Author: Gary Behan

The Los Angeles County Museum of Art (LACMA) has confirmed that a LACMA data breach exposed Social Security numbers, medical information, and partial financial data belonging to customers and employees, following an intrusion that took place in July 2025. The museum says it detected suspicious activity on 11 July 2025, with the initial access having begun four days earlier.According to ClassActionU, an unauthorised third party had access to LACMA’s network from 7 July to 11 July 2025. The investigation into which files were affected concluded in August 2025, but a separate data review to determine specifically whose information was involved…

A Norway DDoS attack on Digdir, the Norwegian Digitalisation Agency, began at 03.38 CEST on Monday and proceeded in waves for more than 30 hours, knocking out or degrading a dozen government digital services and causing knock-on disruption across the wider public-sector ecosystem. It is the third such attack to hit Digdir’s infrastructure in recent months, following one in June and another on 3 August. Digdir, formally Digitaliseringsdirektoratet, operates the shared digital backbone of the Norwegian state: public-service logins, electronic IDs and signatures, secure digital mail, government forms, public-record access, and data exchange between agencies. When something hits that infrastructure,…

Hundreds of servers running Zimbra Collaboration Suite have already been compromised through Zimbra CVE-2026-73570 attacks, with threat intelligence watchdog Shadowserver reporting 274 breached instances in scans conducted on 22 August 2026. The flaw in question carries a IONIX-assessed CVSS score of 8.9, placing it firmly in the high-severity bracket.The vulnerability sits in the SNMP monitoring component of Zimbra Collaboration Suite (ZCS). When SNMP notifications are enabled, an unauthenticated attacker can exploit a command injection weakness to achieve remote code execution, without needing any credentials. Synacor patched the flaw, tracked as CVE-2026-73570, with the release of ZCS version 10.1.20 on 20…

A flaw tracked as CVE-2026-75501 in the Calix GigaSpire UPnP vulnerability disclosure has left an unpatched hole in a premium residential gateway used by customers of several major US broadband providers, allowing anyone on the public internet to silently punch through its firewall without a password. No fix exists, and the device ships with the risky configuration switched on by default. What the Calix GigaSpire UPnP vulnerability actually does The affected hardware is the GS5239XG (also marketed as the GigaSpire 7u10txg), a Wi-Fi 7 gateway with an integrated XGS-PON fibre terminal. The device runs EXOS/6.6.47 firmware and, according to TechTimes,…

The ShinyHunters ReliaQuest phishing attack has now been confirmed by the company itself, with ReliaQuest acknowledging that one of its employees fell for a voice phishing (vishing) and fake SSO page combination, while insisting that no applications, systems, or customer data were ever reached. The whole episode has the peculiar quality of a cybersecurity firm being caught out by a campaign it had itself been publicly tracking. How the ShinyHunters ReliaQuest phishing attack unfolded According to ReliaQuest, an attacker called multiple employees and attempted to trick them into visiting a fake ReliaQuest single sign-on (SSO) page hosted behind a content…

US government agencies have until 24 August to apply the fix for Zimbra CVE-2026-73570, a remote code execution flaw that CISA added to its Known Exploited Vulnerabilities catalogue on Friday after confirming active exploitation in the wild. The race to patch is already being lost on parts of the internet: eSecurityPlanet reports that Shadowserver found at least 8,200 unpatched Zimbra servers still reachable online.The vulnerability sits in the SNMP monitoring component of Zimbra Collaboration Suite (ZCS). When SNMP notifications are enabled, improper sanitisation of untrusted input means an unauthenticated attacker can send specially crafted SMTP requests that execute arbitrary operating…

The ToxicPanda Android malware has been updated with a capability to request VPN service permissions, allowing it to intercept and block network traffic from Google Play and Google Play Services before installing its payload. The upgrade is part of a broader expansion that brings the malware’s target list to 349 banking, financial, cryptocurrency, and e-wallet applications across 16 countries, and its command set to 167 remote instructions.The VPN permission request is not cosmetic. Once granted, ToxicPanda 2.0 creates a local network interface through which it controls traffic passing in and out of the device. By cutting off communication with Google…

A supply-chain attack is using a legitimate update application in Android car head units to deploy Android car head unit malware that conscripts vehicles into a proxy botnet or puts them to work committing advertising fraud. Kaspersky researchers attributed the operation to a threat actor called MoYu, previously associated with the BadBox malware botnet, and say this is the first documented infection chain built specifically for this type of automotive hardware.How the Android car head unit malware infection chain worksMoYu’s operation targets systems from DoFun, a Chinese automotive software, cloud services and hardware provider owned by Shenzhen Driving Control Technology…

SynkLoader Microsoft Teams phishing attacks are distributing a previously unknown malware family that combines a convincing fake Windows lock screen with a full remote-access toolkit, according to analysis by Expel’s security researcher Marcus Hutchins. The malware was first compiled and distributed around 28 July 2026, and its architecture is unlike most commodity loaders: it blends Python, PowerShell, C#, and C++, sometimes three languages within a single module.The campaign opens with an attacker impersonating the target company’s IT help desk over Microsoft Teams, a tactic Microsoft flagged earlier this year as increasingly common in multi-stage attacks. Victims are directed to download…

Truffle Security has found more than 9,300 leaked AWS keys linked to corporate accounts that remain active and valid, the result of four years tracking credentials publicly exposed between August 2022 and August 2026. The scale of what is still live in the wild is, to put it plainly, a problem.Of the 431,875 AWS secrets the company uncovered across code repositories, Git history, datasets, Docker images, registries, and CI logs, researchers extracted 64,024 unique AWS keys corresponding to 50,654 AWS accounts after removing duplicates. The subset for which complete credentials were available for re-verification came to 10,616 keys. As of…