Cybersecurity News, Insights and Analysis

SonicWall has released security updates to address two security flaws impacting its Secure Mobile Access (SMA) 1000 series VPN appliances that have been exploited in zero-day attacks. An active malware campaign is using bogus software-download websites to impersonate trusted vendors and distribute malicious installers. Google on Wednesday announced Gemini 3.8 Flash Cyber, which it described as its most capable cybersecurity model, and has made it available to a set of trusted defenders via a new initiative called the Fairwind Program . Project Watershed 250 will see water providers in Texas provided with federal and private sector cybersecurity resources amid rising nation-state threats The US healthcare provider confirmed that sensitive patient and employee data, alongside financial and business information, were exfiltrated by a third party

The company will give select partners early access to its Astra AI model—so they have time to shore up their defenses. As AI dramatically shortens the time from vulnerability disclosure to exploitation, enterprises must look beyond patching to reduce application risk. The leading global conference series for Operations, Control Systems and IT/OT Security professionals to connect on SCADA, DCS PLC and field controller cybersecurity. The company has notified the SEC that hackers accessed patient, employee, provider, business, and financial information.

The U.S. Department of Justice (DoJ) on Tuesday announced the takedown of a long-standing peer-to-peer (P2P) botnet known as Sality as part of a coordinated law enforcement operation. CERT@VDE says no updates are available for the affected WAGO controllers, and advises owners to disable or block FTP on port 21, enforce segmentation controls, and monitor network traffic for anomalies. The unauthenticated file upload flaw allows an anonymous user to write arbitrary .xsl or .zip formatter files to the GeoNetwork f… Two vulnerabilities in GeoNetwork can be chained to achieve unauthenticated remote code execution (RCE) on the open-source geospatial metadata catalog, which sits behind many government and agency geoportals. SonicWall said it has “investigated a case indicating the active exploitation of the vulnerabilities,” suggesting th… “There is little doubt that StreamRat is a new and technically sophisticated threat, developed by individuals with prior experience in the Android malware ecosystem,” ThreatFabric said in its StreamRat analysis .

The program is available https://www.linkinsanity.com/how-to-outsource-accounting.html to a group of Google Cloud customers, government agencies, and cybersecurity partners.

Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Roughly 2K records were exposed in the past seven days. Ransomware and extortion crews account for 289 of this week’s claims.

Russian Man Extradited Over Malware Campaign Targeting Freelancers

A total of 22 patches were releaased, a majority for code execution, privilege escalation, and information disclosure vulnerabilities. The defendants unsuccessfully attempted to physically install malware on ATMs to force them to dispense cash. Silent patches can become exploit intelligence for attackers while leaving defenders without the context needed to prioritize risk. Security teams must treat autonomous agents as highly privileged identities. Social engineering protection company Doppel has promoted Alyssa Smrekar to Chief Marketing Officer. Sevii has expanded its ADR platform with AI agents designed to investigate, contain, and remediate AI-driven attacks within minutes.

Authorities Turn Sality’s P2P Network Against Itself, Cutting Off New Malware Payloads

Forescout Research – Vedere Labs said it used Anthropic’s Claude to port a working pre-authentication remote code execution (RCE) exploit from one WAGO programmable logic controller (PLC) to another, executing attacker-supplied ARM shellcode on live hardware. The indictment, filed on June 1, 2021, and unsealed the same day as his appearance, describes the platform only as “a well-known freelance employment technology company” based in the Northern District of California. The U.S. Department of Justice (DoJ) has charged a Russian national, extradited from Cyprus on August 28, with using roughly 255 fake accounts on a freelance platform to send malware-laced Excel attachments to about 80,000 of its users in 2016 and 2017.

White House Launches Pilot Program in Texas to Protect Water Infrastructure

The gap between policy and real-world IT environments creates hidden security risks – security leaders must ensure their strategy fits the environment they are in We want your time here to be the best it can be. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page.

Meta Ads Push StreamRat Android Trojan That Can Gain Near-Complete Device Control

Chrome users were caught off guard by a 4-GB Google AI model baked into Chrome, sparking privacy concerns. Alpharetta, Georgia, cops share data with thousands of Flock users, ranging from federal agencies to a fish and wildlife commission. China’s hacking campaign targeted NASA, the Federal Reserve, the US https://neuralooms.com/articles/remote-telemonitoring-in-depth-examination/ Senate, the Justice Department, and more, according to the DOJ.

Malicious Apache Modules Hijack Brazilian Government Site Traffic to Push Betting Pages

PennFab is a Pennsylvania-based steel manufacturing company specializing in structural steel fabrication for various industries, including railroad and transportation. Chip 1 Exchange — a global independent electronics distributor headquartered in Neu-Isenburg, Germany, with primary US operations in Laguna Hills, California. Illinois prosecutors shared defendants’ personal data with federal immigration agents without criminal warrants, public disclosure, or legislative oversight. From AI-generated images to restricted satellite data, the systems used to verify what’s real online are struggling to keep up.

• Virtualizor said every operator should check its servers because the company has no affected-version range or definitive list of installations that received the package.
• SonicWall said it has “investigated a case indicating the active exploitation of the vulnerabilities,” suggesting th…
• Google on Wednesday announced Gemini 3.8 Flash Cyber, which it described as its most capable cybersecurity model, and has made it available to a set of trusted defenders via a new initiative called the Fairwind Program .
• Project Watershed 250 will see water providers in Texas provided with federal and private sector cybersecurity resources amid rising nation-state threats

UK Moves to Block High-Risk Tech Suppliers From Critical Infrastructure

“The campaign has targeted users looking to download popular software and has resulted in compromises across multiple organizations and industries, primarily affecting China-based operations of multinational organizations and Chinese-speaking users,” Microsoft said . The designation applies when a model can independently find and exploit zero-day vulnerabilities across many well-defended systems. Threat actors are exploiting a newly patched critical security flaw impacting JFrog Artifactory merely days after public disclosure, according to watchTowr . Thousands of computers infected with TVRAT , one of two malware types named in the indictment, were calling back to a command-and-control (C2) domain hosted in the U.S., with approximately half of the victims located in the … Organizations must focus on adopting AI at business speed without losing control of cyber risk.

56 breaches surfaced in the last 24 hours, against a baseline of about 46.0/day. Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. The group claims to have stolen internal data. Algra Group specializes in customized input systems, front panels, and industrial labels, providing tailored solutions for various industries. Confirmed filings first — state Attorney General breach notifications and SEC Form 8-K disclosures — then leak-site claims, labelled as claims.