Nostr notes by BeyondMachines :verified:

Nick Scali Discloses Cyberattack Affecting Operations and ...

2026-09-11T10:01:13Z

Nick Scali Discloses Cyberattack Affecting Operations and Customer Information

Nick Scali disclosed a cyberattack in August 2026 that disrupted sales and warehouse operations and exposed customer contact and delivery information. The Australian furniture retailer notified federal authorities and is contacting affected customers and restoring impacted systems.

****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/nick-scali-discloses-cyberattack-affecting-operations-and-customer-information-v-c-u-m-h/gD2P6Ple2L

Check Point Patches Critical VPN Certificate Flaws Enabling ...

2026-09-11T08:01:13Z

Check Point Patches Critical VPN Certificate Flaws Enabling Unauthenticated RCE

Check Point patched two critical 9.8-rated vulnerabilities in its VPN certificate handling that allow unauthenticated remote code execution. The flaws affect Security Gateways, Management Servers, and Spark Firewalls across multiple versions.

**If you use Check Point Quantum Gateways, Security Management Servers, or Spark Firewalls, patch them ASAP. Don't assume you're safe because VPN is switched off, since the flaw can still trigger if certificates exist. If you can't patch right away, disable implied VPN rules and restrict UDP ports 500 and 4500 to your known peer IPs only. Start planning replacement of any end-of-support R80.x/R81.x devices. Those will not be patched.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/check-point-patches-critical-vpn-certificate-flaws-enabling-unauthenticated-rce-w-l-o-8-e/gD2P6Ple2L

Healing Paper Data Breach Exposes Medical Data of 220,000 Gangnam ...

2026-09-07T14:01:31Z

Healing Paper Data Breach Exposes Medical Data of 220,000 Gangnam Unni Users

Healing Paper confirmed a data breach affecting approximately 220,000 Gangnam Unni users after attackers gained unauthorized access through the platform’s APIs. The exposed information includes personal details, consultation photos, treatment records, and payment-related information. Healing Paper also launched a verification tool so users can check whether their data was affected.

****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/healing-paper-data-breach-exposes-medical-data-of-220000-gangnam-unni-users-n-o-w-b-2/gD2P6Ple2L

Mathspace Data Breach Impacts Over 1 Million Users in Australia ...

2026-09-07T11:01:32Z

Mathspace Data Breach Impacts Over 1 Million Users in Australia and New Zealand

Mathspace confirmed a data breach affecting 1,079,819 individuals after attackers exploited an unpatched vulnerability in its self-hosted Metabase reporting system. The company took the compromised reporting system offline, notified Australian and New Zealand authorities, and began alerting affected users.

****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/mathspace-data-breach-impacts-over-1-million-users-in-australia-and-new-zealand-y-1-w-d-f/gD2P6Ple2L

Partnership HealthPlan of California Reports Data Breach ...

2026-09-07T10:01:31Z

Partnership HealthPlan of California Reports Data Breach Affecting 1,500 Members

Partnership HealthPlan of California reported a data breach affecting 1,526 members after welcome packets containing sensitive personal information were mailed to incorrect recipients. The incident exposed names, dates of birth, and member identification numbers but did not involve financial or medical records.

****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/partnership-healthplan-of-california-reports-data-breach-affecting-1500-members-i-9-l-p-o/gD2P6Ple2L

Natural Resources Wales Accidentally Publishes Sensitive Employee ...

2026-09-07T09:01:31Z

Natural Resources Wales Accidentally Publishes Sensitive Employee Diversity Data

Natural Resources Wales inadvertently published a spreadsheet on its public website containing sensitive diversity and equality data for employees who worked there between 2013 and 2018. The organization removed the file and notified the Information Commissioner’s Office.

****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/natural-resources-wales-accidentally-publishes-sensitive-employee-diversity-data-r-i-6-o-w/gD2P6Ple2L

Microsoft Reports Nine Cloud Identity and AI Vulnerabilities Out ...

2026-09-07T08:01:31Z

Microsoft Reports Nine Cloud Identity and AI Vulnerabilities Out of Patch Tuesday, Two Max Severity

Microsoft issued an out-of-band update on September 3, 2026, fixing nine cloud-platform vulnerabilities (eight critical, including two CVSS 10.0 flaws in Azure AD B2C and Azure AI Language Authoring), with the most consequential being two Entra ID bypasses. All were patched server-side with no customer action needed. The exposure duration is not clear.

**Microsoft already fixed all nine flaws on their side, so there's nothing for you to patch. Since attackers may have had a window before the fix, review your Entra ID and Azure sign-in logs and check for any unexpected new admin roles, app registrations, or service principals over the past few months. Don't assume your identity provider is safe by default: turn on alerting for unusual logins and privilege changes, and cut back permissions on service principals and apps to only what they actually need.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/microsoft-s-september-identity-batch-proves-the-authentication-gap-is-not-an-open-source-problem-n-h-9-a-h/gD2P6Ple2L

MikroTik Patches Critical "MikroTrick" Exploit Chain ...

2026-09-06T14:01:31Z

MikroTik Patches Critical "MikroTrick" Exploit Chain Under Active Attack

MikroTik has patched six vulnerabilities, including the "MikroTrick" exploit chain, which allows unauthenticated attackers to gain full administrative control over RouterOS devices. CERT Polska confirmed active exploitation of these flaws. Attackers are creating unauthorized accounts and establishing persistent network tunnels.

**If you use MikroTik routers, first make sure the device is isolated from the internet and reachable only from trusted networks. Block SSH, WebFig, and bandwidth-test access from outside. Then install the fixed RouterOS version (7.23.4, 7.24.2, or 6.49.21 and newer) from the official MikroTik download page, check whether the device is Flagged as compromised, and delete any accounts you didn't create, such as one named "ops".**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/mikrotik-patches-critical-mikrotrick-exploit-chain-under-active-attack-8-j-y-e-y/gD2P6Ple2L

Bennett College Reports Data Breach Affecting 30,000 Individuals ...

2026-09-06T12:01:31Z

Bennett College Reports Data Breach Affecting 30,000 Individuals

Bennett College suffered a network intrusion in late 2025 that exposed the sensitive personal and financial data of 30,000 individuals. The college isolated its systems and is providing credit monitoring services to the affected by the breach.

****
#cybersecurity #infosec #incident #ransomware
https://beyondmachines.net/event_details/bennett-college-reports-data-breach-affecting-30000-individuals-i-b-4-9-r/gD2P6Ple2L

Plex Urges Immediate Updates After Patching Multiple Undisclosed ...

2026-09-06T11:01:31Z

Plex Urges Immediate Updates After Patching Multiple Undisclosed Security Flaws

Plex has issued an urgent security update for Plex Media Server and Plex Desktop to address multiple undisclosed vulnerabilities. The company is urging for immediate updates across all platforms, including manual installations for NAS devices.

**Update your Plex server and desktop app to the latest version right now. Plex rarely emails users about security, so this update likely fixes a very serious problem that could let hackers into your home network.**
#cybersecurity #infosec #advisory #databreach
https://beyondmachines.net/event_details/plex-urges-immediate-updates-after-patching-multiple-undisclosed-security-flaws-3-l-y-8-k/gD2P6Ple2L

Postgres MCP Pro Restricted-Mode Bypass Allows Arbitrary Host ...

2026-09-06T10:01:30Z

Postgres MCP Pro Restricted-Mode Bypass Allows Arbitrary Host File Disclosure

Postgres MCP Pro version 0.3.0 contains a critical restricted-mode bypass (CVE-2026-85620) that allows unauthenticated attackers to read arbitrary files from the database host. The flaw is caused by an incomplete SQL validation in the Abstract Syntax Tree parser, enabling the execution of dangerous functions through FROM clauses.

**If you're running Crystal DBA's Postgres MCP Pro (version 0.3.0 or earlier), don't rely on its restricted mode to keep your AI agents in check. It can be bypassed to read files off your server, including passwords and private keys. Change the database account the MCP server uses to a least-privilege role, strip its superuser status and `pg_read_server_files` permission, and keep it off the internet until an official fix ships.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/postgres-mcp-pro-restricted-mode-bypass-allows-arbitrary-host-file-disclosure-t-6-8-7-8/gD2P6Ple2L

Manning Regional Healthcare Center Reports Data Breach Affecting ...

