28th July – Threat Intelligence Report - Check Point Research

For the latest discoveries in cyber research for the week of 28th July, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES The US Energy Department, including its National Nucl...

research.checkpoint.com

MOVEit Transfer Faces Increased Threats as Scanning Surges and CVE Flaws Are Targeted

Surge in scanning activity targets MOVEit Transfer systems, raising concerns over possible exploitation.

thehackernews.com

BeyondTrust warns of pre-auth RCE in Remote Support software

BeyondTrust has released security updates to fix a high-severity flaw in its Remote Support (RS) and Privileged Remote Access (PRA) solutions that can let unauthenticated attackers gain remote code ex...

bleepingcomputer.com

Asana warns MCP AI feature exposed customer data to other orgs

Work management platform Asana is warning users of its new Model Context Protocol (MCP) feature that a flaw in its implementation potentially led to data exposure from their instances to other users a...

bleepingcomputer.com

Is b For Backdoor? Pre-Auth RCE Chain In Sitecore Experience Platform

Welcome to June! We’re back—this time, we're exploring Sitecore’s Experience Platform (XP), demonstrating a pre-auth RCE chain that we reported to Sitecore in February 2025. We’ve spent a bit of time...

labs.watchtowr.com

Google’s $32 Billion Wiz Deal Draws DOJ Antitrust Scrutiny: Report

According to reports, the US Department of Justice will assess whether the deal would harm competition in the cybersecurity market.

securityweek.com

Washington Post's email system hacked, journalists' accounts compromised

Email accounts of several Washington Post journalists were compromised in a cyberattack believed to have been carried out by a foreign government.

bleepingcomputer.com

High-Severity Vulnerabilities Patched in Tenable Nessus Agent

Three high-severity Tenable Agent vulnerabilities could allow users to overwrite and delete files, or execute arbitrary code.

securityweek.com

CISA Releases Ten Industrial Control Systems Advisories | CISA

cisa.gov

GitLab patches high severity account takeover, missing auth issues

GitLab has released security updates to address multiple vulnerabilities in the company's DevSecOps platform, including ones enabling attackers to take over accounts and inject malicious jobs in futur...

bleepingcomputer.com

'Major compromise' at NHS temping arm never disclosed

Exclusive: Incident responders suggested sweeping improvements following Active Directory database heist

go.theregister.com

Ivanti Workspace Control hardcoded key flaws expose SQL credentials

Ivanti has released security updates to fix three high-severity hardcoded key vulnerabilities in the company's Workspace Control (IWC) solution.

bleepingcomputer.com

OpenAI working to fix ChatGPT outage affecting users worldwide

OpenAI is working to fix an ongoing outage impacting ChatGPT users worldwide and preventing them from accessing the chatbot on the web or via mobile and desktop apps.

bleepingcomputer.com

Update: Dumping Entra Connect Sync Credentials

Recently, Microsoft changed the way the Entra Connect Connect Sync agent authenticates to Entra ID. These changes affect attacker tradecraft, as we can no longer export the sync account credentials…

posts.specterops.io

Supply chain attack hits Gluestack NPM packages with 960K weekly downloads

A significant supply chain attack hit NPM after 15 popular Gluestack packages with over 950,000 weekly downloads were compromised to include malicious code that acts as a remote access trojan (RAT).

bleepingcomputer.com

Crims breached 100k UK tax accounts to steal £43M from HMRC

: It’s definitely not a cyberattack though! Really!

go.theregister.com

US offers $10M for tips on state hackers tied to RedLine malware

The U.S. Department of State has announced a reward of up to $10 million for any information on government-sponsored hackers with ties to the RedLine infostealer malware operation and its suspected cr...

bleepingcomputer.com

Vodafone Germany Fined $51 Million Over Privacy, Security Failures

Germany fined Vodafone $51 million for failing to protect user data from partners and unauthorized third-parties.

securityweek.com

Exclusive: Hackers Leak 86 Million AT&T Records with Decrypted SSNs

Follow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread

hackread.com

Sleeper Sound: LayerX Uncovers Malicious “Sleeper” Sound Management Extensions with Nearly 1.5 Million Users Worldwide - LayerX

LayerX has unearthed network of malicious “sleeper agent” extensions that appear to serve as infrastructure for future malicious activity, currently installed on nearly 1.5 million users worldwide.   ...

layerxsecurity.com

Vulnerability leaks Vanta customer info

TechCrunch reports that leading trust management platform Vanta had private information from less than 4% of its over 10,000 clients inadvertently exposed to other customers due to a product code chan...

scworld.com

Police takes down AVCheck site used by cybercriminals to scan malware

An international law enforcement operation has taken down AVCheck, a service used by cybercriminals to test whether their malware is detected by commercial antivirus software before deploying it in th...

bleepingcomputer.com

Threat Actor Claims TikTok Breach, Puts 428 Million Records Up for Sale

Follow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread

hackread.com

Adidas confirms data swiped from customer service provider

: Hackers take personal data bytes from the brand with three stripes

go.theregister.com

Alleged AT&T breach compromises 31M records

AT&T had a database purportedly including 31 million sensitive user records exposed on a popular hacking forum, reports Cybernews.

scworld.com

M&S warns of £300M dent in profits from cyberattack

: Downtime stings retailer, with technical recovery costs coming at a later date

go.theregister.com

SK Telecom says malware breach lasted 3 years, impacted 27 million numbers

SK Telecom says that a recently disclosed cybersecurity incident in April, first occurred all the way back in 2022, ultimately exposing the USIM data of 27 million subscribers.

bleepingcomputer.com

Coinbase Extorted, Offers $20M for Info on Its Hackers

Coinbase is going Liam Neeson on its attackers, potentially setting a new precedent for incident response in the wake of crypto- and blockchain-targeting cyberattacks.

darkreading.com

The Epoch Times purportedly hacked, 32M records exposed

International far-right media outlet The Epoch Times was reported by SafetyDetectives cybersecurity experts to have a database of 32 million records allegedly stolen from its systems leaked online, ac...

scworld.com

Broadcom data stolen in payroll provider ransomware raid

EXCLUSIVE: The tech biz was in the process of dropping the payroll company as it learned of the breach

go.theregister.com