Healthcare and pharmaceutical distribution giant McKesson has disclosed a cybersecurity incident involving unauthorized access to third-party applications and data theft, with the ShinyHunters extortion group claiming it stole 284 million patient data records.

McKesson discloses breach after ShinyHunters claims patient data theft

Healthcare and pharmaceutical distribution giant McKesson has disclosed a cybersecurity incident involving unauthorized access to third-party applications and data theft, with the ShinyHunters extortion group claiming it stole 284 million patient data records.

bleepingcomputer.com

X is trying to shut down Nitter, which is a big deal for the future of those who don't want an X account, but want to read public posts. youtu.be/u38-b7E3bSU?...

X Has Shut Down Nitter

YouTube video by Mental Outlaw

youtu.be

CVE-2026-73208 exposes a critical flaw where OAuth2 tokens intended for other purposes can be misused for authentication. Ensure strict scope validation on the server side to prevent cross-purpose token replay.

Per-trajectory safety monitors fail against fragmented, multi-iteration attacks because they reset state at each step. Persistent, non-decaying loop state is required to detect evidence that only appears across unattended agent iterations.

LLM pipelines often ingest OOXML files that display different content in Office versus extraction tools, creating divergent ground truth. This study identifies 21 such evidence forks, with 48–76% of LLM APIs returning hidden, extraction-only facts as authoritative evidence.

Self-evolving coding agents can turn a single malicious skill into a self-propagating worm that persists even after the original is deleted. Existing defenses miss these agent-authored copies, so you need counter-prompts to stop the banner-style imitation loop.

Unauthenticated arbitrary file deletion in WooCommerce File Approval <= 10.7 is a critical gap. Patch immediately to prevent attackers from wiping critical files without credentials.

Auth bypass in Zscaler Client Connector (CVSS 9.1) breaks endpoint trust boundaries. Patch immediately; unpatched agents allow lateral movement without credential theft.

CVE-2026-32558 is a critical 9.8 vulnerability in the Affiliate Program for WooCommerce & WordPress affecting versions up to 8.9.1. Patch immediately to prevent potential account takeover or data exposure.

Prefix-cache side channels can expose hidden dependencies in LLM API reseller ecosystems. Attackers can fingerprint shared infrastructure and infer upstream provider usage without direct access.

Numerous vulns on Incus potentially allowing container escape. 7.1.0 and 7.2.0 seem to be most affected.

Incus versions prior to 7.2.0 expose a critical vulnerability where crafted images can bypass isolation. Patch immediately to prevent full host compromise via container escape.

Looks like today is #Wordpress turn to descend into patch hell. 10 fresh CVEs on WordPress plugins. Patch now!

Unauthenticated PHP object injection in Kalles Addons (<= 1.0.6) is a critical exposure. If you run this plugin, assume the server is compromised until you patch or remove it.

Unauthenticated PHP Object Injection in Flexible Subscriptions <= 1.8.1 yields remote code execution. Patch immediately if you run WooCommerce.

TrueBooker <= 1.2.6 exposes an unauthenticated privilege escalation flaw rated 9.8. Patch immediately to prevent total account compromise.

JetEngine <= 3.8.14 ships with an unauthenticated RCE (CVSS 9.8). If you run WordPress with this plugin, patch immediately; it is trivially exploitable from the internet.

youtu.be/3zhveTN1VzE?... Interesting new attack vector: Ghostjacking: Hiding instructions inside logs and error messages that the model trusts as authoritative. Basically just an indirect injection, but a pretty nefarious one.

What should security leaders do with AI? They don’t know.

YouTube video by IBM Technology

youtu.be

Bad morning for anyone running #arcadedb

ArcadeDB before 26.8.1 exposes a critical unauthenticated RCE via the Redis wire-protocol plugin. If you expose this interface, patch immediately or isolate the service.

ArcadeDB below 26.8.1 exposes a critical flaw where the MongoDB wire-protocol plugin skips SASL checks on data commands. If you are running this, unauthenticated attackers can likely read or write your data immediately. Patch now.

ArcadeDB 26.7.3 and earlier fail to propagate authenticated principals, exposing a critical privilege escalation path. Patch immediately to prevent unauthorized server access.

ArcadeDB 9.9 critical: unbound gRPC transaction threads allow privilege escalation. Patch to 26.8.1 immediately.

Have you ever wanted that backdoor factory of a router in your office to report on your presence? Well, Comcast has some news for you!

TechCrunch@techcrunch.com · 2w ago

Comcast adds motion sensing to millions of its newer routers, with a privacy catch

CVE-2026-47686: vm2 sandbox escape via unsanitized SuppressedError. Node.js devs, your "secure" isolation is just a suggestion. Patch to 3.11.6 immediately.