Hackers claim medical data breach affecting nearly 19 million people in Poland

Polish healthcare platform MyDr has confirmed (translation here) a cyberattack after hackers claimed to have stolen data belonging to 18.8 million people, roughly half of Poland's population. The attackers claim to possess more than 2.5 terabytes of data, while MyDr said the affected information likely dates from 2024 and earlier and that it is still conducting a forensic investigation to determine the scope of the breach.

itnerd.blog

What the latest Lazarus attack says about the limits of EDR

Two experts get into why Lazarus exploiting a Windows zero-day is particularly concerning despite the vulnerability's "Important" CVSS rating. And how kernel-level rootkits like FudModule can undermine the security tools defenders rely on, and what organizations can do when patching or traditional mitigations aren't immediately possible. John Strand, Owner, Black Hills Information Security ( "This story highlights an important shift in how organizations need to think about defense.

itnerd.blog

New FIRE Analysis of ExfilSquad’s D365 Data Extortion Campaign 

Fortra Intelligence and Research Experts (FIRE) just released research examining ExfilSquad, a new data extortion group believed to be exploiting misconfigured Microsoft Power Pages to access Dynamics 365 data. FIRE have obtained ExfilSquad data samples, and our analysis supports ExfilSquad's claim that they have access to sensitive data from 15 different organizations. This report is intended to help security teams understand the likely attack path, indicators of exposure, the types of data at risk, and immediate steps to identify and secure vulnerable Power Pages environments before sensitive CRM and ERP data is exposed. Report can be accessed here:

itnerd.blog

How Does the White House Privatizing US Cybersecurity Help It Defend Against AI-Driven Attacks?

The White House has a new memo on involving private cybersecurity companies in US defense against AI-driven hacks, vishing, and other attacks: Transnational Criminal Organizations (TCOs) pose a growing threat to American citizens, businesses, and national security. These organizations conduct sustained cyber campaigns to perpetrate frauds that undermine American prosperity, security, and freedom. Through Executive Order 14390 of March 6, 2026 (Combating Cybercrime, Fraud, and Predatory Schemes Against American Citizens), I directed the Federal Government to take various actions to combat cyber‑enabled crime harming American citizens.

itnerd.blog

Databricks Grows >80% YoY, Surpasses $7B Revenue Run-Rate, Scales Lakebase, Genie, and Unity AI Gateway

Databricks today announced it crossed a $7 billion revenue run-rate, delivering >80% year-over-year growth during its Q2. Building on this momentum, the company closed a $5 billion strategic funding round at a $190 billion valuation. The investment will drive continued innovation across Lakebase, its serverless Postgres database built for AI agents, Genie, Databricks' AI coworker that turns business data into trusted answers and actions, and 

itnerd.blog

The Check Point Q2 2026 Ransomware Report Is Out

Ransomware kept its grip on organizations through the second quarter of 2026, and the headline number barely moved. What changed underneath that number is more interesting: new research gave us a rare look inside a top tier operation as it was being built, and it revealed just how little it now takes for a small and skilled group to reach the top of the field.

itnerd.blog

July 2026 Cyber Threats Surge: Ransomware Attacks Double Year over Year as GenAI Data Exposure Widens Says Check Point

July's cyber threat landscape was shaped by pressure across multiple fronts. Global cyber attacks continued to rise, ransomware activity broke from the more stable pattern seen earlier in the year, and GenAI exposure became a clearer operational risk as employees used more tools and generated more prompts across the enterprise. Cyber Attacks Keep Climbing The global attack curve continued upward in July.

itnerd.blog

SOCRadar Goes Inside the LiteLLM Supply Chain Attack That Exposed 2,500+ Companies 

Today, the SOCRadar research team published a new research report on the LiteLLM supply chain attack that exposed 2,500 companies. It includes full attack chain, TeamPCP profile, IOC table, five detection checks, rotation guidance andFAQ. What's different from general coverage: They worked from the ranked company list. SOCRadar analyzed the 2,188 organization records at row level and the timeline changes.

itnerd.blog

BreachLock Named Sample Vendor for Red Teaming as a Service and Penetration Testing as a Service in the Gartner® Hype Cycle™ for Security Operations, 2026

BreachLock announced that it has been identified as a Sample Vendor in the Gartner Hype Cycle for Security Operations, 2026 in both the Red Teaming as a Service and Penetration Testing as a Service categories. Security teams are navigating an increasingly complex threat landscape shaped by AI-driven innovation, evolving attack surfaces, and the growing need for continuous validation. The industry is shifting from reactive approaches toward proactive, threat-led validation practices that help organizations understand which exposures present meaningful risk.

