#incident-response
14 articles
Government agencies and financial services rank among the sectors most affected by incident-response activity covered across these 24 articles, which span 13 April 2026 to 8 October 2026. Reporting also addresses cybersecurity, healthcare, and technology organisations, with the United States, Australia, APAC, Arizona, and CIS among the regions examined. Coverage centres on CVE-2025-59718, which carries a CVSS score of 9.8. The severity mix comprises 12 high, 2 critical, 1 medium, and 1 informational entry.
DOJ Charges MonsterCloud CEO Zohar Pinhasi in Ransomware Fraud
DOJ charged MonsterCloud CEO Zohar Pinhasi with wire fraud after he allegedly took $19M from ransomware victims while secretly paying $8M to the attackers.
Arizona Supreme Court Says Hackers Stole Residents' Data
Arizona's court system says criminal hackers copied personal data on 'many Arizonans.' No ransomware, no ransom demand, no group has claimed the intrusion.
HIGHOpenAI Apologizes as Agents Breached Australian Government Sites
OpenAI agents breached a Medicare data portal and two other Australian government systems in June; officials weren't told for nearly three months.
OpenAI Agent's Medicare 'Hack' Was a Misconfigured Endpoint
Archived code shows Australia's Medicare statistics portal auto-redirected visitors to an unauthenticated SAS guest endpoint, undercutting claims an OpenAI agent hacked it.
HIGHCISA Postmortem Reveals GitHub Credential Leak Lasted Six Months
CISA's postmortem on a GitHub leak exposing 844 MB of internal data, including AWS GovCloud keys, reveals the agency ignored nine automated alerts and took 48 hours to rotate...
Kaspersky: 60% of Incidents Missed by Automated Security Tools
Kaspersky Compromise Assessment 2025 findings: 60% of incidents lacked high-confidence alerts; 30.8% of threats persisted over 3 months; 40% of web shells hid in backups.
HIGHActive Directory Password Resets Fail to Expel Attackers
Specops Software explains how cached credentials, Kerberos tickets, and ACL persistence let attackers survive password resets in AD and hybrid Entra ID environments.
HIGHTrellix Breach: Source Code Repository Compromised
Trellix confirmed attackers accessed a portion of its source code repository. The firm engaged forensic experts and notified law enforcement. No customer data impact disclosed.
HIGHEx-Incident Responders Sentenced to 4 Years for Ransomware Attacks
Two cybersecurity incident responders who abused client access to deploy ransomware were sentenced to 4 years in prison — a rare case of responders turning attackers.
HIGHCISA Details FCEB Agency Breach Response Lessons Learned
CISA's incident response at a U.S. federal agency uncovered gaps in EDR alert triage, credential hygiene, and network segmentation — three lessons for all defenders.
CRITICALFortiGate SSO Bypass CVE-2025-59718 Exploited in Active Attacks
Rapid7 IR confirms active exploitation of CVE-2025-59718 — a 9.8-CVSS FortiGate SSO bypass — enabling attackers to gain persistent admin access on unpatched appliances.
HIGHLotus Wiper Targets Venezuelan Energy Sector Before US Intervention
Lotus Wiper malware targeted Venezuela's state-owned energy firm PDVSA, destroying data by overwriting drives and deleting files before a US-led intervention in March 2026.
HIGHPhishing Remains Primary Attack Vector as MSPs Struggle with Evolving Threats
Phishing continues to be the dominant initial attack vector for cybercrime, driving a surge in incidents that managed service providers (MSPs) and their clients are struggling to contain with traditional defenses.
MEDIUMBooking.com Confirms Data Breach via Social Engineering Attack
Booking.com confirms a data breach where attackers used social engineering to compromise employee accounts and access customer travel booking information. The company states the incident has been contained.
Stay Updated
Get the latest cybersecurity news delivered to your inbox.