News

A researcher-recovered toolkit shows how one operator compromised over 14,500 Dahua cameras in five weeks using credential attacks, a decade-old auth bypass, and abuse of the vendor’s own cloud relay.

A record 93 active ransomware groups sounds alarming, but Q2 2026 data suggests ransomware market fragmentation is a sign of pressure, not strength.

Two chained Microsoft SharePoint flaws, patched in July and August, let an attacker take over an on-premises server without any credentials at all.

Attackers weaponised a VMware vCenter flaw within five days of disclosure. That speed should change how businesses think about critical patching.

N-able’s patch for its N-central platform didn’t fully close the door attackers used. Here is the step-by-step check for anyone running it, beyond just installing the update.

Veeam, HashiCorp’s Terraform MCP Server and Django all patched critical flaws within 48 hours, including a CVSS 10.0 bug. Here’s what happened and what to check.

A critical TeamCity flaw is being actively exploited. Here is a practical, step-by-step checklist for UK businesses to confirm exposure, patch and check for compromise.

A WordPress XSS vulnerability patched in version 7.0.3 needed no login to start. Here’s a plain-English explainer and five checks for your own sites.

A step-by-step look at how the Atomic macOS Stealer infects Mac users through fake fix-it websites, and a practical checklist for businesses to reduce the risk.

Cl0p-linked attackers are exploiting an unauthenticated flaw in PTC Windchill and FlexPLM. Here’s a practical checklist for finding out if you’re exposed.