The suspect is believed to be Edward Dubrovsky, a Canadian cybersecurity executive who was visiting the United States for a conference.
CVE-2026-102255 is a pre-authenticated SSRF flaw that could allow attackers to perform unauthorized operations.
The former core infrastructure engineer deleted admin accounts, reset hundreds of passwords, and demanded 20 bitcoin to spare the company’s servers.
As AI accelerates vulnerability discovery and exploitation, so-called virtual patching still comes down to defense-in-depth and strong application security fundamentals.
– AI, supply-chain exposure, quantum computing and geopolitical conflict are testing security programs. Preparing for disruption must become part of day-to-day operations.
Agentic remediation is not an act of faith. We are talking about fixing known problems, not judgment calls about unfamiliar risk.
Point-in-time audits and sampled assessments offer only snapshots; continuous control monitoring provides evidence that security controls are working today.
Every leaked credential should be dead, or dying, within sixty seconds of being found. Here’s a proposal to make that the default.
Learn about Frontier Pace Governance: a practical approach to helping IT operations move at AI speed without sacrificing security, accountability, or operational discipline.
RegisterJoin as we decipher the world of zero trust and share war stories on securing an organization by eliminating implicit trust and continuously validating every stage of a digital interaction.
Register
SecurityWeek’s ICS Cybersecurity Conference celebrates its 25th anniversary in Nashville. Join the largest and longest-running event series focused on industrial cybersecurity.
[October 6-8, 2026 | In-Person]
SecurityWeek’s 2026 Zero Trust Summit will deep-dive into the world of digital identity management and the role of zero-trust principles and associated technologies
[October 14, 2026 | Virtual]
The 2026 Virtual CISO Forum brings together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.
[November 11, 2026]
SecurityWeek’s CodeSecCon 2026 will bring together developers and cybersecurity professionals to revolutionize the way applications are built, secured, and maintained.
[Originally August 19, 2026]
-
The vulnerability tracked as CVE-2026-85097 can allow threat actors to take control of the targeted WordPress websites. (October 12, 2026)
-
CVE-2026-102255 is a pre-authenticated SSRF flaw that could allow attackers to perform unauthorized operations. (October 12, 2026)
-
The flaws, CVE-2026-105133 and CVE-2026-105134, allow attackers to bypass authentication and inject OS commands. (October 9, 2026)
-
The security defect, tracked as CVE-2026-107406, could lead to remote code execution or denial-of-service. (October 9, 2026)
-
The outage hit the main Ubuntu and Canonical websites, including the Ubuntu blog and developer portal. (October 12, 2026)
-
Oleg Korniev was a leader of YMCO, a sophisticated network of money mules that helped hackers move funds outside the US. (October 12, 2026)
-
The suspect is believed to be Edward Dubrovsky, a Canadian cybersecurity executive who was visiting the United States for a conference. (October 12, 2026)
-
The former core infrastructure engineer deleted admin accounts, reset hundreds of passwords, and demanded 20 bitcoin to spare the company’s servers. (October 10, 2026)
