A critical zero-day vulnerability has been discovered in the Metabase Cloud business-analytics platform, allowing malicious attackers to gain remote administrator access and potentially compromise downstream organizations. The maximum-severity flaw, which has not yet been assigned a CVE identifier, affects versions 1.58 of the platform and above. According to an advisory posted on GitHub by Metabase, … Read more
Cyberattacks on US Water Systems Continue to Spread, with Iran Suspected as Culprit A wave of cyberattacks targeting water and wastewater systems has been sweeping across the United States, leaving a trail of vulnerable industrial controllers in its wake. At least a dozen states have reported attacks, with the latest victims including Alabama and New … Read more
A Second Polish Energy Plant Falls Victim to Sophisticated Cyber Attackers, Exposing a Novel Attack Path Last year’s devastating cyber attacks on Poland’s energy sector have revealed an alarming new threat vector. A small combined heat-and-power (CHP) plant in Poland was compromised by hackers who exploited a private Access Point Name (APN) network, demonstrating a … Read more
Cyberattacks on US Water Systems Widen, with Iran Suspected Behind the Threats A growing number of states across the US have fallen victim to a wave of cyberattacks targeting their water and wastewater systems. The attacks, which have been linked to Iranian threat actors, have exposed weaknesses in the country’s critical infrastructure, leaving experts warning … Read more
Security researchers at Tenet have unveiled a new attack technique that exploits identity governance gaps in AI agents, allowing attackers to manipulate and hijack these systems with alarming ease. The technique, dubbed “GhostJacking,” works by tricking AI agents into executing malicious commands using seemingly legitimate instructions hidden within trusted data sources. This can include security … Read more
A member of the notorious online cybercrime collective “The Com” has been sentenced to two years in prison for blackmail and sextortion offenses against nearly 120 victims worldwide. Justin Swaddle, known by several aliases on social media platforms, was arrested in October 2023 and pleaded guilty to multiple child sexual abuse offenses at Leeds Crown … Read more
A Devastating Supply-Chain Hack Hits WordPress Admins through BdThemes Plugins A sophisticated threat actor has exploited a vulnerability in the upstream infrastructure of BdThemes, a developer of premium WordPress web-design tools, to create rogue admin accounts on thousands of websites. The attack, which was first detected by WordPress security firm Defiant on August 7, has … Read more
A Second Polish Energy Plant Compromised via Private APN, Highlighting a Novel Attack Vector In a significant revelation, Poland’s Computer Emergency Response Team (CERT) has disclosed that a second energy plant was breached by hackers last year using an unconventional approach. The attack, which occurred on December 29, 2025, highlights the growing threat of sophisticated … Read more
**New Research Exposes Identity Governance Gaps in AI Agents** A recent demonstration at DEF CON 34 has highlighted a disturbing vulnerability in artificial intelligence (AI) agents, allowing attackers to manipulate and hijack these systems using seemingly legitimate security alerts and blocked events. This technique, dubbed “GhostJacking,” has left many organizations wondering if their AI-powered defenses … Read more
Valve has notified Steam hardware customers in Europe that their personal and order information was stolen by hackers who broke into the shipping partner CEVA Logistics’ servers. The breach occurred between July 29 and August 1, with attackers gaining access to details such as names, addresses, phone numbers, email addresses, and product orders. CEVA Logistics … Read more