A report indicates that Harvard University and approximately 140 other legitimate websites have been compromised. The information originates from a Reddit post in the Malware subreddit, linking to an external source. There are no technical details, exploit descriptions, or patch information provided. The severity is assessed as medium based on the reported scale, but no CVSS score is available. There is minimal discussion and no known exploits in the wild. No remediation or patch guidance is provided, and the affected versions or specific vulnerabilities are not identified.
A report from Reddit's NetSec community indicates that GitHub was impacted by a compromised Visual Studio Code (VSCode) extension. The information is based on a single external link with minimal technical details and no confirmed exploits or affected versions. No official vendor advisory or patch information is available. The severity is assessed as medium based on the report, but details on the nature or extent of the compromise are limited.
Verizon's 2026 Data Breach Investigations Report (DBIR) reveals that vulnerability exploitation has surpassed credential theft as the leading cause of data breaches in 2025. The report analyzed over 31,000 security incidents, with 31% of breaches resulting from exploitation of unpatched vulnerabilities. AI technologies are accelerating the weaponization of known vulnerabilities, reducing the window for defense from months to hours. Organizations are struggling with timely patching, with median full patching time increasing to 43 days and only 26% of known exploited vulnerabilities patched. Ransomware involvement in breaches rose to 48%, while third-party breaches increased by 60%. The report highlights the growing use of AI by threat actors for attack development and targeting. Overall, the findings emphasize the urgent need for organizations to prioritize vulnerability management and remediation during development rather than relying on downstream fixes.
A contractor for the Cybersecurity & Infrastructure Security Agency (CISA) publicly exposed highly privileged AWS GovCloud credentials and numerous internal system passwords in a GitHub repository. The repository contained plaintext passwords, cloud keys, tokens, and internal documentation related to CISA's software development and deployment processes. The exposure lasted from November 2025 until May 2026, when the repository was taken offline after notification. CISA confirmed awareness and ongoing investigation, stating no indication of data compromise so far. The exposed credentials included administrative access to multiple AWS GovCloud accounts and internal repositories, posing a significant security risk.
Several healthcare data breaches impacting hundreds of thousands and even millions were added to the HHS tracker. The post Millions Impacted Across Several US Healthcare Data Breaches appeared first on SecurityWeek .
The hackers claimed to have stolen more than 600,000 Salesforce records, including personal information and corporate data. The post 7-Eleven Data Breach Confirmed After ShinyHunters Ransom Demand appeared first on SecurityWeek .
Grafana appears to have been targeted by Coinbase Cartel, a cybercrime group linked to ShinyHunters, Scattered Spider, and Lapsus$. The post Grafana Confirms Breach After Hackers Claim They Stole Data appeared first on SecurityWeek .
Netmirror, a free movie application, was exposed in a security-related incident reported via a Reddit Malware subreddit post. The exposure involves the app reportedly 'robbing' users, implying malicious behavior or data compromise. There is no detailed technical information or evidence of active exploitation in the wild. No affected versions or patch information is provided, and the source is primarily a Reddit post linking to an external Medium article. The severity is assessed as medium based on the reported impact and lack of confirmed exploits.
Other noteworthy stories that might have slipped under the radar: Nvidia cloud gaming data breach, Android 17 security upgrades, FBI warning after ShinyHunters hacks Canvas. The post In Other News: Big Tech vs Canada Encryption Bill, Cisco’s Free AI Security Spec, Audi App Flaws appeared first on SecurityWeek .
The non-bank lender discovered a ransomware attack nearly one year ago, but only recently completed its investigation. The post American Lending Center Data Breach Affects 123,000 Individuals appeared first on SecurityWeek .
The Committee on Homeland Security has requested to be briefed on the incident and Instructure’s remediation steps. The post Government to Scrutinize Instructure Over Canvas Disruption, Data Breach appeared first on SecurityWeek .
The telehealth platform was hacked in January, and users’ personal information was exfiltrated from its systems. The post 716,000 Impacted by OpenLoop Health Data Breach appeared first on SecurityWeek .
Using a vulnerability in the portal, hackers accessed names, addresses, email addresses, and phone numbers. The post Skoda Data Breach Hits Online Shop Customers appeared first on SecurityWeek .
The company topped revenue and earnings forecasts for the first quarter of 2026, but its shares plunged more than 20%. The post Cloudflare Lays Off 1,100 Employees in AI-Driven Restructuring appeared first on SecurityWeek .
A malicious version of the plugin was published to the Jenkins Marketplace late last week. The post Checkmarx Jenkins AST Plugin Compromised in Supply Chain Attack appeared first on SecurityWeek .
The hackers gained the ability to modify equipment operational parameters, creating a direct risk to the public water supply. The post Polish Security Agency Reports ICS Breaches at Five Water Treatment Plants appeared first on SecurityWeek .
Hackers accessed one of the company’s AWS accounts and compromised AI provider secrets stored in Braintrust. The post AI Firm Braintrust Prompts API Key Rotation After Data Breach appeared first on SecurityWeek .
A cybercrime group conducted a data extortion attack against the education technology platform Canvas, disrupting classes and coursework across numerous U. S.schools and universities. The attackers defaced Canvas's login page with a ransom demand and threatened to leak data from approximately 275 million students and faculty spanning nearly 9,000 educational institutions. This incident caused widespread operational disruption in the affected educational organizations.
The cybersecurity firm’s investigation has not found any impact on its source code release or distribution process. The post Trellix Source Code Repository Breached appeared first on SecurityWeek .
Hackers disrupted services and stole names, email addresses, student ID numbers, and user messages. The post Edtech Firm Instructure Discloses Data Breach Amid Hacker Leak Threats appeared first on SecurityWeek .