2026-09-06T09:01:31Z

Manning Regional Healthcare Center Reports Data Breach Affecting Patient Information

Manning Regional Healthcare Center reported a data breach to federal authorities after unauthorized access compromised the protected health information of 746 individuals. The breach involved sensitive patient data including medical records and insurance information.

****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/manning-regional-healthcare-center-reports-data-breach-affecting-patient-information-i-l-q-p-1/gD2P6Ple2L

LHC Group Vishing Attack Exposes Protected Health Information LHC ...

2026-09-05T20:01:31Z

LHC Group Vishing Attack Exposes Protected Health Information

LHC Group suffered a data breach after an employee fell victim to a voice phishing attack, allowing the hackers to steal credentials and access patient files on a third-party platform. The breach exposed protected health information for thousands of individuals, including over 16,000 residents in Texas.

****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/lhc-group-vishing-attack-exposes-protected-health-information-n-w-d-k-x/gD2P6Ple2L

Resource Center of Dallas Reports Data Breach Affecting 12,490 ...

2026-09-05T09:01:31Z

Resource Center of Dallas Reports Data Breach Affecting 12,490 Individuals

The Resource Center of Dallas reported a data breach affecting 12,490 individuals after attackers accessed its network in February 2026.

****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/resource-center-of-dallas-reports-data-breach-affecting-12490-individuals-3-s-s-k-c/gD2P6Ple2L

Google Patches Actively Exploited V8 Zero-Day in Chrome Update ...

2026-09-05T08:01:31Z

Google Patches Actively Exploited V8 Zero-Day in Chrome Update

Google released security updates for Chrome to patch 12 vulnerabilities, including an actively exploited V8 zero-day (CVE-2026-85046) that allows remote code execution.

**This one is urgent, because Chrome is being actively attacked. Update your Chrome and Chromium based browsers ASAP. This is not a time to delay the patch. All your tabs reopen.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/google-patches-actively-exploited-v8-zero-day-in-chrome-update-v-d-c-m-k/gD2P6Ple2L

City of Roanoke Discloses Data Breach Three Months After ...

2026-09-04T20:01:31Z

City of Roanoke Discloses Data Breach Three Months After Unauthorized Network Access

The City of Roanoke disclosed a data breach three months after an unidentified actor accessed sensitive departmental data, including Social Security and passport numbers. The city has engaged security experts and the FBI to investigate the five-day intrusion and strengthen its network architecture.

****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/city-of-roanoke-discloses-data-breach-three-months-after-unauthorized-network-access-l-6-3-s-r/gD2P6Ple2L

HPE Patches Critical Remote Code Execution Flaw in ArubaOS-CX ...

2026-09-04T10:01:31Z

HPE Patches Critical Remote Code Execution Flaw in ArubaOS-CX Switches

HPE patched 34 vulnerabilities in ArubaOS-CX, including a critical buffer overflow (CVE-2026-73749) that allows unauthenticated remote code execution. The update also addresses multiple high-severity flaws enabling command injection, authentication bypass, and unauthorized file writes.

**If you run HPE Aruba CX switches (10000, 6400, 8325, 6000 series), first make sure their management interfaces are not reachable from the internet and only accessible from a dedicated management VLAN on trusted networks. Then update the switches to AOS-CX 10.18.1002, 10.17.1030, 10.16.1060, 10.13.1190, or 10.10.1181, and change any factory-set passwords while you're there.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/hpe-patches-critical-remote-code-execution-flaw-in-arubaos-cx-switches-7-8-k-r-6/gD2P6Ple2L

Attackers Exploit Critical Sangoma Switchvox Flaw to Deploy ...

2026-09-03T08:01:29Z

Attackers Exploit Critical Sangoma Switchvox Flaw to Deploy Reverse Shells

Sangoma patched 12 vulnerabilities in Switchvox, including a critical unauthenticated SQL injection (CVE-2026-9586) that attackers are currently using to gain remote code execution and steal authentication keys.

**If you run Sangoma Switchvox, first make sure it isn't reachable from the internet and can only be accessed from trusted networks, then update immediately to version 8.4.0.2. Anything on version 8.3 or earlier is being actively attacked. Because attackers have been stealing keys, tokens and user data, also check /var/log/switchvox/db-quirks.log for signs of SQL injection, block the IP 176.65.148.184, and reset passwords and signing keys if you find anything suspicious.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/attackers-exploit-critical-sangoma-switchvox-flaw-to-deploy-reverse-shells-b-w-f-y-c/gD2P6Ple2L

Nephrology Associates Data Breach Exposes Sensitive Health ...

2026-09-02T13:01:31Z

Nephrology Associates Data Breach Exposes Sensitive Health Records of 24,000 Patients

Nephrology Associates, M.D., P.A. suffered a data breach affecting over 24,000 patients after unauthorized actors maintained network access for three months. The incident, claimed by multiple ransomware groups, resulted in the theft of Social Security numbers and sensitive medical treatment information.

****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/nephrology-associates-data-breach-exposes-sensitive-health-records-of-24000-patients-q-h-u-6-5/gD2P6Ple2L

Attackers Exploit Critical JFrog Artifactory Flaw to Mint Admin ...

2026-09-02T08:01:30Z

Attackers Exploit Critical JFrog Artifactory Flaw to Mint Admin Tokens

JFrog Artifactory is facing active exploitation of a critical authentication bypass (CVE-2026-82329) that allows unauthenticated attackers to mint administrator tokens and compromise software supply chains.

**If you run self-managed JFrog Artifactory, update to version 7.161.20 ASAP. Attackers are already exploiting this flaw to take full admin control. Primary systems at risk are internet facing self-hosted Artifactory instances. Cloud-hosted instances managed by JFrog are not affected.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/attackers-exploit-critical-jfrog-artifactory-flaw-to-mint-admin-tokens-f-g-f-4-3/gD2P6Ple2L

State of (in)security - Week 35, 2026 Week 35 of 2026 saw 21 ...

2026-09-01T12:01:41Z

State of (in)security - Week 35, 2026

Week 35 of 2026 saw 21 advisories and 20 incidents, with breaches affecting roughly 21.7 million people. The largest incident is being ShinyHunters' leak of 12.9 million Carhartt accounts, part of a broader ShinyHunters campaign also hitting McKesson and Baxter. Attacks were driven mainly by unauthorized access, ransomware, phishing, and third-party compromise (mostly in manufacturing, government, and healthcare). Critical vulnerabilities were patched in widely used software like Chrome, Next.js, Apache Tomcat, ServiceNow, Keycloak, and several WordPress plugins.

**Update Chrome/Chromium browsers and start patching WordPress plugins. This week is heavy on WordPress issues.**
#cybersecurity #infosec #knowledge #weeklyreport
https://beyondmachines.net/event_details/state-of-in-security-week-35-2026-z-p-t-j-x/gD2P6Ple2L

ServiceNow Patches Three Critical 10.0 Severity Flaws in AI ...

2026-08-29T08:01:41Z

ServiceNow Patches Three Critical 10.0 Severity Flaws in AI Platform

ServiceNow released emergency patches for three critical vulnerabilities (CVSS 10.0) and one high-severity flaw in its AI Platform that allow unauthenticated remote code execution and SQL injection. These flaws put sensitive enterprise data and connected corporate systems at risk of full takeover.

**If you self-host ServiceNow, apply the vendor patches ASAP: Xanadu Patch 11, Yokohama Patch 12/13, or Zurich Patch 7-12. Cloud-hosted instances are already fixed. Then check your logs for unusual GraphQL requests or unexpected admin account changes. If possible limit which ServiceNow interfaces are reachable from the internet.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/servicenow-patches-three-critical-10-0-severity-flaws-in-ai-platform-l-6-r-p-l/gD2P6Ple2L

Manchester Airports Group Cyberattack Exposes Data of 8.7 Million ...

