Security Bulletin

Teams are dealing with a truly dangerous problem — automation that works, but that no one understands.

ESET reported that Gamaredon conducted 35 distinct spear-phishing campaigns targeting Ukrainian governmental and military institutions in 2025, primarily in the latter half of the year.

The National Institute of Standards and Technology (NIST) scaled back on the number of CVEs it selects for in-depth analysis, but the move has produced mixed results, according to researchers.

Nissan Americas disclosed in a filing to the California Attorney General that a cyber event involving Oracle's personnel records led to the potential theft of payroll information, bank details, and Social Security numbers.

The StegoAd campaign employed steganography to hide malicious JavaScript within image and font files, making the extensions appear legitimate and functional.

In a 6-3 decision, the Supreme Court ruled that the Fourth Amendment's protection against unreasonable searches and seizures applies to location data collected by companies like Google.

Arcova has launched a new end-to-end data center development offering that integrates engineering, cybersecurity, regulatory compliance, and grid-planning coordination into a single team.

Microsoft will continue to offer hotpatching for Windows Server 2022 Datacenter: Azure Edition until 2027, a move that extends support beyond the mainstream end date of October 13, 2026.

The identified weak keys exhibit patterns of regularly spaced blocks of zeros.

The infostealer was delivered via CVE-2026-48558, a critical authentication bypass vulnerability in SimpleHelp, targeting credentials linking development and admin environments to wider enterprise systems.

Trump order accelerates U.S. quantum strategy, boosting post-quantum security.