Ransomware & Extortion
Japan's GMO urges customers to shut down PCs amid ransomware threat
BleepingComputer reports: The GMO Group has urged customers to disconnect their systems from the internet and shut down computers after a threat actor who breached the company's Onamae Desktop Cloud threatened to launch a ransomware attack today.
Vulnerabilities & remediation
PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network
The Hacker News reports: Cybersecurity researchers have disclosed details of what appears to be an artificial intelligence (AI)-assisted attack orchestrated by a suspected China-nexus threat actor that has leveraged the PHP2Shell vulnerabilities to breach exposed systems.
Vulnerabilities & remediation
Even after PHP2Shell, blast radius matters more than a CVSS score
BleepingComputer reports: PHP2Shell shows how quickly attackers can exploit critical vulnerabilities, often before organizations have time to patch. Token Security explains why limiting the access of service accounts, API keys, and AI agents is just as important as fixing vulnerabilities to reduce the damage from a breach.
Vulnerabilities & remediation
Hackers Target Critical Oracle E-Business Suite RCE Flaw Days After Security Patch
The Hacker News reports: Threat actors are beginning to probe for a newly patched critical vulnerability in Oracle E-Business Suite (EBS), according to threat intelligence firm Defused Cyber. The vulnerability in question is CVE-2026-101767 (CVSS score: 9.8) , a case of improper authentication in the Oracle Application Object Library of Oracle E-Business Suite.
Cybercrime & Fraud
American Organizations Under Attack: Skyw4lker Device Code Phishing Campaign Exposed
The Hacker News reports: Modern phishing campaigns can compromise American businesses without relying on traditional credential theft. Attackers can abuse legitimate cloud services, authentication mechanisms, and trusted business workflows to gain access to corporate accounts while leaving fewer obvious signs behind. ANY.RUN's analysis of Skyw4lker, a device code phishing campaign primarily targeting U.S.
Cybercrime & Fraud
Microsoft urges Entra ID admins to migrate users to passkeys
BleepingComputer reports: Microsoft again asked Entra ID administrators to migrate users to phishing-resistant methods to avoid sign-in disruptions before it retires SMS and voice authentication in February 2027.
Security Operations
Japan Airlines warns of data breach as country grapples with multiple cyber incidents
The Record reports: Hackers stole passport numbers, frequent flyer numbers, email addresses and phone numbers for about 2,000 customers.
Policy & Risk
UK to look at making software companies liable for cyber breaches
The Record reports: The new U.K. budget says the government will "consider where liability for cyber breaches should sit," potentially a landmark shift for a country that has relied on voluntary codes to encourage software vendors to improve security.