2026-08-28T14:01:41Z

Manchester Airports Group Cyberattack Exposes Data of 8.7 Million Customers

Manchester Airports Group suffered a ransomware attack that exposed the personal data of 8.7 million customers across three major UK airports. The breach affected booking and Wi-Fi registration systems but did not disrupt flight operations or compromise payment information.

****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/manchester-airports-group-cyberattack-exposes-data-of-8-7-million-customers-6-h-o-9-3/gD2P6Ple2L

CISA Reports Actively Exploited Gitea Critical RCE Vulnerability ...

2026-08-26T17:01:20Z

CISA Reports Actively Exploited Gitea Critical RCE Vulnerability

Gitea patched a critical remote code execution vulnerability (CVE-2026-60004) that attackers are actively exploiting to install crypto-miners on self-hosted instances. The flaw allows users with write access to inject malicious Git hooks via the diffpatch API, potentially exposing database credentials and system secrets.

**Update self-hosted Gitea instances to version 1.27.1 immediately. Now it's urgent, since hackers are actively attacking you. If you can't patch right away, disable public registration to prevent new outsiders from obtaining repository write access. This does not protect against existing users who already have the required permissions.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/cisa-reports-actively-exploited-gitea-critical-rce-vulnerability-2-1-9-j-5/gD2P6Ple2L

Zscaler Patches Critical Unauthenticated RCE in Client Connector ...

2026-08-26T10:01:42Z

Zscaler Patches Critical Unauthenticated RCE in Client Connector for Windows

Zscaler fixed a critical vulnerability (CVE-2026-59568) that allowed unauthenticated remote code execution and privilege escalation as well as three other flaws in its Client Connector for Windows

**If you use Zscaler Client Connector on Windows, update every endpoint to the latest patched version. Anything released before June 2026 (including 4.7.0.364, 4.8.0.232/284/291, and 4.9.0.448/455) is at risk of remote takeover. Don't assume your automated update policy reached every machine; manually verify the version on all devices. Check endpoint logs for odd processes launched by Zscaler components or unexpected new listening services.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/zscaler-patches-critical-unauthenticated-rce-in-client-connector-for-windows-x-x-2-j-a/gD2P6Ple2L

Critical Keycloak Password Reset Flaw Allows Unauthenticated ...

2026-08-24T15:01:16Z

Critical Keycloak Password Reset Flaw Allows Unauthenticated Account Takeover

Red Hat and Keycloak patched a critical vulnerability (CVE-2026-18963) that allows unauthenticated attackers to bypass email verification and take over any account via the password reset flow. The update also addresses over 20 other security flaws, including account-linking bypasses and administrative permission leaks.

**If you run Keycloak or Red Hat Build of Keycloak, update immediately to Keycloak 26.7.2 or RHBK 26.4.15 / 26.6.6 since the older versions let anyone reset the password of any account, including admins. If you cannot patch right away, turn off the "Forgot password" option in every realm (Realm settings → Login → Forgot password) until the update is applied.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/critical-keycloak-password-reset-flaw-allows-unauthenticated-account-takeover-p-n-m-j-1/gD2P6Ple2L

Mon Health Medical Center Discloses Phishing Breach Affecting ...

2026-08-21T17:01:16Z

Mon Health Medical Center Discloses Phishing Breach Affecting Patient Data

Mon Health Medical Center reported a data breach affecting 2,173 individuals after a phishing attack allowed unauthorized access to internal email mailboxes. The hospital is providing two years of credit monitoring and has notified federal authorities.

****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/mon-health-medical-center-discloses-phishing-breach-affecting-patient-data-0-1-l-j-f/gD2P6Ple2L

Citrix NetScaler Flaws Under Active Attack Following Exploit ...

2026-08-21T13:01:26Z

Citrix NetScaler Flaws Under Active Attack Following Exploit Release

Citrix NetScaler ADC and Gateway appliances are being exploited via a critical SAML memory overflow vulnerability (CVE-2026-8452) that allows pre-authentication remote code execution. Attackers are targeting perimeter devices to gain unauthorized access to internal corporate networks following the release of public proof-of-concept code.

**If you run Citrix NetScaler ADC or Gateway, patch immediately to version 14.1-72.61 or 13.1-63.18 (or the matching FIPS builds). Attackers are already exploiting these appliances and a public exploit PoC is available. If you can't patch right away, restrict the management interface to trusted internal networks only, review your SAML configuration, and check logs for unexpected admin logins or config changes.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/citrix-netscaler-flaws-under-active-attack-following-exploit-release-e-x-8-8-4/gD2P6Ple2L

Critical Zimbra RCE Vulnerability Exploited in Global Attacks ...

2026-08-21T09:01:12Z

Critical Zimbra RCE Vulnerability Exploited in Global Attacks

Zimbra patched nine vulnerabilities in its Collaboration Suite, including a critical RCE flaw (CVE-2026-73570) that attackers are currently exploiting to take control of mail servers. Organizations should update to version 10.1.20 and check logs for signs of compromise.

**If you run Zimbra Collaboration Suite, update to version 10.1.20 ASAP. Attackers are already exploiting this to take over mail servers, and everything older is vulnerable. Because this flaw is being actively exploited, also check for signs of breach: look for unexpected files in `/opt/zimbra/jetty/webapps/` and `/tmp/`, and review `/var/log/zimbra.log` for services restarting on their own.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/critical-zimbra-rce-vulnerability-exploited-in-global-attacks-p-1-4-k-y/gD2P6Ple2L

BitBox Patches Firmware Flaws BitBox released the Dixence update ...

2026-08-20T09:01:03Z

BitBox Patches Firmware Flaws

BitBox released the Dixence update to fix three firmware vulnerabilities, including a bootloader flaw and memory corruption, that could allow attackers to steal funds or execute code.

**If you own a BitBox02 or BitBox02 Nova hardware wallet, update it to firmware 9.26.5 right away using only the official BitBoxApp downloaded from bitbox.swiss, and verify the app's signature before installing. Never enter your recovery words into any computer or phone, and if you used Silent Payments recently, double-check your funds arrived at the right address before sending more.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/bitbox-patches-firmware-flaws-g-w-8-m-a/gD2P6Ple2L

Ray Framework Remote Code Execution Vulnerability Under Active ...

2026-08-20T08:01:03Z

Ray Framework Remote Code Execution Vulnerability Under Active Exploitation

CISA warned that attackers are exploiting a remote code execution vulnerability in the Ray framework to target machine learning developers. The flaw allows attackers to bypass browser security checks and run arbitrary commands on developer machines and internal networks.

**If you use the Ray framework, update it to version 2.52.0 or later ASAP. Attackers are actively exploiting CVE-2025-62593 to run commands on developer machines. Also make sure Ray is never reachable from the internet and only accessible from trusted networks, and watch for unusual traffic between developer laptops and your internal compute clusters.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/ray-framework-remote-code-execution-vulnerability-under-active-exploitation-y-u-w-h-s/gD2P6Ple2L

Cameron Regional Medical Center Disclosed Ransomware Attack ...

2026-08-19T14:01:23Z

Cameron Regional Medical Center Disclosed Ransomware Attack

Cameron Regional Medical Center disclosed a ransomware attack involving potential unauthorized access to sensitive patient information. The Anubis ransomware group claimed responsibility and alleged it stole patient and employee data. CRMC continues to investigate the scope of the incident.

****
#cybersecurity #infosec #incident #ransomware
https://beyondmachines.net/event_details/cameron-regional-medical-center-disclosed-ransomware-attack-3-1-b-n-p/gD2P6Ple2L

Attackers Exploit a Critical MLflow Vulnerability Attackers are ...

2026-08-19T08:01:23Z

Attackers Exploit a Critical MLflow Vulnerability

Attackers are actively exploiting a critical flaw in MLflow (CVE-2026-64849) to steal cloud credentials and gain remote code execution.

