#SecurityWeek
All CosmicBytez Labs articles tagged #SecurityWeek, across news, security advisories, how-to guides, and projects.
- News
Critical FortiMail Zero-Day CVE-2026-104286 Actively Exploited, No Patch Yet
CISA added CVSS 9.8 FortiMail flaw CVE-2026-104286 to its KEV catalog after active exploitation; Fortinet has no fix, only workarounds.
- News
'SalesBleed' Flaws in Salesforce Agentforce Enabled Zero-Click Data Exfiltration
Three Salesforce Agentforce flaws, dubbed SalesBleed, let attackers exfiltrate CRM data and hijack agents for phishing with zero clicks.
- News
Pixel Modem Zero-Day Exploited in Targeted Attacks
Google patched a Pixel modem zero-day (CVE-2026-58704) after confirming limited, targeted exploitation in the wild.
- News
In Other News: Apple Patches Beats Eavesdropping Flaw, DOT Closes Delta CrowdStrike Probe, AWS Continuum
This week's security roundup covers Apple's patch for a Beats headphones eavesdropping vulnerability, the DOT closing its investigation into Delta's...
- News
Android June 2026 Update Patches Exploited Zero-Day and 123 Other Vulnerabilities
Google's June 2026 Android security bulletin addresses 124 vulnerabilities including CVE-2025-48595, an actively exploited zero-day used in limited targeted…
- News
Critical Vulnerability in HP VoIP Phones Enables Enterprise Network Breaches
A stack-based buffer overflow flaw in HP OfficeConnect VoIP phones can be exploited remotely to achieve code execution, potentially allowing attackers to…
- News
One Line of Code Put Billions of Microsoft Android App Downloads at Risk
A single development-mode setting left in production code bypassed Android protections designed to prevent unauthorized apps from accessing Microsoft account…
- News
Dutch Police Dismantle Massive 17-Million-Device Botnet
Dutch authorities seized command-and-control servers tied to a botnet of 17 million infected computers, smartphones, and tablets that was allegedly used to…
- News
Critical FortiClient EMS Vulnerability Exploited in Fresh Attacks
Fortinet's April hotfix for the actively exploited CVE-2026-35616 FortiClient EMS flaw is now seeing renewed exploitation, as attackers continue targeting...
- News
Geordie Raises $30 Million for AI Security and Governance Platform
AI security startup Geordie closes a $30M round led by Balderton Capital to help enterprises detect and govern AI risk across their environments.
- News
185,000 Likely Impacted by 7-Eleven Data Breach
ShinyHunters has leaked data allegedly stolen from 7-Eleven containing email addresses, names, physical addresses, and dates of birth for approximately 185,000.
- News
''First VPN'' Cybercrime Service Disrupted, Administrator
The FBI and international partners have disrupted First VPN, a criminal VPN service used by dozens of ransomware groups for network reconnaissance and...
- News
Researcher Drops YellowKey, GreenPlasma Windows Zero-Days
A security researcher has publicly released two unpatched Windows zero-day exploits: YellowKey, a BitLocker bypass requiring physical access, and...
- News
Google Detects First AI-Generated Zero-Day Exploit in the Wild
SecurityWeek reports that Google has confirmed detecting the first known AI-generated zero-day exploit actively used in the wild. The exploit, designed to...
- News
New Bluekit Phishing Kit Features AI Assistant and Automated Domain Registration
A newly discovered phishing-as-a-service toolkit called Bluekit is emerging on underground forums, offering threat actors an AI assistant for campaign...
- News
1,800 Hit in Mini Shai-Hulud Attack on SAP, Lightning, and Intercom
The TeamPCP threat group's Mini Shai-Hulud supply chain campaign compromised SAP-related npm packages along with PyTorch Lightning and Intercom client...
- News
EnOcean SmartServer Flaws Expose Buildings to Remote Hacking
Claroty researchers have disclosed two vulnerabilities in the EnOcean SmartServer IQ building management controller that can be chained for security...
- News
Critical GitHub Vulnerability Exposed Millions of Repositories
A critical remote code execution vulnerability, CVE-2026-3854, was found to impact GitHub.com and GitHub Enterprise Server, potentially exposing millions...
- News
Next.js Creator Vercel Hacked
Vercel confirmed suffering a breach after a hacker claiming to be part of ShinyHunters offered to sell stolen data for $2 million, affecting the company...
- News
Orthanc DICOM Vulnerabilities Lead to Crashes, RCE
Multiple vulnerabilities in the widely-used Orthanc open-source DICOM server expose medical imaging systems to denial-of-service, information disclosure,...
- News
Medusa Ransomware Is Fast to Exploit Fresh Vulnerabilities
SecurityWeek reports that the Medusa ransomware group has developed a dangerous capability: rapidly weaponizing newly disclosed vulnerabilities —...
- News
250,000 Affected by Data Breach at Nacogdoches Memorial
Nacogdoches Memorial Hospital in Texas has disclosed a January 2026 data breach in which a threat actor accessed its internal network and stole personal...
- News
Cisco Patches Critical and High-Severity Vulnerabilities
Cisco has released security advisories addressing a batch of critical and high-severity vulnerabilities across multiple products, covering flaws that...
- News
Cloudflare-Themed ClickFix Attack Drops Infiniti Stealer on Macs
A newly observed ClickFix campaign impersonates Cloudflare's CAPTCHA verification pages to deliver the Python-based Infiniti Stealer to macOS users via a...
- News
Navia Data Breach Impacts 2.7 Million People
Navia Benefit Solutions has confirmed a data breach that exposed personal and health plan information belonging to approximately 2.7 million individuals,...