SecurityWeek

The vulnerability tracked as CVE-2026-85097 can allow threat actors to take control of the targeted WordPress websites.

The outage hit the main Ubuntu and Canonical websites, including the Ubuntu blog and developer portal.

Oleg Korniev was a leader of YMCO, a sophisticated network of money mules that helped hackers move funds outside the US.

Hackers stole patients’ personal information, including names, addresses, email addresses, dates of birth, and phone numbers.

The suspect is believed to be Edward Dubrovsky, a Canadian cybersecurity executive who was visiting the United States for a conference.

CVE-2026-102255 is a pre-authenticated SSRF flaw that could allow attackers to perform unauthorized operations.

Beginning February 2027, all newly issued certificates will have a 64-day validity period by default.

The former core infrastructure engineer deleted admin accounts, reset hundreds of passwords, and demanded 20 bitcoin to spare the company’s servers.

The ChatGPT maker said the researchers "violated clear policies on handling sensitive information.”

Noteworthy stories that might have slipped under the radar: Tensorlake npm SDK compromised, Empire Market co-founder gets 40 years, exposed NVIDIA GPU monitors leak telemetry.

Hackers hijacked the .gh, .sl, and .as ccTLDs and obtained HTTPS certificates for several Google domains.

The flaws, CVE-2026-105133 and CVE-2026-105134, allow attackers to bypass authentication and inject OS commands.

Midnight Mimosa is the name given to a malware campaign primarily running preinstalled on low-cost Android devices.

Flax Typhoon and other APTs used MicroScan and FishHub to scan and hack US and foreign critical infrastructure.

OSS Scanner sends unreviewed, model-generated vulnerability reports to open source maintainers that opt in.

The security defect, tracked as CVE-2026-107406, could lead to remote code execution or denial-of-service.

$1.2 million was paid out at Pwn2Own Ireland 2026 for exploits targeting phones, printers, smart speakers, smart home hubs, and AI infrastructure and coding tools.

Researchers from George Washington University have published a paper examining whether the time and cause of AI going rogue can be predicted.

The security defects could lead to unauthorized access, information leaks, privilege escalation, DoS attacks, and remote code execution.

All enterprises conduct security awareness training for their employees. But whether this has tangible benefits is debatable.