Everything BreachFeed is tracking across the industry, as it publishes.
Link — click to select, then copy:
https://breachfeed.com/article/cmu8dcs0l1hmlhmu2t5cy1yosGoogle Confirms Gemini Hacked 3 Real Companies in May Safety Test BeInCrypto
Link — click to select, then copy:
https://breachfeed.com/article/cmu8clrri1g16hmu29w6he1ghGoogle’s Gemini hacked three real companies during security test Cybernews
Link — click to select, then copy:
https://breachfeed.com/article/cmu8ae1e31b86hmu2j72lvpevGoogle's Gemini AI Broke Its Own Sandbox and Hacked Three Real Companies startupfortune.com
Link — click to select, then copy:
https://breachfeed.com/article/cmu897lnf18nlhmu2bywdhc3aGoogle Gemini Hacked Other Companies in Test by Israeli Cybersecurity Firm Haaretz
Link — click to select, then copy:
https://breachfeed.com/article/cmu2nexi06ctjhpu2lbtywcrwThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned security teams that ransomware gangs have now joined ongoing attacks exploiting a critical VMware vCenter vulnerability patched in July. [...]
Link — click to select, then copy:
https://breachfeed.com/article/cmu7hge4q0005hmu250yp64y8Reported to the California Attorney General on 09/15/2026. Date of breach: 04/24/2026.
Link — click to select, then copy:
https://breachfeed.com/article/cmu2v0une6laehpu2myxksjweView CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to access live video and sensitive device information, enable unauthorized services, execute arbitrary code, modify device operation, and recover stored credentials. The following versions of CareCam CM2507 are affected: HMT.CM2507 Firmware v251211.1507 (CVE-2026-88259, CVE-2026-84398, CVE-2026-84400, CVE-2026-81305, CVE-2026-85478, CVE-2026-85497, CVE-2026-81321) CVSS Vendor Equipment Vulnerabilities v3…
Link — click to select, then copy:
https://breachfeed.com/article/cmu2v0une6ladhpu2c0x0cui8View CSAF Summary Siemens Reyrolle 7SR5 Before V2.70 is affected by multiple vulnerabilities. Siemens has released a new version for Reyrolle 7SR5 and recommends to update to the latest version. The following versions of Siemens Reyrolle 7SR5 are affected: Reyrolle 7SR5 vers:intdot/<2.70 (CVE-2024-42384, CVE-2024-42385, CVE-2024-42386, CVE-2024-42391, CVE-2024-42392, CVE-2026-62645, CVE-2026-62646, CVE-2026-62647, CVE-2026-62648, CVE-2026-62649, CVE-2026-62650, CVE-2026-62652, CVE-2026-62653,…
Link — click to select, then copy:
https://breachfeed.com/article/cmu2v0une6lachpu2ewab8yvmView CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to deliver an unauthorized update, execute code, or extract credentials to allow the attacker to impersonate a privileged client. The following versions of Wärtsilä FOS-Onboard are affected: FOS-Onboard 5.07.0923.01 (CVE-2026-78225, CVE-2026-81855) CVSS Vendor Equipment Vulnerabilities v3 9.1 Wärtsilä Wärtsilä FOS-Onboard Use of Hard-coded Cryptographic Key Background Critical Infrastructure Sectors:…
Link — click to select, then copy:
https://breachfeed.com/article/cmu2v0une6labhpu2x8k4yh9gView CSAF Summary Mendix SAML module contains a vulnerability that could allow unauthenticated remote attackers to hijack an account in specific SSO configurations. Mendix has provided fix releases for the Mendix SAML module and recommends to update to the latest version. The following versions of Siemens Mendix SAML are affected: Mendix SAML (Mendix 10 compatible) vers:intdot/<4.2.3 (CVE-2026-80465) Mendix SAML (Mendix 11 compatible) vers:intdot/<4.2.3 (CVE-2026-80465) Mendix SAML (Mendix 9.24…
Link — click to select, then copy:
https://breachfeed.com/article/cmu2v0une6laahpu2kktox2u8View CSAF Summary A reflected cross site scripting vulnerability in the authentication redirect flow (/auth/) of Teamcenter allows an unauthenticated remote attacker to inject JavaScript into an authenticated user's session by crafting a malicious URL. Successful exploitation may enable the attacker to read data or perform actions within the victim's Teamcenter session. Siemens has released new versions for the affected products and recommends to update to the latest versions. The following…
Link — click to select, then copy:
https://breachfeed.com/article/cmu2v0une6la9hpu29mltju81View CSAF Summary Schneider Electric is aware of a vulnerability in its SCADAPack x70 products. The SCADAPack 47x, SCADAPack 47xi, SCADAPack 47xd, SCADAPack 470R and SCADAPack 57x products are Remote Terminal Units that provide communication capabilities for remote monitoring and control. Failure to apply the mitigations provided below may increase the risk of unauthorized access to RTU configuration through the Secure Lock functionality, potentially resulting in a loss of confidentiality. The…
Link — click to select, then copy:
https://breachfeed.com/article/cmu2v0une6la8hpu2u34ovcfbView CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to access privileged management functions or send arbitrary SMS messages through the connected GSM modem. The following versions of mySCADA myPRO Manager are affected: mySCADA myPRO Manager <=2.1 (CVE-2026-73807, CVE-2026-82567) CVSS Vendor Equipment Vulnerabilities v3 9.8 mySCADA Technologies mySCADA myPRO Manager Missing Authorization, Missing Authentication for Critical Function Background Critical…
Link — click to select, then copy:
https://breachfeed.com/article/cmu2v0une6la7hpu2ywds5v6aView CSAF Summary Successful exploitation of these vulnerabilities could grant full administrative control of the device, allowing an attacker to view live and recorded surveillance, alter device configurations, and use the device as a network pivot point. The following versions of Digital Watchdog VMAX DVR and NVR Product Lineups are affected: VMAX A1 G4 DVRs vers:all/* (CVE-2026-68953, CVE-2026-66890, CVE-2026-68070, CVE-2026-68950, CVE-2026-66887, CVE-2026-66372) VMAX IP G4 NVRs vers:all/*…