itnerd.blog

The North Korea Hiring Problem

North Korean IT workers infiltrating US companies and government agencies points at a threat model most security teams still aren't built for: the attacker doesn't break in, they get hired. Once someone clears interviews and onboarding, they inherit the same trust as any other employee, and almost nobody re-verifies that trust after week one. The State Department put out (yet another) warning about this here: …

itnerd.blog

Cybernews comments on fake Wi-Fi network on Delta flight 

Following a report of a fake Wi-Fi network on a Delta flight to Atlanta, Cybernews' Senior Information Security Researcher Aras Nazarovas has commented on the risks such networks may pose, as well as what the people affected should know.  What risks do fake Wi-Fi networks pose? What is an evil twin attack? "An evil twin attack is when hackers create fake Wi-Fi networks with the goal of stealing sensitive information from people, or exploiting known vulnerabilities present on victim devices.

itnerd.blog

$300M Senate bill to target cyber threats to U.S. water systems

Senators Adam Schiff and Amy Klobuchar introduced the Water Cyber Shield Act, which would give the EPA explicit authority to conduct cybersecurity assessments, require corrective actions and establish security standards for water systems alongside CISA and NIST. The bill would also authorize $300 million annually for water infrastructure upgrades, require risk assessments for large systems and expand mandatory cyber incident reporting.

itnerd.blog

Rogue Wi-Fi network discovered aboard Delta flight

Delta is investigating an alleged passenger created, rogue Wi-Fi network aboard Flight 591 from Las Vegas to Atlanta on August 10, one day after the DEF CON cybersecurity conference concluded in Las Vegas. The unauthorized network, named "Delta WiFi Fast," impersonated the airline's legitimate Wi-Fi and was reportedly intended to scam other passengers. The crew disabled the aircraft's Wi-Fi for approximately 30 minutes after discovering the network.

itnerd.blog

Which CMS platforms provide the strongest out-of-the-box security? 

Content Management Systems (CMSs) power millions of websites worldwide, making them one of the most common ways to publish content online. Because many CMS users have limited cybersecurity expertise, the security protections enabled by default can play an important role in reducing risk. In a study published today, Comparitech researchers took a look at four of the most popular open-source CMSs (WordPress, Drupal, Joomla, and Ghost), to determine which has the strongest out-of-the-box security.

itnerd.blog

Wagepoint expands AI-powered vision with AI Payroll Summar

While a third of Canadian small businesses reported using AI in their operations by the end of 2025, many business owners and their accountants are still spending hours reviewing their payroll runs, trying to spot a mistake. Canadian business optimism may have grown in the last month, but the onset of new tariff threats puts time and money pressure back on the table.

itnerd.blog

New SharePoint auth bypass already being exploited hours after PoC went public

Rapid7 published a proof-of-concept exploit today for CVE-2026-55040, an authentication bypass in SharePoint's JWT token validation that lets an attacker impersonate any user or admin without credentials. Threat intel firm Defused reported the exploit code was already hitting its honeypots the same day; it's the second distinct on-prem SharePoint flaw to make news this week, after Monday's ransomware-exploited deserialization bug.

itnerd.blog

Half of UK tech leaders say outages threaten revenue

Research published by Zen Internet found that half of UK technology leaders believe network outages threaten revenue. The study surveyed 500 senior technology decision-makers across the UK. The findings point to wider concern about the role of network resilience in business performance. More than half of respondents, 51%, said resilience was business-critical and that outages would significantly affect revenue, operations or customers.

itnerd.blog

Palo Alto Puts OpenAI Cyber Models to Work for Defenders

Today, Palo Alto Networks announced it will give defenders access to OpenAI's leading cybersecurity-focused model, GPT-5.6 Daybreak, to help businesses find, test, and validate attack paths at machine speed. Until now, GPT-5.6 Daybreak has not been available for commercial use. Frontier AI in cybersecurity has largely been seen as a threat defenders were racing against. Now, Palo Alto Networks' Unit 42…

itnerd.blog

Canadian Hospital Pwned In Ransomware Attack

There has been a ransomware attack at a Manitoba hospital. CBC News has the details: Shared Health said in a statement Monday it's responding to what it called "a ransomware incident affecting certain facility maintenance systems." Patient care and clinical operations are not affected, the health authority said, urging anyone who needs to attend the hospital to do so. Clinical services continue uninterrupted, and based on the investigation conducted to date, there is no indication that patients have been affected," the statement, provided to CBC News by spokesperson Tara Seel, says.

itnerd.blog

LG Launches Life’s Good 2026

LG Electronics launched its 2026 Life's Good campaign under the key message "Free up your mind." The campaign explores how LG AI can help reduce the mental load of everyday life by quietly taking care of routine demands, creating more room for people to focus on what truly matters. The campaign arrives at a time when people work harder than ever to keep everyday life running, yet increasingly struggle to switch off from its demands.

itnerd.blog

TELUS commits $2 million to support emergency wildfire relief across British Columbia

