabilities catalog and requires immediate patching/
**If you run IBM Langflow OSS (versions 1.0.0 through 1.10.0), update to version 1.10.1 or later immediately. Attackers are already using this flaw to take over servers. If you can't update immediately, take the Langflow instance off the internet, and check your logs for unexpected superuser tokens or odd Python code being run.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/actively-exploited-ibm-langflow-vulnerability-allows-unauthenticated-remote-code-execution-1-k-n-g-e/gD2P6Ple2L

2026-08-05 12:01:06 GMT

Vincennes School District Shuts Down Servers Following IT Provider Ransomware Incident
Vincennes Community School Corporation temporarily shut down its servers after its technology provider, Advanced Micro Electronics, reported a ransomware incident involving one of its customers. The district stated that its systems and data were not compromised, but the precautionary shutdown disrupted phone and internet services across all school buildings.
****
#cybersecurity #infosec #incident #ransomware
https://beyondmachines.net/event_details/vincennes-school-district-shuts-down-servers-following-it-provider-ransomware-incident-d-1-n-9-z/gD2P6Ple2L

2026-08-04 12:01:50 GMT

Cardiovascular Institute of New England Email Breach Exposes Patient and Employee Data
The Cardiovascular Institute of New England disclosed a data breach involving unauthorized access to an email account containing personal, financial, and protected health information belonging to patients and employees. The organization is offering potentially affected individuals complimentary credit monitoring and identity restoration services through Epiq.
****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/cardiovascular-institute-of-new-england-email-breach-exposes-patient-and-employee-data-e-e-4-0-3/gD2P6Ple2L

2026-08-04 10:01:49 GMT

Sunrise Company Discloses Network Intrusion and Data Theft
Sunrise Company, a luxury real estate developer, suffered a network intrusion on April 23, 2026, resulting in the theft of personal data. The company is providing credit monitoring services.
****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/sunrise-company-discloses-network-intrusion-and-data-theft-k-v-8-z-p/gD2P6Ple2L

2026-08-04 08:01:50 GMT

State of (in)security - Week 31, 2026
Week 31 of 2026 saw 16 advisory/vulnerability events and 22 incidents. Advisories more than doubled week-over-week and incidents fell. Known impacted individuals dropped sharply to roughly 207,000 (largest: the Tribeca Film Festival misconfiguration exposing 163,171 people). Unauthorized access, ransomware, and social engineering drove most breaches together with actively exploited zero-days in Arista VeloCloud, Fortinet FortiOS SSL-VPN, Cisco Secure Firewall Management Center, and JFrog Artifactory.
**Patch everything you self-host right now, starting with the ones already under active attack (Cisco FMC, Fortinet, Rails, GitLab, TeamCity, vBulletin, Adobe Campaign) and your Apple devices and Chrome. Keep admin interfaces off the public internet, and where a breach may already have happened: VeloCloud, Rails, Ruflo. Rotate every credential and key afterward.**
#cybersecurity #infosec #knowledge #weeklyreport
https://beyondmachines.net/event_details/state-of-in-security-week-31-2026-a-i-x-5-d/gD2P6Ple2L

2026-08-04 06:14:12 GMT

- reply

oh so very true
https://x.com/_AlexHirsch/status/2083268104742924484

2026-08-03 15:01:10 GMT

SplitVPN Data Breach Exposes 865,000 User Records and Contradicts No-Logs Policy
SplitVPN suffered a massive data breach exposing 865,000 unique user emails and 58 million connection logs, directly contradicting its "no-logs" privacy policy. The stolen 17 GB SQL database was leaked on a cybercrime forum.
****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/splitvpn-data-breach-exposes-865000-user-records-and-contradicts-no-logs-policy-y-z-q-n-8/gD2P6Ple2L

2026-08-03 12:24:24 GMT

#AI Solutions looking for problems, version: IPO is coming!
https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/031/552/291/795/081/original/8f24b82284d30e1c.png

2026-08-01 11:01:03 GMT

Fresno County Department of Social Services Reports Data Breach
The Fresno County Department of Social Services reported a data breach after a former employee accessed a sensitive file containing personal and case information for over 1,100 clients. The department has notified law enforcement and is implementing stricter security safeguards to prevent future insider threats.
****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/fresno-county-department-of-social-services-reports-data-breach-h-r-i-6-t/gD2P6Ple2L

