Researchers show that file-change notification systems can leak keystroke timing, browsing activity, and WhatsApp media events.

The post Windows, Linux, Android File Notification Systems Leak User Activity appeared first on SecurityWeek.

Tracked as CVE-2026-48842, the exploited bug is an SQL injection that can be exploited without authentication.

The post Roundcube Webmail Vulnerability in Attackers’ Crosshairs appeared first on SecurityWeek.

The attackers used a compromised BigCommerce application key held by Ribon to access customer data.

The post BigCommerce Data Stolen via Ribon Apps Hack appeared first on SecurityWeek.

The data security company received the new investment from Goldman Sachs Alternatives, extending its Series G funding round.

The post Cyera Raises $400 Million at $12+ Billion Valuation appeared first on SecurityWeek.

Forescout’s new network segmentation research shows that OT and medical devices often share network segments with other enterprise assets.

The post Only 13% of OT Network Segments Are Fully Isolated: Analysis appeared first on SecurityWeek.

Posing as the legitimate sorted-btree package, indexed-btree hides a malware trigger in its prototype method.

The post Malicious B-tree NPM Package Accumulates Millions of Downloads appeared first on SecurityWeek.

It’s unclear if the attacks are part of previous campaigns against Rust, but the techniques used by the attackers match those used by North Korea.

The post Rust Team Members and Popular Crate Owners Targeted via Video Calls appeared first on SecurityWeek.

The cybersecurity firm believes the data breach was the result of the May 2026 TanStack supply chain attack.

The post CrowdSec Confirms Source Code Stolen in Supply Chain Attack appeared first on SecurityWeek.

Microsoft fixed vulnerabilities across Azure and AI-branded products, with privilege escalation flaws accounting for the majority.

The post Microsoft Patches 18 Vulnerabilities in AI, Cloud Products appeared first on SecurityWeek.

Hackers used a compromised API key to deploy a Cloudflare worker that injected malicious scripts.

The post Brevo Supply Chain Attack Injects Malware Into 100,000 Websites appeared first on SecurityWeek.

The company will use the funding to accelerate platform development and expand its presence in key enterprise markets.

The post MIND Secures $72 Million for AI-Powered DLP appeared first on SecurityWeek.

Check Point Security Management and Log Servers are affected by a critical vulnerability that can allow remote code execution with root privileges.

The post Check Point, Kaspersky, Tanium Patch Product Vulnerabilities appeared first on SecurityWeek.

Join SecurityWeek today for a virtual summit exploring the strategies and tools organizations need to discover, prioritize, and defend their expanding attack surfaces.

The post Virtual Event Today: Attack Surface Management Summit appeared first on SecurityWeek.

The cybersecurity startup is building a proprietary foundation model and plans to accelerate global expansion.

The post Exein Secures $270M at $1.7B Valuation for Physical AI Security appeared first on SecurityWeek.

An unauthenticated attacker can exploit CVE-2026-76461 to execute arbitrary commands on the underlying OS with root privileges.

The post Root RCE Zero-Day in Cisco Secure Email Gateway Under Active Exploitation appeared first on SecurityWeek.

Hackers compromised the Brevo marketing platform and used that access to send phishing emails to users of Trezor, BitBox, and CoinTracking.

The post Trezor Says 347,000 Users Received Phishing Emails After Brevo Hack appeared first on SecurityWeek.

Financials have not been disclosed, but the estimated cost is in the tens of millions of dollars.

The post Kiteworks Acquires Bonfy.AI to Fill the AI Gap in Data Governance appeared first on SecurityWeek.

Join the webinar for a focused, 20-minute discussion on Frontier Pace Governance, an approach to balancing automation, policy, and business risk as IT operations accelerate.

The post Webinar Today: Keep Pace With AI – A New Operating Model for Endpoint Remediation appeared first on SecurityWeek.

The exploit provides full System privileges on Windows machines running the September 2026 patches.

The post New ‘ShieldCrash’ Zero-Day Exploit Targets Microsoft Defender appeared first on SecurityWeek.

The critical, unauthenticated bugs allow attackers to bypass authentication and proxy a user’s browser traffic.

The post Fortinet Patches Critical Vulnerabilities in FortiMonitorOnSight, Chrome Extension appeared first on SecurityWeek.