Author: Staff Writer

Top Highlights Despite a 7% decline from April, weekly cyberattacks increased slightly year-over-year to 2,055, with education and government sectors remaining heavily targeted. Ransomware saw a 48% rise in May 2026, with 698 global attacks—the highest in 2026—dominated by 61 active groups, notably Qilin, The Gentlemen, and DragonForce. Sectors like agriculture, hospitality, travel, and construction experienced significant attack increases (+23% to +51%) due to digitalization and automated tooling, transforming previously low-threat industries. Ransomware activity remains highly fragmented but increasingly consolidated, with top groups accounting for 71% of attacks in early 2026; enterprises face heightened risks from GenAI prompts vulnerable to…

Summary Points ShinyHunters exploited a zero-day vulnerability (CVE-2026-35273) in Oracle PeopleSoft, primarily targeting universities to steal sensitive data. The vulnerability allows remote code execution without user interaction, exposing servers with vulnerable PeopleSoft versions to potential takeover. Attackers left evidence—staging servers, scripts, and command-and-control data—leading cybersecurity firms to identify and warn impacted organizations. Immediate mitigation includes disabling or blocking access to vulnerable endpoints, applying available patches, and monitoring for signs of compromise. Hackers Exploit Oracle Vulnerability to Target Universities Recently, a cybercrime group known as ShinyHunters exploited a serious security flaw in Oracle’s PeopleSoft software. This flaw, identified as CVE-2026-35273, is…

Top Highlights Effective AI governance depends on precise data classification, especially at the column level, to balance access and security without impeding legitimate use. Automated discovery and enforcement, enabled by integration between Cyera and Snowflake, streamline rapid remediation of risky data access in AI deployments. AI Guardian provides essential visibility into AI agents and data access, addressing the agent inventory problem and aligning security with evolving AI environments. The timing of this integration is critical as enterprise AI adoption accelerates, requiring joint security and data leadership to meet regulatory, compliance, and operational demands. The Growing Importance of Data Governance in…

Fast Facts Enhanced cooperation aims to improve detection and response to cyber threats between India and the USA. Information sharing under the MoU may lead to faster identification of cybercriminal activities and digital forensic investigations. Strengthening cyber intelligence collaboration could impede malicious cyber campaigns targeting either nation’s critical infrastructure. Threats, Attack Techniques, and Targets The signing of the MoU indicates increased cooperation between India and the USA on cyber threat intelligence. This partnership aims to better understand cyber threats and attack methods. Common attack techniques include phishing, malware, and social engineering. Targets are mostly government systems, financial institutions, and critical…

Top Highlights Phishing emails have become highly sophisticated, often mimicking legitimate communication, making detection challenging and increasing ransomware risk. Modern email security must focus on intent and context, not just technical signs, to effectively identify stealthy phishing attempts. Combining advanced phishing prevention with robust BCDR strategies is essential for comprehensive cyber resilience, reducing attack impact and ensuring quick recovery. Staying ahead of evolving threats requires understanding attack patterns and implementing layered defenses, including targeted awareness and rapid response plans. From Phishing to Ransomware: Understanding the Attack Chain Phishing emails have become more sophisticated, making it hard for individuals and traditional…

Summary Points GoFlateLoader, a simple yet effective malware loader in Go, uses oversized PE files with massive overlays to bypass size-limited security scans, impacting over 33,000 users globally. It primarily spreads via fake cracked software downloads and malicious redirects, delivering in-memory payloads of well-known info-stealers like Lumma, Vidar, and Remus without writing to disk. Notably lacking typical anti-debugging or sandbox evasion, it relies on a deceptive file size and in-memory decoding to evade detection, with its large PE overlay being a key identifying feature. To mitigate risk, users should avoid untrusted sources, keep security tools updated, and focus on detection…

Fast Facts Threat actors quickly exploited Ivanti Sentry’s critical vulnerability (CVE-2026-10520) within 24 hours of its public disclosure, using a publicly available proof-of-concept (PoC) exploit. The vulnerability, with a CVSS score of 10, allows unauthenticated attackers to remotely execute code with root privileges, leading to potential control over the device. Exploitation activity surged immediately after the PoC was released, with attackers targeting vulnerable systems and some backdoored, as observed by security organizations like Shadowserver and Defused. Ivanti Sentry’s critical role in enterprise security makes its compromise highly dangerous, risking data breaches, credential theft, lateral movement, and disruption of mobile device…

Summary Points OceanLotus (APT32) targeted Vietnam’s stock investors via a supply chain attack by hijacking the FireAnt MetaKit software to deploy its backdoor, SPECTRALVIPER, focusing on individuals involved in domestic financial investigations. The attack, active from October 2025 to March 2026, exploited unverified, unsigned software updates, delivering malicious payloads through DLL side-loading and leveraging phishing-like tactics for precise targeting. The backdoor, SPECTRALVIPER, communicates over HTTPS, supports lateral movement, and injects additional binaries, indicating a highly sophisticated operation aligned with Vietnamese government interests and domestic surveillance efforts. The campaign highlights the importance of verifying updates’ integrity, especially when lacking HTTPS, as…

Top Highlights CISA added a critical vulnerability (CVE-2026-50751) in Check Point Security Gateway to its KEV list, warning it is actively exploited in ransomware attacks worldwide. The flaw allows unauthenticated attackers to bypass login and establish unauthorized VPN connections via deprecated IKEv1, enabling lateral movement and data exfiltration. Exploitation gives attackers quick network access, potentially leading to ransomware deployment and compromise of high-value targets without triggering typical alerts. Organizations must immediately apply available hotfixes, disable IKEv1 if unnecessary, and audit logs, as the vulnerability poses a severe, actively exploited security risk. Problem Explained CISA recently added a critical vulnerability, CVE-2026-50751,…

Quick Takeaways New AI models like Anthropic’s Claude Mythos Preview drastically reduce the time to develop working exploits from weeks to hours, accelerating the exploitation of N-day vulnerabilities. The model successfully generated proof-of-concept exploits for multiple vulnerabilities within minutes to hours, even for complex Windows kernel flaws, surpassing traditional timelines. This rapid exploit creation broadens the risk window during the patch gap, especially impacting slow-updating environments like industrial, healthcare, and IoT systems. AI-driven exploit capabilities threaten to render the concept of “N-day” vulnerabilities obsolete, demanding faster patching, advanced defenses, and a reassessment of cybersecurity strategies. Key Challenge A recent study…