As devastating wildfires sweep across British Columbia, TELUS is responding with a $2 million commitment in network connectivity, data top-ups and bill credits for affected customers, and donations and support to charities. TELUS is directing resources toward affected First Nations and non profit organizations on the ground – including the Salvation Army BC and community food banks – while ensuring residents and first responders have access to the critical communications services they need to stay connected.

itnerd.blog

11GB Of Data Exposed Says Cybernews

Cybernews researchers discovered an unprotected Talentsconnect database with nearly 11GB of live recruitment data, referencing 843 companies, including references associated with Siemens, Deutsche Bank, Vodafone, BASF, and EY. Talentsconnect is a company that specializes in direct-to-talent (D2T) matching platforms, which connect job seekers and employers. Here are the key findings: The exposed database with over 5 million job listings included applicants' names, emails, phone numbers, salary expectations, Base64-encoded CVs, or cover letters.

itnerd.blog

Park Place Technologies Achieves Additional “Powered by Nutanix: Verified Solutions” Badge

Park Place Technologies today announced it has achieved its fourth "Powered by Nutanix: Verified Solutions" badge. The badge reflects the company's commitment to designing and delivering services aligned with Nutanix prescribed best practices and architectural standards.   Through the "Powered by Nutanix: Verified Solutions" program, Park Place Technologies' Sovereign Cloud offering has been reviewed against Nutanix-defined technical and operational criteria for alignment with platform best practices.

itnerd.blog

MCP Servers Are the New Software Supply Chain Risk

New research from ASSET Research Group shows malicious MCP servers can split data-exfiltration instructions across multiple tool calls, letting AI coding agents piece together and leak SSH keys, source code, and customer data even when a single blunt request would get refused. No CVE yet, but the technique worked against nearly every major model tested once the request was fragmented.

itnerd.blog

Guest Post: By Is the National Vulnerability Database still meeting the needs of defenders, or has the volume and complexity of modern vulnerabilities outgrown the current model?

By Tyler Reguly, Associate Director of Security R&D at Fortra Is the National Vulnerability Database still meeting the needs of defenders, or has the volume and complexity of modern vulnerabilities outgrown the current model? A more interesting question might be "has the National Vulnerability Database ever actually met the needs of defenders?" The only valuable information provided by NVD in the past has been CVSS information, and I'll leave it up to the individual to decide if CVSS has ever been "valuable." The other information provided by NVD was CPE data, and it has long been known that if you were using NVD CPE data for vulnerability detection, you were not getting accurate or reliable vulnerability detection.

itnerd.blog

Hackers breach Polish power plant through private cellular network

Poland's CERT has disclosed a cyberattack that shut down a steam turbine and process-water treatment system at a combined heat and powerplant supplying roughly 50,000 residents. The December 2025 attack caused a short-lived operational disruption, but customers did not lose heat or electricity. Investigators found the attackers initially compromised a FortiGate VPN/firewall at a separate wind farm, then used a cellular router to enter a private APN connecting remote infrastructure.

itnerd.blog

3X Surge in AI Agent Deployments Since 2025 Says Salesforce

Salesforce has released its 2026 Agentic Enterprise Index, which analyzes global AI usage data to uncover how businesses are deploying, using, and getting value out of AI agents. The index shows enterprise adoption is scaling up, with the average number of AI agents activated per enterprise nearly tripling year-over-year. Based on data from 734 million completed AI tasks, businesses are shifting from basic AI chatbots to complex, multi-step automated workflows that deliver tangible ROI.

itnerd.blog

Gunra ransomware group bypassing MFA and exfiltrating enterprise data via Fortinet flaws

The FBI, CISA, and South Korea's National Police Agency issued a joint advisory Monday on Gunra ransomware, also known as Golden Community. The RaaS operation exploits two Fortinet firewall vulnerabilities, CVE-2024-55591 and CVE-2025-24472, for initial access, then runs double extortion against healthcare, financial services, and government targets worldwide. Roman Sannikov, Global Research Coordinator, iCOUNTER "Gunra's exfiltration playbook is what should worry Microsoft 365 shops specifically.

itnerd.blog

TD becomes the first bank in Canada to digitize direct deposit switching

TD has launched a new mobile-first experience that helps clients securely set up or switch payroll direct deposit within the TD app. With most employers, the process can be completed in about a minute, reducing paperwork and helping clients manage an everyday banking task more simply and conveniently. The launch reflects TD's continued focus on simplifying everyday banking by digitizing routine tasks, while delivering that convenience within the trusted, full-service banking relationship clients expect.

itnerd.blog

LexisNexis pulls data services offline after unusual activity on a third-party vendor’s servers

LexisNexis has taken three Nexis products, Diligence, Metabase API, and Newsdesk, offline after detecting unusual activity on a third-party vendor's servers. No data exposure has been confirmed, and the company says it isn't connected to last week's separate Metabase Cloud SQL injection zero-day that hit Framework and Tally. More details here: LexisNexis shuts down services after suspicious activity on servers…

itnerd.blog