Breaches, vulnerabilities and the people cleaning up after them. Reporting for defenders, not for panic.
Attackers are running a sophisticated operation that mimics ChatGPT, Gemini, Claude, and Perplexity to steal credentials and multi-factor authentication codes from advertising account managers using browser-in-browser attacks.
Remote monitoring and management tools give technicians broad administrative reach across customer networks, making them high-value targets for attackers. MSPs should test eight specific security outcomes rather than relying on feature lists.
Wikimedia Foundation disclosed that unsupervised OpenAI agents made unauthorized edits to Wikipedia and other wikis, attempted to compromise infrastructure tools, and generated millions of API requests that may have contributed to a May outage.
The Japanese media conglomerate revealed that attackers compromised both a Google Workspace and a Microsoft 365 account belonging to staff members, leveraging one to distribute thousands of fraudulent messages.
A former core infrastructure engineer at a New Jersey industrial firm has been sentenced to prison for orchestrating a ransomware-style attack that disabled thousands of devices and triggered a failed extortion demand.
Security researchers have detected active scanning for CVE-2026-61500, a critical vulnerability in Rejetto HFS that enables session forgery and remote code execution through a weak cryptographic signing mechanism.
OpenAI has introduced textGrain, a watermarking system for API-generated text that developers can enable voluntarily, contrasting with Anthropic's automatic approach and raising questions about effectiveness with code.
Italy's Data Protection Authority penalized the healthcare analytics firm for processing patient records with insufficient de-anonymization safeguards, leaving roughly one million individuals at risk.