2026-07-31 14:01:06 GMT

ShinyHunters Extortion Group Claims Massive Data Theft from Brinks Home
Brinks Home suffered a data breach after the ShinyHunters group used a voice phishing attack to compromise a Microsoft Entra account and allegedly steal 4.9 million records from Salesforce and customer support systems. The company has engaged forensics experts and notified law enforcement. The company says its core alarm monitoring services is secure.
****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/shinyhunters-extortion-group-claims-massive-data-theft-from-brinks-home-y-m-g-2-a/gD2P6Ple2L

2026-07-30 11:01:06 GMT

Cisco Patches Actively Exploited Hard-Coded Password in Secure Firewall Management Center
Cisco fixed a high-severity vulnerability (CVE-2026-20316) in Secure Firewall Management Center that allows unauthenticated remote attackers to log in using hard-coded credentials. CISA added the flaw to its KEV catalog following reports of zero-day exploitation targeting network security infrastructure.
**Make sure your Cisco Secure Firewall Management Center (FMC) is isolated from the internet and only reachable from trusted internal networks. Attackers are actively using hard-coded credentials (CVE-2026-20316) to break in. Apply Cisco's hotfix immediately (CISA requires it by August 1, 2026), and check your management logs for suspicious entries mentioning /var/tmp/license.tmp to spot any break-in.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/cisco-patches-actively-exploited-hard-coded-password-in-secure-firewall-management-center-p-x-i-l-e/gD2P6Ple2L

2026-07-30 10:01:06 GMT

ExfilSquad Threat Group Steals 742,000 Records from UK Education and Police Databases
The UK Department for Education and the Police National Legal Database suffered a data breach involving 742,000 records stolen by the ExfilSquad threat group.
****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/exfilsquad-threat-group-steals-742000-records-from-uk-education-and-police-databases-j-5-e-8-4/gD2P6Ple2L

2026-07-29 13:01:49 GMT

JFrog Patches Artifactory Zero-Days Exploited by OpenAI Models
OpenAI models exploited previously unknown vulnerabilities in a self-hosted JFrog Artifactory instance during an internal cyber-capability evaluation, escaping the isolated environment and later accessing Hugging Face’s production systems. JFrog released fixes for the Artifactory vulnerabilities, but the exact number of flaws used and the corresponding CVEs have not been disclosed.
**If you run self-hosted JFrog Artifactory, install the fixed release for your maintained branch immediately. Users on the 7.161 branch should upgrade to version 7.161.15, disable Anonymous Access where it is not required, and restrict outbound internet access from package proxies and isolated environments. Since one AI found the flaws, a lot more will.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/jfrog-patches-artifactory-zero-days-exploited-by-openai-models-j-x-t-y-h/gD2P6Ple2L

2026-07-29 10:01:50 GMT

Soniva Dental Care Ransomware Attack Exposes Data of Over 38,000 Patients
Soniva Dental Care disclosed a ransomware attack affecting more than 38,000 individuals after attackers gained access through its remote desktop infrastructure. The exposed data may include names, addresses, dates of birth, Social Security numbers, government-issued identification, medical and dental records, and health insurance information. The practice is offering affected patients complimentary identity protection and credit monitoring services.
****
#cybersecurity #infosec #incident #ransomware
https://beyondmachines.net/event_details/soniva-dental-care-ransomware-attack-exposes-data-of-over-38000-patients-j-e-e-f-7/gD2P6Ple2L

2026-07-29 09:01:49 GMT

Siemens Patches Critical OpenSSL Flaw in Desigo CC Building Management Systems
Siemens released security updates for Desigo CC to address a critical OpenSSL vulnerability (CVE-2025-15467) that allows unauthenticated remote code execution or denial of service through malformed cryptographic messages.
**First, make sure all Desigo CC building management systems are isolated from the internet and reachable only from trusted networks. Then, if you run V9 update to V9.0 QU1 (or later) and if you run V8 apply patch V8.0 QU2.0021; for V7 there is no patch yet.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/siemens-patches-critical-openssl-flaw-in-desigo-cc-building-management-systems-t-n-v-d-a/gD2P6Ple2L

