Hackers Spied on a Stock Exchange Executive's Outlook Mailbox for Five Months

Unknown attackers maintained at least five months of access to a senior global stock exchange executive’s Outlook mailbox.

Cisco Patches CVE-2026-20230 in Unified CM as Exploit Code Goes Public

Cisco patched a Unified CM flaw allowing unauthenticated network attackers to write files and escalate to root.

CISA Adds Exploited Magento RCE Flaw CVE-2026-45247 to KEV Catalog

CISA added CVE-2026-45247, a CVSS 9.8 Mirasvit Cache Warmer flaw affecting Magento stores, to its KEV catalog after active exploitation.

China-Linked TA4922 Expands Phishing Attacks to U.K., Germany, Italy, and South Africa

TA4922 expanded targeting to organizations in the U.K., Germany, Italy, and South Africa while continuing campaigns against East Asia.

Five Eyes Warns Chinese Spies Are Using Fake Job Ads to Target Military Staff

Follow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread

iFood Confirms Data Breach Affecting 1.2 Million Users in Brazil

Follow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread

Dashlane Brute-Force Attack Leads to Limited Encrypted Vault Downloads

Dashlane’s security systems automatically locked accounts to protect them against the hacking attempts.

Oracle WebLogic CVE-2024-21182 Added to KEV Catalog After Active Exploitation

CVE-2024-21182 entered CISA's KEV catalog after active exploitation evidence, requiring federal patching by June 4, 2026.

Android Update Patches Exploited Zero-Day, 123 Other Vulnerabilities

Google says the Android vulnerability CVE-2025-48595 has been exploited in limited, targeted attacks.

Trump Signs Voluntary AI Cyber Review Order

President Trump signed an executive order creating a voluntary framework for evaluating advanced AI systems with significant cybersecurity capabilities, directing

HP Poly VoIP vulnerability sets the stage for executive voice deepfakes

The remote code execution flaw enables root access and voice attacks on HP Poly VoIP phones, including eavesdropping and the ability to collect audio to generate deepfakes.

Anthropic Lets Claude Mythos Spread Its Glasswings

It's dangerous, but not TOO dangerous to give to more organizations.

Inspector general finds NIST mistakes have made vulnerability database ineffective

NIST’s National Vulnerability Database (NVD) backlog mushroomed from 13,000 unprocessed security vulnerabilities in February 2024 to more than 27,000 by the end of 2025, “undermining the NVD’s utility...