Security Bulletin

SharePoint access often means access to the keys of the kingdom, something attackers and defenders understand all too well.

The Detectify MCP Server utilizes the Model Context Protocol (MCP), an open standard adopted across the AI industry for agent-tool communication.

The CypherLoc attack begins with a phishing email containing a malicious link or attachment.

The vulnerability, tracked as CVE-2026-8153 with a CVSS score of 9.8, affects all PolyScope software versions prior to 5.25.1.

The vulnerability, CVE-2026-5426, stems from the use of hard-coded ASP.NET machine keys within the LMS.

The Oncology Institute disclosed on May 20, 2026, that Kroll, a third-party administrator for an unnamed vendor, detected unauthorized access to systems that may have affected patient data.

The attack exploits vulnerabilities in iOS 16, specifically CVE-2025-43300 within the ImageIO framework and potentially CVE-2025-55177, to gain unauthorized access to WhatsApp sessions.

RemotePE is deployed through a multi-stage attack chain involving two loaders, DPAPILoader and RemotePELoader.

A user on a cybercrime forum is selling a database of 340 million records allegedly linked to OnlyFans users for approximately $76,000.

The vulnerability, identified as CVE-2026-26980, affects Ghost versions 3.24.0 through 6.19.0, allowing unauthenticated attackers to steal admin API keys.

Quantum threats are driving the need for post-quantum cryptography across the network stack, as attackers can capture encrypted data today and decrypt it in the future. Discover how Cisco full-stack PQC helps protect both devices and data.