Rejetto HFS session-forgery flaw (CVE-2026-61500) under attack
Attackers are forging admin sessions on Rejetto HFS via CVE-2026-61500, a weak-PRNG flaw scored 9.3. Fix is in 3.2.1; VulnCheck reports exploitation and a PoC is public.
Newsroom
Booba ransomware hits UIC College of Medicine, 344GB claimed
The University of Illinois Chicago College of Medicine was hit by ransomware; the Booba group claims 344GB stolen. UIC says patient care and the main network were unaffected and systems are restored.
DTU breach exposes CPR numbers on up to 200,000 people
Attackers used stolen credentials to raid DTU's DTUBasen identity system, exposing CPR numbers and personal data on up to 200,000 current and former users dating to 2003.
Proofpoint: TA419 phishes US AI policy circles via BitB OneDrive
Proofpoint ties China-aligned TA419 to credential phishing against US AI policy experts, using Frameless BitB to spoof Microsoft OneDrive logins and steal MFA-backed sessions.
Fortra patches critical BoKS flaws: unauth RCE and AD bypass
Fortra fixed eight BoKS Core PAM flaws, three critical: an unauth stack overflow (CVE-2026-12627, 9.8), a crlserver command injection to root, and predictable AD passwords. Fixed in 8.1.0.24/9.0.0.7.
MI5 names CGTRI as MSS front, warns 100+ UK academics
MI5's first self-published espionage alert says the China General Technology Research Institute funds UK academic research to boost MSS espionage capability. Review CGTRI funding ties now.
US court dismisses El Faro Pegasus suit against NSO Group
A California federal court dismissed the El Faro journalists' Pegasus-spyware suit against NSO Group for lack of jurisdiction; the Knight Institute says it will appeal.
ShinyHunters member 'Rey' detained in Jordan, aiding FBI
Reuters reports Jordanian authorities detained Saif al-Din Khader, alias 'Rey', who is cooperating with the FBI to locate other ShinyHunters members. He is a suspect, not charged.
CloudSyncD: fake Zoom installer backdoors macOS, steals passwords
Jamf Threat Labs found CloudSyncD, a new macOS backdoor delivered by a fake Zoom installer that social-engineers past Gatekeeper and hides the user's password in a fake config file.