SecurityWeek

The pharmaceutical giant says the attackers gained access to personal data stored on the compromised systems. 

French officials say roughly 73,000 government accounts were affected, while the threat actor claims to have stolen messages and user data from the sovereign Tchap platform.

The extortion group threatens to leak 297 GB of data allegedly stolen from the Council of Europe, including employee personal information.

The platform used more than 9,000 phishing sites, stealing nearly 4 million credit cards and causing roughly $1.9 billion in losses.

Someone posted fake VRChat and Discord data breach reports on the system, prompting the Maine AG to take action.

By default, npm install will no longer execute scripts from dependencies, unless explicitly allowed.

Anthropic takes Fable 5 and Mythos 5 offline to comply with a directive from the Trump administration to prevent use by foreign nationals.

Other noteworthy stories that might have slipped under the radar: ICS device exposure remains flat as attack surface widens, Microsoft issues incident response playbook for AI, IBM and AT&T accused of hack cover-ups.

Industry professionals comment on various aspects of Fable 5, including dual-use capabilities, safeguards, and tiered access.

The hackers published 5GB of data, including customer personal information and credentials for the RTKBase platform.

The critical-severity OS command injection vulnerability allows attackers to execute arbitrary code with root privileges.

The browser refresh resolved critical and high-severity security defects, including a dozen use-after-free bugs.

An AI hacker claims to have achieved a prompt-based jailbreak shortly after Fable 5’s launch, but Anthropic says it’s not a real jailbreak.

Oracle has mitigated CVE-2026-35273, but it has not publicly confirmed the vulnerability’s in-the-wild exploitation.

Oracle has released mitigations for CVE-2026-35273, but it has not said whether it’s a zero-day exploited in ShinyHunters attacks.

As alert volumes outpace human capacity, organizations are turning to AI, automation, and deeper context to separate real threats from the noise.

The new BOD 26-04 requires agencies to review and update vulnerability management policies with a focus on KEV catalog entries.

Researchers say the OnyxC2 malware targets more than 200 applications and extensions while evading detection through encrypted payloads, DLL sideloading, and in-memory execution techniques.

Disclosed in March, the security defect enables unauthenticated attackers to write files to arbitrary locations on the system.

A PowerShell script included in patch files appears to be triggering false positives by multiple security engines.