**If you run MLflow, update it to version 3.15.0 or later ASAP, and make sure the server is not reachable from the internet. Then check your audit logs for any odd requests to cloud metadata services. If you see any (or aren't sure), rotate your cloud credentials and keys as a precaution.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/attackers-exploit-a-critical-mlflow-vulnerability-3-u-3-k-6/gD2P6Ple2L

GitLab Issues Emergency Patch for Critical GraphQL Flaw Allowing ...

2026-08-18T11:01:46Z

GitLab Issues Emergency Patch for Critical GraphQL Flaw Allowing Remote Project Deletion

GitLab issued an emergency security update to fix a critical GraphQL code injection vulnerability (CVE-2026-19478) that allows unauthenticated attackers to remotely delete or modify public projects and user data.

**If you run a self-managed GitLab server (version 18.2 through 19.2.3), update it ASAP to 19.2.4, 19.1.6, 19.0.8, or 18.11.11. The patch is quick and won't take your system offline. Before you patch, check your logs for unusual GraphQL activity so you know nobody has already deleted or altered your projects or user data.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/gitlab-issues-emergency-patch-for-critical-graphql-flaw-allowing-remote-project-deletion-k-u-c-h-x/gD2P6Ple2L

Terry J. Dubrow Plastic Surgery Practice Reports Long-Term Data ...

2026-08-17T20:01:45Z

Terry J. Dubrow Plastic Surgery Practice Reports Long-Term Data Breach

Terry J. Dubrow, MD, A Medical Corporation reports a data breach where an attacker accessed patient records including Social Security numbers and medical images over an eighteen-month period. The practice has notified the FBI and is offering identity protection services to affected individuals.

****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/terry-j-dubrow-plastic-surgery-practice-reports-long-term-data-breach-7-3-p-d-h/gD2P6Ple2L

State of (in)security - Week 33, 2026 During week 33 of 2026 ...

2026-08-17T19:01:46Z

State of (in)security - Week 33, 2026

During week 33 of 2026 (Aug. 10–17), there were 9 advisory/vulnerability events and 42 incidents affecting roughly 39.5 million people, a sharp rise from the prior week. Unauthorized access, ransomware/malware, and third-party compromises were leading causes, and healthcare, government, and IT hit hardest. Major items included Poland's medical data breach affecting 19 million citizens, actively exploited flaws in Magento, VMware vCenter, SharePoint, GeoServer and SAP, and large patch releases from Microsoft (421 fixes), SAP, Siemens, Adobe and Zoom.

**Update your Mac and Zoom today, both have flaws attackers are already using to take over machines with no password and no clicks from you. If you run servers, patch anything internet-facing first: vCenter, SharePoint, Adobe Commerce/Magento, and SAP Commerce Cloud are all under active attack right now. Then push the regular Windows update.**
#cybersecurity #infosec #knowledge #weeklyreport
https://beyondmachines.net/event_details/state-of-in-security-week-33-2026-v-m-1-n-l/gD2P6Ple2L

Shell Investigates 89 GB Data Theft Claim by Cl0p Ransomware ...

2026-08-17T18:01:46Z

Shell Investigates 89 GB Data Theft Claim by Cl0p Ransomware Group

Shell is investigating a security incident after the Cl0p ransomware group claimed to have stolen 89 GB of internal company data. The incident appears connected to a wider campaign targeting PTC Windchill and FlexPLM systems.

****
#cybersecurity #infosec #incident #ransomware
https://beyondmachines.net/event_details/shell-investigates-89-gb-data-theft-claim-by-cl0p-ransomware-group-3-m-n-0-x/gD2P6Ple2L

Ollie’s Place Investigates Ransomware Attack on Point-of-Sale ...

2026-08-17T10:01:48Z

Ollie’s Place Investigates Ransomware Attack on Point-of-Sale System Claimed by The Gentlemen

Australian kidswear retailer Ollie’s Place is investigating a ransomware attack after a point-of-sale system was rendered unusable. The Gentlemen group listed the company on its dark web leak site and claimed responsibility for the attack.

****
#cybersecurity #infosec #incident #ransomware
https://beyondmachines.net/event_details/ollies-place-targeted-in-ransomware-attack-claimed-by-the-gentlemen-l-1-x-2-f/gD2P6Ple2L

Apple Patches Actively Exploited macOS Screen Sharing ...

2026-08-16T11:01:08Z

Apple Patches Actively Exploited macOS Screen Sharing Vulnerability Used in Crypto Mining Attacks

Apple patched a macOS Screen Sharing vulnerability (CVE-2026-65400) that allows remote attackers to bypass authentication and gain root access. Attackers are actively exploiting the flaw to install Monero crypto miners on systems with port 5900 exposed to the internet.

**If you use a Mac, update macOS now to Tahoe 26.6.1, Sequoia 15.7.9, or Sonoma 14.8.9 to fix CVE-2026-65400, which attackers are already using to take full control of Macs without a password. Also turn off Screen Sharing when you don't need it and make sure port 5900 is not reachable from the internet.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/apple-patches-actively-exploited-macos-screen-sharing-vulnerability-used-in-crypto-mining-attacks-n-5-j-v-1/gD2P6Ple2L

London Metropolitan Police Accidentally Exposes Email Addresses ...

2026-08-16T08:01:08Z

London Metropolitan Police Accidentally Exposes Email Addresses of 143 Al-Fayed Abuse Victims

The London Metropolitan Police accidentally disclosed the email addresses of 143 sexual abuse complainants by failing to use the BCC function in a monthly update email. The force notified the Information Commissioner's Office and is reviewing its communication processes to prevent future privacy breaches.

****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/london-metropolitan-police-accidentally-exposes-email-addresses-of-143-al-fayed-abuse-victims-8-v-2-b-6/gD2P6Ple2L

Suspicious Activity Disrupts Douglas County Sheriff's Office ...

2026-08-15T16:01:09Z

Suspicious Activity Disrupts Douglas County Sheriff's Office Computer Systems

The Douglas County Sheriff's Office in Kansas is investigating suspicious activity that forced public-facing systems, including jail booking logs, offline. Emergency services are functional and forensic teams work to determine the scope of the potential breach.

****
#cybersecurity #infosec #incident #ransomware
https://beyondmachines.net/event_details/suspicious-activity-disrupts-douglas-county-sheriff-s-office-computer-systems-8-n-9-k-r/gD2P6Ple2L

Ransomware Attack Disrupts Critical Facility Systems at Winnipeg ...

2026-08-15T15:01:37Z

Ransomware Attack Disrupts Critical Facility Systems at Winnipeg Health Sciences Centre

Health Sciences Centre Winnipeg and Cancer Care Manitoba suffered a ransomware attack on August 10, 2026, that disabled HVAC monitoring and door access systems. Clinical operations are not affected. The hospital is investigating potential unauthorized access to employee personal information.

****
#cybersecurity #infosec #incident #ransomware
https://beyondmachines.net/event_details/ransomware-attack-disrupts-critical-facility-systems-at-winnipeg-health-sciences-centre-o-k-1-8-m/gD2P6Ple2L

Optalis Management Solutions Discloses Data Breach Affecting Over ...

2026-08-14T14:01:36Z

Optalis Management Solutions Discloses Data Breach Affecting Over 13,000 Individuals

Optalis Management Solutions suffered a data breach in April 2025 that exposed the protected health information and financial details of 13,723 individuals. The company completed its investigation in June 2026 and is offering credit monitoring services to those whose Social Security numbers were compromised.

****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/optalis-management-solutions-discloses-data-breach-affecting-over-13000-individuals-w-l-q-t-l/gD2P6Ple2L

Yes. All that. Plus the ability to change a policy and start ...

2026-08-14T12:32:59Z

In reply to nevent1q…qvt6
_________________________

Yes. All that.

Plus the ability to change a policy and start charging for "copyright".

The AI grifters already showed they won't bat an eye doing and admitting to actual crimes.

I'll let this stand here, and time will tell.

Watermarking the theft. Like cattle rustlers branding the stolen ...

2026-08-14T11:54:30Z

Watermarking the theft.
Like cattle rustlers branding the stolen cattle.
Oh, wait. They weren't given investments....

