76 stories from 17 sources
The week in Cybersecurity
Click on a headline to see stories that shaped it.
Threads
6 threads
Critical PHP flaws moved from an unconfirmed report to active exploitation, millions of attempts and emergency patching worldwide. Organizations took websites offline, prioritized exposed systems and investigated possible compromise before fixes were broadly available.
Attackers used autonomous and commercial AI agents to multiply intrusions, including campaigns against banks, while financial institutions began blocking unauthorized agents. Defensive efforts also shifted toward building agent safeguards into systems before deployment.
Compromised intermediate certificates created a risk of forged website credentials and intercepted connections. The fallout culminated in eMudhra leaving the certificate business after weak private keys exposed a broader trust problem.
A suspected SBI customer-data leak progressed from public claims to an internal investigation and an insurance notification. The exposed records raised risks of identity fraud, targeted scams and difficult questions about breach evidence and remediation.
A China-aligned group breached ConnectWise and gained visibility into thousands of organizations through the provider's customer base. The incident demonstrated how compromising a trusted technology intermediary can extend an intrusion far beyond one company.
Meta Muse conversations became searchable by title, allowing large numbers of shared chats to surface personal or business information. Meta later restored sharing, keeping consent and default-disclosure controls at the center of the issue.
Day’s Recap