Security incidents
Breach and zero-day write-ups, each mapped to the certifications that cover the skills involved.
This archive includes generated reports awaiting editorial review. Severity is shown only after the source, event classification and impact have been checked.
309 incidents
Bullhorn Staffing Platform Cyberattack Incident
Bullhorn, a staffing software company, took its platform offline to contain a cyberattack that caused a system-wide outage. The company is working to restore services after a thorough security review with CrowdStrike specialists. It's unclear if customer data was exfiltrated.
Severity: Awaiting reviewIncident type: Infrastructure outageIncident date: Reading time: 5 min readRelated certifications: CISSPCCSPOSCPCandiru Spyware Delivered via Targeted Ads
Researchers at Citizen Lab discovered a zero-click attack that delivered Candiru spyware to devices via targeted online advertisements. The attack, called AdFection, was linked to Israeli firm Discovere-Tech and affected at least 45 devices between 2024 and 2025.
Severity: Awaiting reviewIncident type: Zero day, Security featureIncident date: Reading time: 6 min readRelated certifications: CEHCISSPOSCPand 1 moreeMudhra CA Certificate Compromise
Mozilla, Google, and Apple blocked compromised eMudhra CA certificates due to weak private keys that could be recovered and used to forge trusted certificates for legitimate websites.
Severity: Awaiting reviewIncident type: Supply chainIncident date: Reading time: 5 min readRelated certifications: CISSPCCSPCSSLPPlex2Shell Vulnerability Exploit
Attackers are exploiting four vulnerabilities in Plex Media Server, known as Plex2Shell, to breach servers and execute code with elevated privileges. The vulnerabilities were discovered by security researcher Zach Main and rated medium to high in severity. CISA has directed federal agencies to prioritize patching systems affected by Plex2Shell vulnerabilities.
Severity: Awaiting reviewIncident type: Zero dayIncident date: Reading time: 5 min readRelated certifications: CISSPCCSPCISAInternational CSAM Crackdown Operation
Law enforcement authorities from 17 countries in Latin America and Europe arrested 95 suspects in an INTERPOL-coordinated operation targeting the distribution of child sexual abuse material (CSAM) through online messaging groups.
Severity: Awaiting reviewIncident type: Security newsIncident date: Reading time: 7 min readRelated certifications: CEHCISSPOSCPand 1 moreArch Linux AUR Malware Incident
A threat actor uploaded malicious packages to the Arch User Repository (AUR) that impersonated two popular helper tools, yay and paru, and delivered malware with root privileges.
Severity: Awaiting reviewIncident type: Supply chainIncident date: Reading time: 9 min readRelated certifications: CEHCISSP-ACISSPand 5 moreCritical Magento BlockStrap Flaw
A critical vulnerability (CVE-2026-103849) in Magento and Adobe Commerce allows hackers to execute arbitrary PHP code on store servers. The flaw, dubbed BlockStrap, impacts September versions of Adobe Commerce and Magento Open Source through 2.4.9 and Adobe Commerce B2B through 1.5.3.
Severity: Awaiting reviewIncident type: Zero dayIncident date: Reading time: 8 min readRelated certifications: CISSPOSCPCISMand 9 moreCriminal IP Introduces AITEM for Attack Surface Management
Criminal IP introduces AITEM (AI-Powered Threat Exposure Management) as the next evolution of Attack Surface Management, expanding visibility beyond external asset inventory and connecting exposure discovery with investigation, threat context, prioritization, and response.
Severity: Awaiting reviewIncident type: Security featureIncident date: Reading time: 8 min readRelated certifications: CISSPCCSPCAPand 14 moreGoogle Ads Abuse for Claude ClickFix Attacks
Hackers are abusing legitimate Bing search-result redirects in Google search ads to direct users to fake Claude installers that deliver ClickFix attacks.
Severity: Awaiting reviewIncident type: Security featureIncident date: Reading time: 7 min readRelated certifications: CEHCISSPCCand 2 moreASOS Data Breach Incident
ASOS, a UK-based online fashion retailer, suffered a data breach due to a social engineering attack, where hackers stole an employee's login credentials and accessed customer information on third-party platforms.
Severity: Awaiting reviewIncident type: Data breachIncident date: Reading time: 7 min readRelated certifications: CEHCISSPOSCPand 1 moreSouth Korea Bank Breaches
South Korea's Financial Services Commission (FSC) is investigating a series of cyberattacks targeting financial institutions, including Shinhan Bank and Kookmin Bank, which affected over 144,000 customers. The breaches are suspected to be AI-powered attacks.
Severity: Awaiting reviewIncident type: Data breachIncident date: Reading time: 5 min readRelated certifications: CEHCISSPOSCPand 5 moreMetaMask Infrastructure Security Incident
MetaMask disclosed an ongoing infrastructure security incident affecting some of its infrastructure, with no immediate threat to MetaMask wallets. The company is working to address the issue internally, with help from external partners and security advisors.
