This website uses cookies
Read our Privacy policy and Terms of use for more information.
malware
+5
Oct 24, 2026
•
9 min read
Plus: Oracle patched over 1,200 vulnerabilities in one update, Meta was ordered to pay New Mexico $25 billion over privacy deception, and the AKIRA group has hit about 200 Swiss companies
Oct 17, 2026
Plus: Microsoft patched a record 1,400+ flaws this Patch Tuesday, French supermarket refrigeration systems were forced to heat up remotely, and an OpenAI employee was arrested for hiding a recording device in the executive conference room
Oct 10, 2026
7 min read
Plus: Plus: ShinyHunters is slowly being dismantled with two arrests and a possible third, Pwn2Own Ireland paid $1.26M for 98 zero-days including AI products, and FortiBleed is still active six months on
Oct 3, 2026
Plus: KillSec was dismantled and its alleged leader is 16, the Pentagon's personnel agency exposed 3 million records for nine months, and ShinyHunters is mass-exploiting Oracle PeopleSoft with URL encoding tricks
Sep 26, 2026
Plus: ShinyHunters claims it breached the FBI via Oracle PeopleSoft, Colorado water utilities were hit again with possible Iran links, and EvilTokens AI phishing-as-a-service got taken down with 12,000 victims
Sep 11, 2026
6 min read
Plus: Microsoft's September Patch Tuesday fixed 966 flaws and two zero-days, ShinyHunters claimed the Florida DMV database, and Chrome is now shipping updates every two weeks
Sep 5, 2026
Plus: U.S. strikes on Iran pushed federal agencies to warn about retaliatory attacks on water and utility systems, the Sality botnet was disrupted after 23 years, and Pegasus found its way onto Serbian activists' phones
Aug 29, 2026
Plus: TeamPCP finally got two arrests in Australia, Slovak traffic cameras came with a Russian backdoor pre-installed, and SharePoint exploit chains are being actively weaponized
Aug 22, 2026
Plus: Cl0p's PTC Windchill zero-day is hitting 40+ companies with GE, Philips, and Shell named so far, Oracle shipped 943 patches in one update, and US agencies warn AI is generating Siemens PLC exploits
Aug 15, 2026
Plus: Microsoft patched 398 flaws with AI finding more than humans can review, ransomware took down a hospital's doors and HVAC in Winnipeg, and three research teams bypassed passkeys without breaking FIDO2
Aug 8, 2026
Plus: Iran-linked hackers hit water utilities in seven U.S. states, Storm-2945 harvested M365 credentials from hotel Wi-Fi, and Samsung banned smart TV apps secretly running residential proxies
Jul 25, 2026
Plus: Iran-linked hackers targeted Siemens, Schneider, and Rockwell ICS devices, the EU fined Google €890M for DMA violations, and Operation Offsides seized 1,000+ illegal World Cup streaming sites
Jul 18, 2026
8 min read
Plus: Microsoft patched a record 622 vulnerabilities, asyncapi npm packages delivered a botnet loader via GitHub Actions, and ShinyHunters spent a year inside Salesforce via OAuth abuse
Jul 11, 2026
Plus: The DHS threat intelligence network got breached, a 16-year-old Linux KVM flaw lets guest VMs crash the host, and Canada's spy agency confirmed it hacked drug traffickers and a ransomware gang last year
Jun 27, 2026
Plus: North Korea poisoned 141 npm packages in 45 minutes, FortiBleed exposed 430,000+ FortiGate credentials, and a 1997 Squid Proxy bug finally got a CVE
Jun 20, 2026
Plus: The SocGholish botnet is down after nine years, Texas leaked 3M driver's licenses and passports, and dozens of cybersecurity vets are calling the Anthropic ban dangerous
Jun 13, 2026
Plus: Microsoft patched 200 flaws and three zero-days, Cisco's SD-WAN hit its seventh exploited zero-day of the year, and ShinyHunters went after Oracle PeopleSoft at 100+ universities
Jun 6, 2026
Plus: Palo Alto GlobalProtect auth bypass is actively exploited, Weil Gotshal reportedly paid $20M to keep client files quiet, and the EU is moving to limit U.S. cloud in sensitive infrastructure
May 30, 2026
Plus: ShinyHunters hit Carnival, Charter, and Mytheresa, the Dutch blocked a U.S. takeover of their national ID infrastructure, and Iran-linked actors are coding backdoors with AI assistance
May 23, 2026
Plus: fast16 predated Stuxnet and corrupted nuclear simulations quietly, Pwn2Own Berlin paid $1.3M for 47 bugs, and Bluesky got hijacked for Russian propaganda
May 16, 2026
Plus: ShinyHunters got paid, TeamPCP hit 170 packages across npm and PyPI, and Cisco's SD-WAN zero-day count hit six for the year
May 9, 2026
Plus: A 64-day cPanel zero-day window, ShinyHunters hits an ed-tech giant, and Europe blocks Huawei from its solar grid.
May 2, 2026
10 min read
Plus: Supply chain attackers found the path of least resistance, OpenSSH patched a bug older than most junior devs, and Europe is done pretending U.S. cloud is a neutral choice
Apr 25, 2026
Plus: Scattered Spider pleads guilty, a ransomware negotiator on the wrong payroll, and a China-linked backdoor in US federal Cisco firewalls.
Apr 18, 2026
Plus: AI vishing platforms hit the cybercrime market, NIST quietly caps CVE coverage, and Russia goes after a Swedish power grid.
![🕵🏻♂️ [InfoSec MASHUP] 43/2026 - The Patch Window Is a Race Now](https://media.beehiiv.com/cdn-cgi/image/format=auto,width=720,fit=scale-down,onerror=redirect/uploads/publication/thumbnail/ab407690-3f0c-4109-add5-5e9bf75e0e54/landscape_infosecMASHUP-substack-banner.png)
