117 casos · pág. 5/6
This weekly recap covers several concurrent incidents. ConnectWise disabled seven application identities and suspended Cloud Backup after unknown actors abused them to compromise Microsoft 365 tenants. China-nexus Armory Castle (UNC5221 / Warp Panda) exploited BeyondTrust Remote Support flaw CVE-2026-102764 (CVSS 9.3) as a zero-day in lat…
The PHP security team released emergency fixes on October 21, 2026 for two critical core flaws, CVE-2026-109618 and CVE-2026-109619, nicknamed PHP2Shell. Both are rated CVSS v4.0 9.2 and allow unauthenticated remote code execution (RCE) as the web worker account. They can also expose process memory that may hold credentials and API keys (…
American Renal Management LLC, doing business as Innovative Renal Care, a kidney care provider with more than 200 locations in 28 U.S. states, has proposed a $900,000 settlement to resolve consolidated class action litigation (In re American Renal Management LLC Data Breach Litigation, U.S. District Court for the Middle District of Tennes…
Ridgeway Pharmacy Ltd, a Victor, Montana mail order and community pharmacy, disclosed that a security incident involving its third-party designed and developed website exposed the personal and health information of 258,920 customers. The company became aware of the exposure on August 21, 2026. Forensic experts confirmed the incident was l…
A Tenable blog post for Cybersecurity Awareness Month argues that shadow AI now covers far more than personal chatbots. It includes unvetted MCP servers, AI browser extensions, locally hosted models, coding assistants and autonomous agents holding broad credentials. Citing IBM's 2026 Cost of a Data Breach Report, it says 43% of organizati…
Jefferson County Health Department (Hillsboro, Missouri) has agreed to a $2.25 million settlement of a consolidated class action over a 2022 data security incident. An unauthorized third party accessed its network between October 31 and November 15, 2022, and may have viewed or obtained personal and protected health information. The breac…
Researchers at Claroc disclosed GhostShares, a design flaw in Meta's Muse AI assistant that lets anyone discover shared conversations through passive DNS. Muse share links use the domain cf.metaaiusercontent.com and embed the conversation title and a random identifier in the hostname. Once a browser resolves the name, passive DNS sensors …
A public repository exposed sensitive data from Smart Sampa, the Prefeitura de São Paulo video surveillance system, for about 11 months, allowing unauthorized access to more than 58,000 cameras. Cameras covered sensitive sites such as daycare centers, schools, hospitals and drug-treatment centers. According to UOL, reporters used the expo…
Ticketmaster confirmed a security incident that exposed personal data of customers in Brazil who bought tickets in 2025. The company notified affected users by email and reported the case to the Brazilian data protection authority (ANPD). According to the company, the incident involved a third-party data analytics tool. The investigation,…
A $6,438,578.20 settlement has been agreed to resolve the "Other Labs Track" of consolidated litigation over the American Medical Collection Agency (AMCA) breach. The defendants are AMCA clients Sonic Healthcare U.S.A., Aurora Diagnostics LLC, Clinical Pathology Laboratories, Inc. and Austin Pathology Associates. AMCA, a subsidiary of Ret…
Mid Florida Dermatology & Plastic Surgery, a 33-location medical group in central Florida, reported to the HHS Office for Civil Rights a breach affecting 85,585 individuals. An unauthorized third party accessed its network from March 26 to March 30, 2026, and patient files may have been viewed or acquired. Two other healthcare incidents w…
Boston Children's Health Physicians (BCHP) and its managed IT provider XTIUM (formerly Axispoint Technology Solutions Group) settled with the New York and Connecticut Attorneys General over an August 2024 breach affecting almost 890,000 individuals. The settlement carries a $4 million penalty, of which $2.7 million is payable (New York $2…
iRhythm Technologies, maker of the Zio wearable ECG monitor, has had a June 2026 data breach confirmed at roughly 8.18 million individuals, according to the Oregon Attorney General breach list. This is close to its entire customer base of about 8 million patients in the US and Europe. The company first identified unauthorized access on Ju…
An actor using the handle ChimeraZ claims to be selling a dataset from LOOF (Livre Officiel des Origines Félines), the French organization that registers pedigree cats and maintains official feline genealogical records. The listing advertises about 654,000 lines, roughly 330,000 animal records, about 40,000 people and 90,555 files totalin…
Germany's Alternative für Deutschland (AfD) confirmed on 19 October 2026 that a hosting provider used by the party was hacked in September and that mailboxes were copied. The anonymous site hexane.cc went online claiming to index 421,179 internal party emails. It does not publish the emails. It shows AI-generated summaries sorted into cat…
Scammers abused a legitimate spend-management platform as part of a fraud operation. They used its notification system to send phishing messages and its open-banking account linking to validate stolen banking credentials. Group-IB documented the activity in a client environment after the platform reported suspicious payment notifications …
Paradigm Healthcare Services, a San Francisco-based billing processor for Medi-Cal (California's Medicaid program) under a data use agreement with the California DHCS, told the US HHS that a breach affected more than 970,000 people. The company detected unauthorized access to its local network on October 13, 2025. It determined only on Au…
GreyNoise reports that a single malicious cyber actor, tracked since 7 May 2026, is a suspected Chinese speaker working in UTC+8 and is the same as or related to Red Heron (reported by Acronis), based on the shared C2 domain, malware family, Gitea exploitation and other TTPs. The actor exploited the wp2shell WordPress chain (CVE-2026-6303…
The Hakai Security Research Team disclosed CVE-2026-44706, a SQL Injection in Chatwoot versions <= 4.11.1. Any authenticated user with agent privileges, the lowest access level, can read the entire PostgreSQL database. The flaw sits in the FilterService, where user input is interpolated directly into SQL. Exposed data includes bcrypt pass…
AI-assisted "vibe coding" is lowering the barrier to app development, but it is also producing apps with common security oversights that app marketplaces do not necessarily flag. The article cites a report that 84% of developers were using or planning to use AI tools, and a Lovable-hosted app in which a researcher found 16 vulnerabilities…