Link — click to select, then copy:
https://breachfeed.com/article/cmu2rwysg6hschpu2udrun2n4Developed by the National Institute of Standards and Technology (NIST) and CISA, this interagency report provides federal agencies and cloud service providers with guidelines to protect the identity assertions, access tokens, and cryptographic mechanisms that support modern authentication and authorization. As agencies adopt hybrid and multi-cloud environments, single sign-on, federation, and application programming interface (API)-based access increasingly depend on signed tokens and…
Link — click to select, then copy:
https://breachfeed.com/article/cmu2n0sdt6cg0hpu2sq2tfww3With artificial intelligence (AI) shrinking the window between vulnerability discovery and exploitation and lowering the barrier to entry for bad actors, new findings from Sysdig show that skilled human operators can move just as swiftly after gaining initial access. In one instance highlighted by the cloud security company, the threat actor pivoted from a vulnerable Marimo notebook to an SSH
Link — click to select, then copy:
https://breachfeed.com/article/cmu2m22ei6bdjhpu25jsl3knkHackers exploited a vulnerability in a VPN product to steal the personal information of roughly 240,000 people. The post 240,000 Hit by Data Breach at Japan’s Digital Agency appeared first on SecurityWeek.
Link — click to select, then copy:
https://breachfeed.com/article/cmu2n0sdt6cg1hpu2vwv8grjmIntroduction Security teams have gotten pretty good at testing against what can hurt them. Can this EDR agent catch this payload? Will my organization fail the phishing simulation? Does this SIEM rule fire on this particular technique? And, in more mature organizations, this testing happens continuously rather than as a one-off exercise. But no matter how much you validate against these
Link — click to select, then copy:
https://breachfeed.com/article/cmu2n0sdt6cg2hpu2l4xr0h6mCybersecurity researchers have disclosed details of a mass-scanning campaign that has targeted Vite deployments siphon sensitive data. The first is an automated effort aimed at internet-exposed Vite development servers that's designed to steal cloud credentials, configurations from Amazon Web Services (AWS) and Microsoft Azure instances, and infrastructure state files, per F5 Labs. The
Link — click to select, then copy:
https://breachfeed.com/article/cmu2kk1yq69pthpu22jhyfodfThe updates resolve kernel vulnerabilities that could lead to memory corruption, privilege escalation, system termination, and information leaks. The post Apple Patches 200 Vulnerabilities With New iOS 27, macOS Golden Gate 27 Releases appeared first on SecurityWeek.
Link — click to select, then copy:
https://breachfeed.com/article/cmu2i3bet66zmhpu240y9635cFive alleged leaders of the Black Axe cybercrime syndicate, known for its involvement in global-scale cyber-enabled financial fraud, have been extradited to the United States to face wire fraud and money laundering charges. [...]
Link — click to select, then copy:
https://breachfeed.com/article/cmu2hub9d66o3hpu2u7e8lyoh44-year-old Kenneth Carter from Portland, Oregon, used to work in an AT&T retail store. But now he has been sentenced to 16 months in a federal prison. That should be plenty of time for him to rue the day he agreed to increase his monthly income by helping a SIM swap gang in their attempt to steal over half a million dollars. Read more in my article on the Hot for Security blog.
Link — click to select, then copy:
https://breachfeed.com/article/cmu2hk12066ebhpu2f5bm3g5uThe Humanist AI Code of Conduct draws a line between defensive cyber research and operational attack capability. The post Microsoft AI Code of Conduct Sets Cyberattack Boundaries, Chain of Command, Safety Constraints appeared first on SecurityWeek.
Link — click to select, then copy:
https://breachfeed.com/article/cmu2ghg62657jhpu289fvp262Ads led to a ClickFix page designed to trick macOS and Windows users into installing malware. The post Hacked HBO Max Reddit Account Used for Malware Delivery via ClickFix Attack appeared first on SecurityWeek.
Link — click to select, then copy:
https://breachfeed.com/article/cmu2g4kzt64qvhpu29iw7i1rkOrganizations are investing more in security than ever before, yet many still struggle with a fundamental problem: they are preparing for tomorrow’s crisis with yesterday’s mindset. For decades, companies organized security around neat categories. Cybersecurity protected networks. Physical security protected facilities and people. Human resources managed workforce issues. Legal handled compliance. The model worked because threats largely stayed in their lanes. That is no longer the case. Today,…
Link — click to select, then copy:
https://breachfeed.com/article/cmu2fiq0f644lhpu2l5zhlcliMicrosoft has confirmed that copy and paste may silently fail for some Excel users after installing the September 2026 KB5002914 security update. [...]
Link — click to select, then copy:
https://breachfeed.com/article/cmu2euada63cjhpu2zjelniztBoth state-affiliated cyberespionage group and cybercrime gangs are targeting AI-related documents, configuration files, and proprietary models during intrusions. In addition, the number and scope of distillation attacks, where the knowledge, logic, and reasoning capabilities of LLMs is being extracted with targeted prompts, is increasing. “GTIG observed adversaries with wide-ranging motivations target proprietary AI models and source code, exfiltrate application programming interface (API)…