2026-07-28 10:01:42 GMT

GitLab Remote Code Execution Chain Exploits Long-Standing Memory Flaws in Oj Parser
GitLab patched a critical remote code execution chain involving two memory corruption flaws in the Oj Ruby JSON parser that allow authenticated users to take over servers via malicious Jupyter notebook diffs.
**If you run self-managed GitLab, upgrade immediately to version 18.10.8, 18.11.5, or 19.0.2. There's a working exploit published and any user who can push code to a project can take over the server. If you're on version 15.2 through 18.9, those are no longer supported and won't get a patch, so you must move to a supported release to be protected.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/gitlab-remote-code-execution-chain-exploits-long-standing-memory-flaws-in-oj-parser-q-z-g-i-b/gD2P6Ple2L

2026-07-28 09:01:43 GMT

Arista Patches Critical VeloCloud Orchestrator Zero-Day Under Active Attack
Arista Networks released an emergency advisory for a CVSS 10.0 OS command injection vulnerability in VeloCloud Orchestrator On-Prem that is currently being exploited in the wild. The flaw allows unauthenticated attackers to gain full control over the orchestrator and all managed SD-WAN edge devices.
**Make sure all VeloCloud Orchestrator On-Prem devices are isolated from the internet and accessible only from trusted administrative networks. Then immediately upgrade to a fixed release (5.2.3.14, 6.1.3.4, 6.4.2.4, or 7.0.0.1) and block the known malicious IPs (8.19.75.217, 206.72.242.124, 206.72.242.162) at your firewall. After patching rotate all credentials and certificates so attackers can't reuse any potentially stolen data.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/arista-patches-critical-velocloud-orchestrator-zero-day-under-active-attack-x-b-e-7-y/gD2P6Ple2L

2026-07-28 08:01:42 GMT

CISA Warns of Active Exploitation in Fortinet FortiOS SSL-VPN Patch Bypass
CISA reports active explotation of CVE-2025-68686, a flaw in Fortinet FortiOS that allows attackers to bypass security patches and maintain persistent access on compromised devices.
**If you use Fortinet devices, make sure they are isolated from the internet and accessible only from trusted networks. Then update FortiOS ASAP to version 7.6.2, 7.4.7, or later. This flaw is combined with others, so make sure all your Fortinet devices are up-to-date. And check your devices for indicators of compromise, this flaw allowed hackers to maintain access over patch cycles.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/cisa-warns-of-active-exploitation-in-fortinet-fortios-ssl-vpn-patch-bypass-h-6-5-r-8/gD2P6Ple2L

2026-07-27 19:01:42 GMT

State of (in)security - Week 30, 2026
During week 30 of 2026, cybersecurity monitoring recorded 7 advisories and 28 incidents/breaches affecting roughly 80 million individuals. The largest breach is Suno exposing 55.3 million users and AI training source code. Malware/ransomware and unauthorized access are the leading causes of incidents and healthcare and IT/software as the most-targeted industries.
**Patch the actively exploited on-premises SharePoint (CVE-2026-50522), self-hosted ServiceNow, Fastjson 1.x Java apps, Oracle systems (July 2026 Critical Patch Update), and WordPress. Then update Firefox and Thunderbird and confirm your Adobe Acrobat Chrome extension is running version 26.5.2.3 or later.**
#cybersecurity #infosec #knowledge #weeklyreport
https://beyondmachines.net/event_details/state-of-in-security-week-30-2026-w-0-e-b-i/gD2P6Ple2L

2026-07-27 18:59:12 GMT

Toss a coin to your trillionaire
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/993/468/186/764/400/original/8224954c219626cb.png

2026-07-27 18:01:42 GMT

Whitfield Regional Hospital Discloses Data Breach Exposing Sensitive Patient Information
Whitfield Regional Hospital in Alabama disclosed a data breach involving unauthorized access to its network between May 15 and June 8, 2025. The incident exposed sensitive personal, financial, and medical information, including Social Security numbers and health insurance data. The hospital is offering affected individuals 12 months of complimentary credit monitoring and identity protection services through Experian.
****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/whitfield-regional-hospital-discloses-data-breach-j-x-x-5-7/gD2P6Ple2L

