Cloud, Identity & SaaS
The Huntress Tragic Quadrant: Ranking Threats Hitting Businesses Hardest
BleepingComputer reports: Attackers are increasingly abusing legitimate IT tools, Microsoft 365 sessions, and everyday workflows to compromise businesses without triggering traditional defenses. Huntress Labs ranks the threats hitting organizations hardest, highlighting which attack techniques deserve immediate attention and which remain emerging risks.
Ransomware & Extortion
Lazarus Abuses South Korean Security Software to Deploy Malware Using Post-Quantum Encryption
The Hacker News reports: The North Korea-linked Lazarus Group has been attributed to a cyber espionage campaign dubbed Operation FlashHole targeting at least three organizations in South Korea spanning the construction, software, and wire-communication equipment manufacturing sectors. According to Russian cybersecurity company Kaspersky, the campaign has been active since at least July 2025.
Vulnerabilities & remediation
CISA confirms PHP2Shell vulnerabilities now exploited in attacks
BleepingComputer reports: The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the PHP2Shell vulnerabilities to its catalog of actively exploited security flaws and ordered federal agencies to patch their systems by Thursday.
Vulnerabilities & remediation
Tailscale warns of SSH flaws allowing root privilege escalation
BleepingComputer reports: The Tailscale security team is working to patch almost a dozen security vulnerabilities that could be exploited to steal credentials, crash servers, gain root privileges, and more.
Vulnerabilities & remediation
Apple Backports Fix for Exploited CoreGraphics Flaw to Older iPhones and iPads
The Hacker News reports: Apple on Monday backported fixes for a high-severity security flaw that was exploited in real-world cyber attacks to older devices. The vulnerability, tracked as CVE-2026-86950 (CVSS score: 8.8), is an out-of-bounds write affecting CoreGraphics that could result in arbitrary code execution when processing a maliciously crafted file.
AI & Security
CyberStrikeAI Uses 44 AI Agents to Automate Hacking Operations Against Japan Targets
The Hacker News reports: Cybersecurity researchers have disclosed details of three cyber attacks targeting organizations in Japan in which artificial intelligence (AI) was a key element, either in the driving seat or to assist a human operator.
Security Operations
University of New Mexico hospital diverts ambulances after cyberattack
The Record reports: For about two hours on Monday, the organization diverted ambulances to health systems in Albuquerque and Santa Fe. They were forced to suspend outpatient surgeries and appointments for the remainder of the day.
Vulnerabilities & remediation
Mitsubishi Electric GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz
CISA reports: View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code (CVE-2023-4863), bypass authentication (CVE-2026-16436 and CVE-2026-16437), or perform arbitrary operations (CVE-2026-16438), resulting in information disclosure, tampering with, destruction, or deletion of information, and a denial-of-service (DoS) condition of the system.