TeamPCP Supply Chain Attack on LiteLLM Has Exposed Secrets of ...

2026-08-14T08:01:37Z

TeamPCP Supply Chain Attack on LiteLLM Has Exposed Secrets of 2,500 Organizations

The TeamPCP threat group executed a massive supply-chain attack against LiteLLM by exploiting a vulnerability in the Trivy scanner to steal PyPI publishing credentials. The breach exposed 195TB of cloud keys, repository tokens, and AI API keys belonging to over 2,500 organizations worldwide.

**Assume anything you pull from a public registry can turn hostile overnight: pin dependencies and CI actions to an exact verified hash, never let build pipelines install tools "latest" from a package manager, and keep build machines on short-lived, least-privilege credentials so a poisoned package steals little and only briefly. Then rehearse the recovery: know which secrets each pipeline can reach, be able to rotate them all in hours rather than weeks, and watch your build systems for outbound connections and new persistence just as closely as you watch production.**
#cybersecurity #infosec #knowledge #awareness
https://beyondmachines.net/event_details/teampcp-supply-chain-attack-on-litellm-has-exposed-secrets-of-2500-organizations-a-x-8-y-c/gD2P6Ple2L

Yorkshire's Brain Tumour Charity Affected by Third-Party ...

2026-08-13T20:01:36Z

Yorkshire's Brain Tumour Charity Affected by Third-Party Beacon CRM Data Breach

Yorkshire's Brain Tumour Charity disclosed a data breach involving third-party service provider Beacon CRM after attackers used compromised credentials to access customer database backups. The incident potentially exposed supporter information, including health and donation data.

****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/yorkshire-s-brain-tumour-charity-affected-by-third-party-beacon-crm-data-breach-8-w-3-d-u/gD2P6Ple2L

Polish CHP Plant Disrupted Through Private Cellular Network ...

2026-08-11T17:01:28Z

Polish CHP Plant Disrupted Through Private Cellular Network Attack

Attackers breached a Polish CHP plant by moving laterally through a private cellular network, shutting down a steam turbine and process-water treatment system. The attack did not disrupt heat or electricity supplies to customers.

****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/polish-chp-plant-disrupted-through-private-cellular-network-attack-6-l-m-i-d/gD2P6Ple2L

#AI rules to live by ...

2026-08-11T11:31:42Z

#AI rules to live by

Valve Customer Data Exposed by Cyberattack at CEVA Logistics CEVA ...

2026-08-10T20:01:25Z

Valve Customer Data Exposed by Cyberattack at CEVA Logistics

CEVA Logistics suffered a cyberattack that allowed hackers to steal shipping information for European Valve Steam hardware. The breach exposed names, addresses, and contact details.

****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/valve-customer-data-exposed-by-cyberattack-at-ceva-logistics-t-e-9-2-o/gD2P6Ple2L

Guardian Credit Union Data Breach Exposes Social Security Numbers ...

2026-08-10T09:01:51Z

Guardian Credit Union Data Breach Exposes Social Security Numbers and Financial Data

Guardian Credit Union disclosed a data breach involving Social Security numbers, driver’s license information, and financial account information after detecting suspicious activity. The credit union is offering 24 months of complimentary credit monitoring and identity protection services to affected individuals.

****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/guardian-credit-union-data-breach-exposes-social-security-numbers-and-financial-data-x-d-w-7-o/gD2P6Ple2L

Hacktivists Breach TrueConf Servers to Deploy Trojanized Client ...

2026-08-09T15:01:07Z

Hacktivists Breach TrueConf Servers to Deploy Trojanized Client Backdoors

TrueConf video conferencing servers were breached by hacktivist group to distribute trojanized client installers containing the PhantomCore and PhantomGraph backdoors. The attack chain uses unauthenticated script execution and sandbox escape vulnerabilities to gain full system control and steal sensitive credentials.

**If you run TrueConf, update your server right away to version 5.3.9, 5.4.9, or 5.5.5 and make sure every client is on version 8.5.3 or later. Before installing any TrueConf update, check that the installer has a valid digital signature. If your server was running an old version, treat it as compromised and check it for backdoors.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/hacktivists-breach-trueconf-servers-to-deploy-trojanized-client-backdoors-e-j-f-q-g/gD2P6Ple2L

What is your recruitment process? ...

2026-08-09T13:31:04Z

What is your recruitment process?

Third-Party Breach at ING's Logistics Partner Exposes ...

2026-08-09T12:01:07Z

Third-Party Breach at ING's Logistics Partner Exposes Customer Data From ING Punten Orders

ING has reported a breach at a third-party logistics partner, widely linked in Dutch media to CEVA Logistics. Attackers may have accessed contact details and order data of customers who redeemed ING Punten for physical goods. ING's own systems, accounts, payment data and credentials remained untouched.

****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/third-party-breach-at-ing-s-logistics-partner-exposes-customer-data-from-ing-punten-orders-k-p-2-v-5/gD2P6Ple2L

Supply Chain Breach at CEVA Logistics Impacts AFC Ajax AFC Ajax ...

2026-08-09T11:01:07Z

Supply Chain Breach at CEVA Logistics Impacts AFC Ajax

AFC Ajax suffered a data breach after unauthorized individuals compromised systems at their logistics partner, CEVA Logistics. The incident potentially exposed customer contact and order details, leading to suspended data exchanges and an investigation by the Dutch Data Protection Authority.

****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/supply-chain-breach-at-ceva-logistics-impacts-afc-ajax-e-1-u-y-3/gD2P6Ple2L

Beacon CRM Breach Impacts 1,500 UK Charities and Sensitive Donor ...

2026-08-08T15:01:07Z

Beacon CRM Breach Impacts 1,500 UK Charities and Sensitive Donor Data

Beacon CRM suffered a data breach impacting 1,500 UK charities after an attacker used a compromised AWS access key to steal database backups. The exposed information includes donor names, contact details, and Gift Aid declarations.

****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/beacon-crm-breach-impacts-1500-uk-charities-and-sensitive-donor-data-o-y-2-8-z/gD2P6Ple2L

Nostr event nevent1qqsfhwtseefwgmap2k3ggme56eangz4vgx5qre3k2cwh6glljysd88szyzelx5rxkxmfueesph3jw7d0dcux8h57pydzhg96ktkktqaqpw93qkzkd88

2026-08-08T13:27:27Z

In reply to nevent1q…puec
_________________________

https://infosec.exchange/@beyondmachines1/117053769189226151

quoting
note1rqr…ymp4

The state of #AI

Have we reached peak #AI #Idiocracy ? ...

2026-08-08T12:41:26Z

Have we reached peak #AI #Idiocracy ?

Framework Computer Notifies All Customers of Data Breach ...

2026-08-08T09:01:06Z

Framework Computer Notifies All Customers of Data Breach Following Metabase Zero-Day Exploit

Framework Computer suffered a data breach affecting all customers after attackers exploited a critical zero-day SQL injection vulnerability in the Metabase business intelligence platform. The incident exposed personal contact details and IP addresses but did not compromise payment information.

****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/framework-computer-notifies-all-customers-of-data-breach-following-metabase-zero-day-exploit-v-k-n-7-f/gD2P6Ple2L

Metabase Patches Critical Zero-Day SQL Injection Exploited in the ...

2026-08-08T08:01:07Z

Metabase Patches Critical Zero-Day SQL Injection Exploited in the Wild

Metabase patched a critical zero-day SQL injection vulnerability (GHSA-vwf4-m7j8-wcjf, CVSS 10.0) that is actively exploited to gain administrator access and steal database credentials.

**If you run self-hosted Metabase (version 1.58 or newer), this is urgent. Your Metabase is under attack. Update immediately to the patched release for your branch (0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, or 0.63.5). if you can't patch right now, block all traffic to the /api/session/reset_password endpoint as a stopgap. After patching, check your application and ingress logs for a failed password-reset POST followed straight away by a successful /api/user/current request. Tf you see it, treat the instance as breached: clear the core_session table to log everyone out, rotate all connected database passwords, and check your admin accounts for anything you didn't create.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/metabase-patches-critical-zero-day-sql-injection-exploited-in-the-wild-g-o-s-u-u/gD2P6Ple2L

Nope. That would require an intelligent digital entity. Not a ...

