Security news.
Today's security landscape is dominated by critical vulnerabilities, active exploitation, and significant data breaches, alongside discussions on AI's impact on both offensive and defensive cybersecurity. Defenders face a surging volume of threats, requiring rapid adaptation beyond traditional patching models.
CISA: Windows Task Host Flaw Now Exploited by Ransomware Gangs
CISA confirmed that ransomware groups are actively exploiting a high-severity Windows Task Host vulnerability, previously flagged in April as actively exploited.
16 Typosquatted RubyGems Packages Steal Browser Credentials and Crypto Wallets
A new typosquatting campaign is targeting RubyGems users, distributing a Windows-based information stealer via malicious packages like 'ubnuler' and 'rakier'.
300,000 WordPress Sites Potentially Exposed to Hacking Due to Form Plugin Flaw
A critical arbitrary file upload vulnerability (CVE-2026-15748) in a WordPress form plugin allows unauthenticated attackers to upload executable files, impacting over 300,000 sites.
Heights Finance Data Breach Impacts at Least 1.2 Million Individuals
Hackers gained unauthorized access to a third-party platform, stealing names, addresses, Social Security numbers, and financial information of at least 1.2 million individuals from Heights Finance.
GitLab Patches Critical Code Injection Vulnerability
GitLab has released patches for a critical code injection vulnerability that could allow unauthenticated attackers to modify or delete user data and public projects.
'Ransom Busters': Ransomware Actor Poses as Incident-Recovery Service
A ransomware affiliate is reportedly approaching victims with offers of incident recovery, in a deceptive scheme to divert ransom payments for their own benefit.
AI-Driven Vulnerability Surge Breaks the Traditional Patching Model
Rapid7 warns that the explosion of AI-driven vulnerability disclosures and faster exploitation renders traditional patch cycles obsolete, requiring organizations to prioritize exposure management over severity scores.
One Attacker Has Scraped Both Salesforce and ServiceNow Portals Since 2025
Research reveals that a single threat actor has been continuously scraping records from Salesforce and ServiceNow customer portals across various industries for over a year, dubbed the "City Forum" campaign.