Severity: Awaiting reviewIncident type: Infrastructure outageIncident date: Reading time: 9 min readRelated certifications: CEHCISSPOSCPand 13 moreMikroTik RouterOS Pre-Authentication RCE Flaw
CISA warns of a critical pre-authentication remote code execution (RCE) flaw in MikroTik RouterOS that could lead to code execution with root privileges or denial of service.
Severity: Awaiting reviewIncident type: Zero dayIncident date: Reading time: 8 min readRelated certifications: CEHCISSPCCSPand 18 moreCitrix NetScaler Zero-Day Exploitation
The Cybersecurity and Infrastructure Security Agency (CISA) ordered U.S. government agencies to patch exploited Citrix NetScaler vulnerabilities. Citrix confirmed two NetScaler RCE zero-days exploited in attacks.
Severity: Awaiting reviewIncident type: Zero dayIncident date: Reading time: 8 min readRelated certifications: CISSPCCSPCAPand 6 moreSupabase Database Misconfiguration Exposures
Researchers found over 16,000 misconfigured Supabase databases exposing personally identifiable information, passwords, and authentication tokens.
Severity: Awaiting reviewIncident type: Data breachIncident date: Reading time: 8 min readRelated certifications: CEHCISSPOSCPand 12 moreRogue External MFA Provider Credential Theft
Security researchers discovered a technique called TrustSink that allows hackers with privileged access to register a rogue external MFA provider, stealing users' passwords during legitimate login attempts. The attack relies on Microsoft Entra's external authentication model and requires an attacker to control a highly privileged Entra account.
Severity: Awaiting reviewIncident type: Security featureIncident date: Reading time: 6 min readRelated certifications: CISSPCCOSCPand 1 moreRapuncel Infostealer Malware Campaign
An ongoing malware campaign uses SEO-optimized GitHub repositories to impersonate well-known software firms and push a previously undocumented information stealer called Rapuncel, which steals data from infected devices and disables antivirus software.
Severity: Awaiting reviewIncident type: Supply chain, Zero dayIncident date: Reading time: 8 min readRelated certifications: CEHCISSPCCSPand 9 moreBigCommerce Data Breach via Ribon Apps
BigCommerce has alerted multiple merchants to data breaches after attackers compromised credentials for third-party Ribon applications and used them to inject malicious scripts into online stores.
Severity: Awaiting reviewIncident type: Data breachIncident date: Reading time: 7 min readRelated certifications: CEHCISSP-ACISSPand 27 moreCenterPoint Energy Data Breach
CenterPoint Energy confirmed a data breach where an attacker stole 7.49 million customer records containing personal information. The breach occurred through CenterPoint's public API, which lacked security measures. The company is investigating and notifying affected customers.
Severity: Awaiting reviewIncident type: Data breachIncident date: Reading time: 8 min readRelated certifications: CISSP-ACISSPCCSPand 6 moreShinyHunters Hacker Detained in Jordan
A suspected ShinyHunters hacking group member, known online as 'Rey', has been detained in Jordan and is cooperating with the FBI to help locate other members of the extortion group.
Severity: Awaiting reviewIncident type: Data breachIncident date: Reading time: 5 min readRelated certifications: CEHCISSPOSCPand 2 moreGitLab Path Traversal Vulnerability Exploitation
Hackers are exploiting a maximum-severity GitLab vulnerability to read credentials, secrets, and other sensitive information from vulnerable servers. The vulnerability, tracked as CVE-2026-85706, was patched by GitLab in versions 19.3.2, 19.2.6, and 19.1.
Severity: Awaiting reviewIncident type: Zero dayIncident date: Reading time: 8 min readRelated certifications: CEHCISSPCCand 14 moreN-able N-central Remote Code Execution Vulnerability
N-able has released an emergency hotfix for a maximum-severity remote code execution (RCE) flaw affecting its N-central remote monitoring and management (RMM) platform. The vulnerability allows threat actors to execute malicious code on unpatched N-central instances exposed online.
Severity: Awaiting reviewIncident type: Zero dayIncident date: Reading time: 6 min readRelated certifications: CISSPOSCPCISMCrowdStrike Falcon Zero-Day Exploit
A zero-day exploit named 'FalconFlank' has been released, allowing attackers to escalate privileges on up-to-date Windows systems. The exploit targets CrowdStrike's endpoint security platform and affects devices running the latest versions of Windows 11 and Windows Server.
Severity: Awaiting reviewIncident type: Zero dayIncident date: Reading time: 5 min readRelated certifications: CEHCISSPCCand 2 morePasskey Authentication Compromise
At least 39 publicly documented methods, attack paths, research techniques, and exploitation scenarios involving passkeys and the infrastructure around them have been discovered, compromising passkey authentication.
Severity: Awaiting reviewIncident type: Security featureIncident date: Reading time: 8 min readRelated certifications: CEHCISSPCCand 22 more