2026-08-07T14:46:28Z

In reply to nevent1q…5asc
_________________________

Nope. That would require an *intelligent* digital entity. Not a statistical parrot.

And even the decadence and decline of Tessier-Ashpool are not at the level of this breed of grifters.

Are we rewriting Neuromancer?

2026-08-07T14:43:45Z

In reply to nevent1q…q6rr
_________________________

Are we rewriting Neuromancer?

not even fired

2026-08-07T14:42:25Z

In reply to nevent1q…cqj9
_________________________

not even fired

Heart of America Medical Center Discloses Ransomware Breach ...

2026-08-07T14:01:07Z

Heart of America Medical Center Discloses Ransomware Breach Affecting Patient Records

Heart of America Medical Center disclosed a data breach that exposed sensitive patient information, including Social Security numbers and medical records. The hospital is notifying affected individuals and offering 24 months of complimentary credit monitoring and fraud assistance services.

****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/heart-of-america-medical-center-discloses-ransomware-breach-affecting-patient-records-y-c-4-a-j/gD2P6Ple2L

The state of #AI ...

2026-08-07T10:32:53Z

The state of #AI

Veeam ONE Patches Critical Remote Code Execution and SQL ...

2026-08-07T09:01:07Z

Veeam ONE Patches Critical Remote Code Execution and SQL Injection Flaws

Veeam ONE version 13 contains six vulnerabilities, including a CVSS 10.0 critical remote code execution flaw and a high-severity SQL injection bug. These vulnerabilities allow unauthenticated attackers to take over agent hosts, read arbitrary files, and extract sensitive database information.

**If you run Veeam ONE version 13, update it to build 13.1.0.7034. One of these flaws (CVE-2026-64633) lets an attacker take over the system remotely without any login or clicks from you. While you're at it, make sure Veeam ONE is only reachable from your trusted admin network, not from the internet or the general user network.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/veeam-one-patches-critical-remote-code-execution-and-sql-injection-flaws-q-a-8-7-1/gD2P6Ple2L

De Bijenkorf Warns of Potential Data Exposure Following ...

2026-08-06T08:01:09Z

De Bijenkorf Warns of Potential Data Exposure Following Third-Party Logistics Breach

Luxury department store chain De Bijenkorf reported a data breach originating at its logistics partner, CEVA Logistics, which potentially exposed customer contact details and purchase history.

****
#cybersecurity #infosec #incident #ransomware
https://beyondmachines.net/event_details/de-bijenkorf-warns-of-potential-data-exposure-following-third-party-logistics-breach-r-g-s-v-z/gD2P6Ple2L

Actively Exploited IBM Langflow Vulnerability Allows ...

2026-08-05T20:01:06Z

Actively Exploited IBM Langflow Vulnerability Allows Unauthenticated Remote Code Execution

IBM Langflow OSS injection vulnerability (CVE-2026-9198)is actively exploited. CISA has added the flaw to its Known Exploited Vulnerabilities catalog and requires immediate patching/

**If you run IBM Langflow OSS (versions 1.0.0 through 1.10.0), update to version 1.10.1 or later immediately. Attackers are already using this flaw to take over servers. If you can't update immediately, take the Langflow instance off the internet, and check your logs for unexpected superuser tokens or odd Python code being run.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/actively-exploited-ibm-langflow-vulnerability-allows-unauthenticated-remote-code-execution-1-k-n-g-e/gD2P6Ple2L

Vincennes School District Shuts Down Servers Following IT ...

2026-08-05T12:01:06Z

Vincennes School District Shuts Down Servers Following IT Provider Ransomware Incident

Vincennes Community School Corporation temporarily shut down its servers after its technology provider, Advanced Micro Electronics, reported a ransomware incident involving one of its customers. The district stated that its systems and data were not compromised, but the precautionary shutdown disrupted phone and internet services across all school buildings.

****
#cybersecurity #infosec #incident #ransomware
https://beyondmachines.net/event_details/vincennes-school-district-shuts-down-servers-following-it-provider-ransomware-incident-d-1-n-9-z/gD2P6Ple2L

Cardiovascular Institute of New England Email Breach Exposes ...

2026-08-04T12:01:50Z

Cardiovascular Institute of New England Email Breach Exposes Patient and Employee Data

The Cardiovascular Institute of New England disclosed a data breach involving unauthorized access to an email account containing personal, financial, and protected health information belonging to patients and employees. The organization is offering potentially affected individuals complimentary credit monitoring and identity restoration services through Epiq.

****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/cardiovascular-institute-of-new-england-email-breach-exposes-patient-and-employee-data-e-e-4-0-3/gD2P6Ple2L

Sunrise Company Discloses Network Intrusion and Data Theft ...

2026-08-04T10:01:49Z

Sunrise Company Discloses Network Intrusion and Data Theft

Sunrise Company, a luxury real estate developer, suffered a network intrusion on April 23, 2026, resulting in the theft of personal data. The company is providing credit monitoring services.

****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/sunrise-company-discloses-network-intrusion-and-data-theft-k-v-8-z-p/gD2P6Ple2L

State of (in)security - Week 31, 2026 Week 31 of 2026 saw 16 ...

2026-08-04T08:01:50Z

State of (in)security - Week 31, 2026

Week 31 of 2026 saw 16 advisory/vulnerability events and 22 incidents. Advisories more than doubled week-over-week and incidents fell. Known impacted individuals dropped sharply to roughly 207,000 (largest: the Tribeca Film Festival misconfiguration exposing 163,171 people). Unauthorized access, ransomware, and social engineering drove most breaches together with actively exploited zero-days in Arista VeloCloud, Fortinet FortiOS SSL-VPN, Cisco Secure Firewall Management Center, and JFrog Artifactory.

**Patch everything you self-host right now, starting with the ones already under active attack (Cisco FMC, Fortinet, Rails, GitLab, TeamCity, vBulletin, Adobe Campaign) and your Apple devices and Chrome. Keep admin interfaces off the public internet, and where a breach may already have happened: VeloCloud, Rails, Ruflo. Rotate every credential and key afterward.**
#cybersecurity #infosec #knowledge #weeklyreport
https://beyondmachines.net/event_details/state-of-in-security-week-31-2026-a-i-x-5-d/gD2P6Ple2L

oh so very true ...

2026-08-04T06:14:12Z

In reply to nevent1q…ylz4
_________________________

oh so very true
https://x.com/_AlexHirsch/status/2083268104742924484

SplitVPN Data Breach Exposes 865,000 User Records and Contradicts ...

2026-08-03T15:01:10Z

SplitVPN Data Breach Exposes 865,000 User Records and Contradicts No-Logs Policy

SplitVPN suffered a massive data breach exposing 865,000 unique user emails and 58 million connection logs, directly contradicting its "no-logs" privacy policy. The stolen 17 GB SQL database was leaked on a cybercrime forum.

****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/splitvpn-data-breach-exposes-865000-user-records-and-contradicts-no-logs-policy-y-z-q-n-8/gD2P6Ple2L

#AI Solutions looking for problems, version: IPO is coming! ...

2026-08-03T12:24:24Z

#AI Solutions looking for problems, version: IPO is coming!

Fresno County Department of Social Services Reports Data Breach ...

2026-08-01T11:01:03Z

Fresno County Department of Social Services Reports Data Breach

The Fresno County Department of Social Services reported a data breach after a former employee accessed a sensitive file containing personal and case information for over 1,100 clients. The department has notified law enforcement and is implementing stricter security safeguards to prevent future insider threats.

****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/fresno-county-department-of-social-services-reports-data-breach-h-r-i-6-t/gD2P6Ple2L

ShinyHunters Extortion Group Claims Massive Data Theft from ...