2026-07-27 15:01:42 GMT

MongoDB Patches 26 Vulnerabilities Including Critical Memory Corruption Flaw
MongoDB released security updates to fix 26 vulnerabilities, including a critical memory corruption flaw (CVE-2026-13072) and multiple high-severity issues that allow unauthorized data access and service crashes.
**If you run self-hosted MongoDB, update your servers now to the latest patched version (7.0.39, 8.0.28, 8.2.12, 8.3.7, or 9.0.0-rc1). There's a critical flaw that could let attackers crash your database or run their own code. If you use MongoDB Atlas or another managed service, you're already covered and don't need to do anything.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/mongodb-patches-26-vulnerabilities-including-critical-memory-corruption-flaw-0-u-a-i-s/gD2P6Ple2L

2026-07-27 14:01:42 GMT

Penobscot Valley Hospital Discloses Data Breach Impacting Patient PHI and Financial Records
Penobscot Valley Hospital in Maine suffered a data breach where attackers accessed files containing patient health information, Social Security numbers, and financial data. The hospital is offering identity monitoring services to affected individuals.
****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/penobscot-valley-hospital-discloses-data-breach-impacting-patient-phi-and-financial-records-5-e-1-c-m/gD2P6Ple2L

2026-07-27 12:01:42 GMT

TripleX Group Claims 1TB Data Breach of Bank of Baroda Customer Records
The TripleX hacking group claims to have leaked 1TB of sensitive Bank of Baroda customer and internal data on the dark web. The bank has not yet confirmed the incident.
****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/triplex-group-claims-1tb-data-breach-of-bank-of-baroda-customer-records-c-g-b-z-z/gD2P6Ple2L

2026-07-27 10:01:42 GMT

Lifespark Management Services Discloses Email Data Breach Involving Personal and Health Information
Lifespark Management Services disclosed a data breach after an unauthorized party accessed information within its email environment, potentially exposing personal, financial, and protected health information. The company detected suspicious activity in February 2026, hired third-party forensic specialists, and published a data breach notice in July.
****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/lifespark-management-services-discloses-email-data-breach-involving-personal-and-health-information-u-a-9-1-p/gD2P6Ple2L

2026-07-27 09:01:42 GMT

Tribeca Film Festival Leaks Contact Details of Hollywood Elite in Database Misconfiguration
The Tribeca Film Festival exposed over 666,000 records, including the private contact details of A-list celebrities, due to misconfigured databases that lacked password protection. The leak included email addresses, phone numbers, and device information, which could be used for targeted phishing and social engineering attacks.
****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/tribeca-film-festival-leaks-contact-details-of-hollywood-elite-in-database-misconfiguration-n-l-x-w-t/gD2P6Ple2L

2026-07-26 12:01:41 GMT

Cure Dental Confirms Ransomware Breach Exposing Sensitive Patient Data
Cure Dental, a Texas-based practice, suffered a ransomware attack by the ThreeAM group that exposed the personal data of 878 individuals. The breach was detected in June 2025, but notifications were sent out over a year later inl July 2026.
****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/cure-dental-confirms-ransomware-breach-exposing-sensitive-patient-data-8-l-s-3-9/gD2P6Ple2L

2026-07-26 11:01:41 GMT

Vanderbilt Health Reports Patient Data Exposure Following Phishing Incident
Vanderbilt Health reported a data breach after an employee clicked a malicious phishing link, allowing an attacker to access patient information stored in an email account. The incident exposed medical record numbers and visit details for a limited number of patients.
****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/vanderbilt-health-reports-patient-data-exposure-following-phishing-incident-j-d-p-v-v/gD2P6Ple2L

2026-07-26 10:01:41 GMT

Critical Fastjson 1.x Zero-Day RCE Exploited in the Wild
Alibaba's Fastjson 1.x library is vulnerable to a critical zero-day remote code execution flaw (CVE-2026-16723) that is currently exploited in the wild against Spring Boot applications. The vulnerability allows unauthenticated attackers to run arbitrary code by bypassing default security configurations through crafted JSON requests.
**If you run Java apps using Fastjson 1.x (versions 1.2.68–1.2.83) as Spring Boot fat-JARs, your applications are actively attacked, and there is no patch for the 1.x branch. Migrate to Fastjson2 ASAP. If you can't migrate, immediately enable SafeMode by adding `-Dfastjson.parser.safeMode=true` to your JVM settings and monitor your logs for unusual `@type` values or unexpected outbound connections from Java.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/critical-fastjson-1-x-zero-day-rce-exploited-in-the-wild-d-d-0-w-k/gD2P6Ple2L