Denmark's Central Population Register (CPR) experienced a data breach exposing personal information of approximately 8.8 million individuals. The breach involves sensitive registry data but specific technical details and exploited vulnerabilities are not provided. No patch or remediation details are available from the input data. The incident affects a large portion of the Danish population, but no information on targeted countries beyond Denmark is given.
A suspected Chinese-speaking threat actor linked to Red Heron conducted extensive exploitation campaigns from May to September 2026. The attacker exploited multiple vulnerabilities in WordPress (CVE-2026-63030, CVE-2026-60137) to breach a western government organization, stealing over 18,000 sensitive records including credentials and personally identifiable information. Additionally, the actor exploited CVE-2026-7273 in ZyXEL GS1900 switches, compromising 996 devices across 48 countries and exfiltrating configurations and credentials. The adversary demonstrated sophisticated capabilities such as custom tool development possibly using large language models, privilege escalation, and systematic data exfiltration via PowerShell-based techniques.
The ShinyHunters hacker group claimed to have stolen over 350GB of information from European Commission cloud systems. The post European Commission Reports Cyber Intrusion and Data Theft appeared first on SecurityWeek .
Hackers stole personal, medical, and health insurance information from the company’s internal systems. The post 3.1 Million Impacted by QualDerm Data Breach appeared first on SecurityWeek .
The devices have been added to the NATO Information Assurance Product Catalogue (NIAPC). The post Apple iPhone and iPad Cleared for Classified NATO Use appeared first on SecurityWeek .
Eurail has confirmed that the stolen data is up for sale, but it’s still trying to determine how many individuals are impacted. The post Hackers Offer to Sell Millions of Eurail User Records appeared first on SecurityWeek .
The KRVTZ-NET IDS alert dated 2026-02-12 reports network reconnaissance activity detected via intrusion detection systems, involving scanning from the IPv6 address 2602:80d:1003::11 associated with Censys, an internet-wide scanning service. This activity is classified as low severity and represents automated information gathering rather than an active exploit or vulnerability. No affected products, patches, or known exploits are linked to this event. Although reconnaissance itself does not directly compromise systems, it increases exposure by revealing network configurations and services that could be targeted in future attacks. Organizations with publicly accessible IPv6 infrastructure, especially in Europe, should monitor such scanning as part of their threat intelligence and defense posture. Mitigation involves enhanced monitoring, network segmentation, hardening exposed services, and integrating threat intelligence to anticipate potential threats. The threat is assessed as low severity due to its limited immediate impact and lack of exploitation evidence.
Last week, a new AI agent framework was introduced to automate "live". It targets office work in particular, focusing on messaging and interacting with systems. The tool has gone viral not so much because of its features, which are similar to those of other agent frameworks, but because of a stream of security oversights in its design.
Infostealer threats are expanding beyond Windows, targeting macOS and leveraging cross-platform languages like Python. Recent campaigns use social engineering to deploy macOS-specific infostealers such as DigitStealer, MacSync, and AMOS. These stealers use fileless execution and native macOS utilities to harvest credentials and sensitive data. Python-based stealers are also on the rise, allowing attackers to quickly adapt and target diverse environments. Additionally, threat actors are abusing trusted platforms like WhatsApp and PDF converter tools to distribute malware such as Eternidade Stealer. These evolving threats blend into legitimate ecosystems and evade conventional defenses, posing significant risks to organizations across various operating systems and delivery channels.
Among them, 23,000 hosts were persistently responsible for the majority of activity observed over 293 days of scanning. The post 175,000 Exposed Ollama Hosts Could Enable LLM Abuse appeared first on SecurityWeek .
Vibe coding generates a curate’s egg program: good in parts, but the bad parts affect the whole program. The post Vibe Coding Tested: AI Agents Nail SQLi but Fail Miserably on Security Controls appeared first on SecurityWeek .
AI will assist companies in finding their external attack surface, but it will also assist bad actors in locating and attacking the weak points. The post Cyber Insights 2026: External Attack Surface Management appeared first on SecurityWeek .
Prompt injection attacks exploit implicit execution authority granted to generative AI models, allowing malicious inputs to trigger unauthorized side effects such as tool or function execution. This threat analysis reframes prompt injection as a failure of authority and trust boundaries rather than just input sanitization. A proposed mitigation architecture involves separating generation from execution, where the AI model only proposes actions and a distinct control plane enforces fixed policies to decide if actions are executed. This approach eliminates the privileged path from text generation to side effects, reducing the risk of prompt injection. European organizations using AI systems with implicit execution capabilities could face risks of unauthorized actions if such trust boundaries are not enforced. Countries with high AI adoption in critical infrastructure and technology sectors are more likely to be affected. The suggested severity is medium due to the moderate impact on integrity and availability, the complexity of exploitation, and the lack of direct authentication requirements. Defenders should focus on architectural changes that separate generation and execution, implement strict policy enforcement, and avoid granting AI models direct execution authority.
The 'Ferry IoT Hack' refers to a recently reported security incident involving Internet of Things (IoT) devices used in ferry operations. Although detailed technical information is scarce, the threat highlights vulnerabilities in ferry-related IoT systems that could be exploited to disrupt ferry services or compromise operational safety. The medium severity rating suggests a moderate risk, with no known active exploits or patches currently available. European ferry operators relying on IoT for navigation, safety, or operational management may face risks of service disruption or data compromise. Mitigation requires immediate security assessments of IoT deployments, network segmentation, and enhanced monitoring. Countries with significant ferry traffic and IoT adoption, such as the United Kingdom, Norway, Greece, and the Netherlands, are more likely to be affected. Given the lack of detailed exploit information, the threat is assessed as medium severity due to potential operational impact and moderate ease of exploitation without requiring user interaction or authentication. Defenders should prioritize threat intelligence gathering and proactive security hardening of ferry IoT infrastructures.
This threat concerns a method of CSRF (Cross-Site Request Forgery) protection that does not rely on traditional tokens or hidden form fields, as discussed in a recent blog post. CSRF attacks exploit the trust a web application has in a user's browser, causing unauthorized commands to be transmitted. The alternative CSRF protection approach aims to mitigate these attacks without using tokens, which are commonly used but can introduce complexity. While this method may simplify implementation, it requires careful consideration to ensure it does not weaken security. The threat is rated medium severity due to the potential for exploitation if the alternative protection is improperly implemented. No known exploits are currently in the wild, and the discussion level is minimal, indicating early-stage awareness. European organizations using web applications that adopt this novel CSRF protection approach should evaluate their security posture carefully. Mitigation involves thorough testing and validation of the alternative CSRF protection mechanism and maintaining defense-in-depth strategies. Countries with significant web development sectors and high adoption of modern web frameworks may be more impacted. Overall, defenders should be aware of this emerging approach and scrutinize its security implications before deployment.
A recently analyzed multi-stage macOS infostealer malware has been identified, highlighting a complex attack targeting macOS users. This malware operates in multiple stages to evade detection and exfiltrate sensitive information from infected systems. Although no known exploits are currently active in the wild, the threat poses a medium severity risk due to its potential to compromise confidentiality. European organizations using macOS devices should be aware of this threat, especially those in sectors with high-value data. Mitigation requires enhanced endpoint monitoring, restricting execution of unknown binaries, and user education on phishing and suspicious downloads. Countries with significant macOS market share and advanced tech sectors, such as Germany, the UK, France, and the Nordics, are more likely to be targeted. Given the malware’s complexity and potential impact on data confidentiality without requiring user interaction post-infection, the suggested severity is medium. Defenders should prioritize detection capabilities for multi-stage macOS malware and implement strict application control policies.