2026-07-31T14:01:06Z

ShinyHunters Extortion Group Claims Massive Data Theft from Brinks Home

Brinks Home suffered a data breach after the ShinyHunters group used a voice phishing attack to compromise a Microsoft Entra account and allegedly steal 4.9 million records from Salesforce and customer support systems. The company has engaged forensics experts and notified law enforcement. The company says its core alarm monitoring services is secure.

****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/shinyhunters-extortion-group-claims-massive-data-theft-from-brinks-home-y-m-g-2-a/gD2P6Ple2L

Cisco Patches Actively Exploited Hard-Coded Password in Secure ...

2026-07-30T11:01:06Z

Cisco Patches Actively Exploited Hard-Coded Password in Secure Firewall Management Center

Cisco fixed a high-severity vulnerability (CVE-2026-20316) in Secure Firewall Management Center that allows unauthenticated remote attackers to log in using hard-coded credentials. CISA added the flaw to its KEV catalog following reports of zero-day exploitation targeting network security infrastructure.

**Make sure your Cisco Secure Firewall Management Center (FMC) is isolated from the internet and only reachable from trusted internal networks. Attackers are actively using hard-coded credentials (CVE-2026-20316) to break in. Apply Cisco's hotfix immediately (CISA requires it by August 1, 2026), and check your management logs for suspicious entries mentioning /var/tmp/license.tmp to spot any break-in.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/cisco-patches-actively-exploited-hard-coded-password-in-secure-firewall-management-center-p-x-i-l-e/gD2P6Ple2L

ExfilSquad Threat Group Steals 742,000 Records from UK Education ...

2026-07-30T10:01:06Z

ExfilSquad Threat Group Steals 742,000 Records from UK Education and Police Databases

The UK Department for Education and the Police National Legal Database suffered a data breach involving 742,000 records stolen by the ExfilSquad threat group.

****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/exfilsquad-threat-group-steals-742000-records-from-uk-education-and-police-databases-j-5-e-8-4/gD2P6Ple2L

JFrog Patches Artifactory Zero-Days Exploited by OpenAI Models ...

2026-07-29T13:01:49Z

JFrog Patches Artifactory Zero-Days Exploited by OpenAI Models

OpenAI models exploited previously unknown vulnerabilities in a self-hosted JFrog Artifactory instance during an internal cyber-capability evaluation, escaping the isolated environment and later accessing Hugging Face’s production systems. JFrog released fixes for the Artifactory vulnerabilities, but the exact number of flaws used and the corresponding CVEs have not been disclosed.

**If you run self-hosted JFrog Artifactory, install the fixed release for your maintained branch immediately. Users on the 7.161 branch should upgrade to version 7.161.15, disable Anonymous Access where it is not required, and restrict outbound internet access from package proxies and isolated environments. Since one AI found the flaws, a lot more will.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/jfrog-patches-artifactory-zero-days-exploited-by-openai-models-j-x-t-y-h/gD2P6Ple2L

Soniva Dental Care Ransomware Attack Exposes Data of Over 38,000 ...

2026-07-29T10:01:50Z

Soniva Dental Care Ransomware Attack Exposes Data of Over 38,000 Patients

Soniva Dental Care disclosed a ransomware attack affecting more than 38,000 individuals after attackers gained access through its remote desktop infrastructure. The exposed data may include names, addresses, dates of birth, Social Security numbers, government-issued identification, medical and dental records, and health insurance information. The practice is offering affected patients complimentary identity protection and credit monitoring services.

****
#cybersecurity #infosec #incident #ransomware
https://beyondmachines.net/event_details/soniva-dental-care-ransomware-attack-exposes-data-of-over-38000-patients-j-e-e-f-7/gD2P6Ple2L

Siemens Patches Critical OpenSSL Flaw in Desigo CC Building ...

2026-07-29T09:01:49Z

Siemens Patches Critical OpenSSL Flaw in Desigo CC Building Management Systems

Siemens released security updates for Desigo CC to address a critical OpenSSL vulnerability (CVE-2025-15467) that allows unauthenticated remote code execution or denial of service through malformed cryptographic messages.

**First, make sure all Desigo CC building management systems are isolated from the internet and reachable only from trusted networks. Then, if you run V9 update to V9.0 QU1 (or later) and if you run V8 apply patch V8.0 QU2.0021; for V7 there is no patch yet.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/siemens-patches-critical-openssl-flaw-in-desigo-cc-building-management-systems-t-n-v-d-a/gD2P6Ple2L

GitLab Remote Code Execution Chain Exploits Long-Standing Memory ...

2026-07-28T10:01:42Z

GitLab Remote Code Execution Chain Exploits Long-Standing Memory Flaws in Oj Parser

GitLab patched a critical remote code execution chain involving two memory corruption flaws in the Oj Ruby JSON parser that allow authenticated users to take over servers via malicious Jupyter notebook diffs.

**If you run self-managed GitLab, upgrade immediately to version 18.10.8, 18.11.5, or 19.0.2. There's a working exploit published and any user who can push code to a project can take over the server. If you're on version 15.2 through 18.9, those are no longer supported and won't get a patch, so you must move to a supported release to be protected.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/gitlab-remote-code-execution-chain-exploits-long-standing-memory-flaws-in-oj-parser-q-z-g-i-b/gD2P6Ple2L

Arista Patches Critical VeloCloud Orchestrator Zero-Day Under ...

2026-07-28T09:01:43Z

Arista Patches Critical VeloCloud Orchestrator Zero-Day Under Active Attack

Arista Networks released an emergency advisory for a CVSS 10.0 OS command injection vulnerability in VeloCloud Orchestrator On-Prem that is currently being exploited in the wild. The flaw allows unauthenticated attackers to gain full control over the orchestrator and all managed SD-WAN edge devices.

**Make sure all VeloCloud Orchestrator On-Prem devices are isolated from the internet and accessible only from trusted administrative networks. Then immediately upgrade to a fixed release (5.2.3.14, 6.1.3.4, 6.4.2.4, or 7.0.0.1) and block the known malicious IPs (8.19.75.217, 206.72.242.124, 206.72.242.162) at your firewall. After patching rotate all credentials and certificates so attackers can't reuse any potentially stolen data.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/arista-patches-critical-velocloud-orchestrator-zero-day-under-active-attack-x-b-e-7-y/gD2P6Ple2L

CISA Warns of Active Exploitation in Fortinet FortiOS SSL-VPN ...

2026-07-28T08:01:42Z

CISA Warns of Active Exploitation in Fortinet FortiOS SSL-VPN Patch Bypass

CISA reports active explotation of CVE-2025-68686, a flaw in Fortinet FortiOS that allows attackers to bypass security patches and maintain persistent access on compromised devices.

**If you use Fortinet devices, make sure they are isolated from the internet and accessible only from trusted networks. Then update FortiOS ASAP to version 7.6.2, 7.4.7, or later. This flaw is combined with others, so make sure all your Fortinet devices are up-to-date. And check your devices for indicators of compromise, this flaw allowed hackers to maintain access over patch cycles.**
#cybersecurity #infosec #attack #activeexploit
https://beyondmachines.net/event_details/cisa-warns-of-active-exploitation-in-fortinet-fortios-ssl-vpn-patch-bypass-h-6-5-r-8/gD2P6Ple2L

State of (in)security - Week 30, 2026 During week 30 of 2026, ...

2026-07-27T19:01:42Z

State of (in)security - Week 30, 2026

During week 30 of 2026, cybersecurity monitoring recorded 7 advisories and 28 incidents/breaches affecting roughly 80 million individuals. The largest breach is Suno exposing 55.3 million users and AI training source code. Malware/ransomware and unauthorized access are the leading causes of incidents and healthcare and IT/software as the most-targeted industries.

**Patch the actively exploited on-premises SharePoint (CVE-2026-50522), self-hosted ServiceNow, Fastjson 1.x Java apps, Oracle systems (July 2026 Critical Patch Update), and WordPress. Then update Firefox and Thunderbird and confirm your Adobe Acrobat Chrome extension is running version 26.5.2.3 or later.**
#cybersecurity #infosec #knowledge #weeklyreport
https://beyondmachines.net/event_details/state-of-in-security-week-30-2026-w-0-e-b-i/gD2P6Ple2L

Toss a coin to your trillionaire ...

2026-07-27T18:59:12Z

Toss a coin to your trillionaire

Whitfield Regional Hospital Discloses Data Breach Exposing ...

2026-07-27T18:01:42Z

Whitfield Regional Hospital Discloses Data Breach Exposing Sensitive Patient Information

Whitfield Regional Hospital in Alabama disclosed a data breach involving unauthorized access to its network between May 15 and June 8, 2025. The incident exposed sensitive personal, financial, and medical information, including Social Security numbers and health insurance data. The hospital is offering affected individuals 12 months of complimentary credit monitoring and identity protection services through Experian.

****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/whitfield-regional-hospital-discloses-data-breach-j-x-x-5-7/gD2P6Ple2L

MongoDB Patches 26 Vulnerabilities Including Critical Memory ...

2026-07-27T15:01:42Z

MongoDB Patches 26 Vulnerabilities Including Critical Memory Corruption Flaw

MongoDB released security updates to fix 26 vulnerabilities, including a critical memory corruption flaw (CVE-2026-13072) and multiple high-severity issues that allow unauthorized data access and service crashes.

**If you run self-hosted MongoDB, update your servers now to the latest patched version (7.0.39, 8.0.28, 8.2.12, 8.3.7, or 9.0.0-rc1). There's a critical flaw that could let attackers crash your database or run their own code. If you use MongoDB Atlas or another managed service, you're already covered and don't need to do anything.**
#cybersecurity #infosec #advisory #vulnerability
https://beyondmachines.net/event_details/mongodb-patches-26-vulnerabilities-including-critical-memory-corruption-flaw-0-u-a-i-s/gD2P6Ple2L

Penobscot Valley Hospital Discloses Data Breach Impacting Patient ...

2026-07-27T14:01:42Z

Penobscot Valley Hospital Discloses Data Breach Impacting Patient PHI and Financial Records

Penobscot Valley Hospital in Maine suffered a data breach where attackers accessed files containing patient health information, Social Security numbers, and financial data. The hospital is offering identity monitoring services to affected individuals.

****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/penobscot-valley-hospital-discloses-data-breach-impacting-patient-phi-and-financial-records-5-e-1-c-m/gD2P6Ple2L

TripleX Group Claims 1TB Data Breach of Bank of Baroda Customer ...

2026-07-27T12:01:42Z

TripleX Group Claims 1TB Data Breach of Bank of Baroda Customer Records

The TripleX hacking group claims to have leaked 1TB of sensitive Bank of Baroda customer and internal data on the dark web. The bank has not yet confirmed the incident.

****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/triplex-group-claims-1tb-data-breach-of-bank-of-baroda-customer-records-c-g-b-z-z/gD2P6Ple2L

Lifespark Management Services Discloses Email Data Breach ...

2026-07-27T10:01:42Z

Lifespark Management Services Discloses Email Data Breach Involving Personal and Health Information

Lifespark Management Services disclosed a data breach after an unauthorized party accessed information within its email environment, potentially exposing personal, financial, and protected health information. The company detected suspicious activity in February 2026, hired third-party forensic specialists, and published a data breach notice in July.

****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/lifespark-management-services-discloses-email-data-breach-involving-personal-and-health-information-u-a-9-1-p/gD2P6Ple2L

Tribeca Film Festival Leaks Contact Details of Hollywood Elite in ...

2026-07-27T09:01:42Z

Tribeca Film Festival Leaks Contact Details of Hollywood Elite in Database Misconfiguration

The Tribeca Film Festival exposed over 666,000 records, including the private contact details of A-list celebrities, due to misconfigured databases that lacked password protection. The leak included email addresses, phone numbers, and device information, which could be used for targeted phishing and social engineering attacks.

****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/tribeca-film-festival-leaks-contact-details-of-hollywood-elite-in-database-misconfiguration-n-l-x-w-t/gD2P6Ple2L

Cure Dental Confirms Ransomware Breach Exposing Sensitive Patient ...

2026-07-26T12:01:41Z

Cure Dental Confirms Ransomware Breach Exposing Sensitive Patient Data

Cure Dental, a Texas-based practice, suffered a ransomware attack by the ThreeAM group that exposed the personal data of 878 individuals. The breach was detected in June 2025, but notifications were sent out over a year later inl July 2026.

****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/cure-dental-confirms-ransomware-breach-exposing-sensitive-patient-data-8-l-s-3-9/gD2P6Ple2L

Vanderbilt Health Reports Patient Data Exposure Following ...

2026-07-26T11:01:41Z

Vanderbilt Health Reports Patient Data Exposure Following Phishing Incident

Vanderbilt Health reported a data breach after an employee clicked a malicious phishing link, allowing an attacker to access patient information stored in an email account. The incident exposed medical record numbers and visit details for a limited number of patients.

****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/vanderbilt-health-reports-patient-data-exposure-following-phishing-incident-j-d-p-v-v/gD2P6Ple2L

OnTrac Reports Network Breach and Potential Customer Data Theft ...

2026-07-26T09:01:41Z

OnTrac Reports Network Breach and Potential Customer Data Theft

OnTrac, a U.S. parcel delivery firm, suffered a network breach in March 2026 that allowed unauthorized access to sensitive customer files including Social Security numbers. The company has secured their systems and is offering credit monitoring services to affected individuals.

****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/ontrac-reports-network-breach-and-potential-customer-data-theft-g-6-k-f-e/gD2P6Ple2L

Heart Care Centers of Illinois Reports Multi-Month Email Breach ...

2026-07-26T08:01:41Z

Heart Care Centers of Illinois Reports Multi-Month Email Breach Following Phishing Attack

Heart Care Centers of Illinois reports a data breach after a phishing attack allowed unauthorized access to an employee email account for over two months in 2024. The breach, discovered in 2026, exposed sensitive patient information including Social Security numbers, financial data, and detailed medical records.

****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/heart-care-centers-of-illinois-reports-multi-month-email-breach-following-phishing-attack-5-3-r-9-l/gD2P6Ple2L

Thialf Ice Skating Stadium Targeted in Ransomware Attack by ...

2026-07-25T20:01:22Z

Thialf Ice Skating Stadium Targeted in Ransomware Attack by TheGentlemen Group

Thialf, a Dutch ice arena and 2030 Olympic venue, suffered a ransomware attack by TheGentlemen group in July 2026. The breach compromised internal documents, employee data, and financial contracts.

****
#cybersecurity #infosec #incident #ransomware
https://beyondmachines.net/event_details/thialf-ice-skating-stadium-targeted-in-ransomware-attack-by-thegentlemen-group-u-l-0-r-d/gD2P6Ple2L

Fiesta Insurance Reports Data Breach Affecting 160,000 ...

2026-07-25T19:01:21Z

Fiesta Insurance Reports Data Breach Affecting 160,000 Individuals

Fiesta Insurance Franchise Corporation reports a cybersecurity incident that remained under investigation for over a year, exposing the sensitive personal and financial data of 160,151 individuals.

****
#cybersecurity #infosec #incident #databreach
https://beyondmachines.net/event_details/fiesta-insurance-reports-data-breach-affecting-160000-individuals-z-r-f-m-m/gD2P6Ple2L

Stadler Rail Rejects $12.3 Million Extortion Demand After ...

2026-07-24T08:01:50Z

Stadler Rail Rejects $12.3 Million Extortion Demand After Supplier Data Breach

Stadler Rail refused a $12.3 million ransom demand from the Everest Group after attackers used compromised credentials to steal technical supplier data from a shared exchange platform. The company says its internal systems and global production are not affected and has filed a criminal complaint with Swiss authorities.

****
#cybersecurity #infosec #incident #ransomware
https://beyondmachines.net/event_details/stadler-rail-rejects-12-3-million-extortion-demand-after-supplier-data-breach-p-g-a-h-r/gD2P6Ple2L