EdgeProtect
Threat News
Latest cyber threat intelligence, breaches and exploitation
10 stories
Attackers Exploit SharePoint Authentication Bypass CVE-2026-55040 Following Public PoC Release
Microsoft SharePoint is under active attack as threat actors exploit CVE-2026-55040, a critical security feature bypass with a CVSS score of 9.1, immediately after public proof-of-concept code became available.
New Ransomware Group Linkc Targets H2O.ai with Extortion Claims
A newly identified ransomware operation named Linkc has emerged, claiming to have breached AI and cloud provider H2O.ai and demanding payment in exchange for withheld sensitive corporate information.
Hunters International Ceases Operations, Announces Mass Leak of Stolen Data from 67 Victims
Hunters International has officially closed its project and announced it will leak stolen data from 67 victims, following a period of increased law enforcement pressure that led to its rebranding as World Leaks earlier this year.
GDLockerSec Claims Attacks on Nigerian Agency and AWS, but Evidence Suggests Amateur Operation
The GDLockerSec ransomware group has claimed responsibility for attacks on a Nigerian government agency and Amazon Web Services in January 2025, yet forensic analysis indicates the operation is amateurish and relies on exaggerated narratives to inflate its reputation within the cybercrime ecosystem.
Trend Micro Exposes The Gentlemen Ransomware Group's Advanced Driver Abuse and Anti-AV Tactics
Trend Micro has detailed the sophisticated tactics of The Gentlemen ransomware group, which leverages legitimate driver abuse and Group Policy Object manipulation to compromise manufacturing, healthcare, and construction sectors globally.
Trezor Confirms Data Breach at ShipMonk Affecting 14,000 Customers
Trezor has confirmed that its third-party shipping partner, ShipMonk, suffered a data breach impacting 14,000 customers after attackers leveraged a SQL injection flaw in the Metabase platform.
Attackers Exploit macOS Screen Sharing Authentication Bypass CVE-2026-65400 to Gain Root and Deploy Monero Miners
The flaw in macOS Screen Sharing allows network-based attackers to bypass authentication and obtain root access, with observed deployments of Monero crypto miners on compromised systems.
Exposed AWS Access Key Linked to Data Breach Affecting 1500+ UK Charities
CRM provider Beacon attributes a breach impacting around 1,500 UK charities to a compromised AWS access key that was likely exposed during software development, leading to the exfiltration of supporter personal data.
France's DGFiP Confirms Breach After Hacker ZeroBytes Claims 600,000 Victims
French authorities are investigating a breach of the Directorate General of Public Finances (DGFiP) after hacker ZeroBytes claimed to have stolen data on over 600,000 individuals and businesses.
Active Attacks Target Max-Severity SAP Commerce Cloud RCE Patched Three Days Ago
A critical remote code execution vulnerability in SAP Commerce Cloud, patched on Tuesday, is already seeing exploitation attempts in the wild just three days later, according to Defused. The flaw, tracked as CVE-2026-58231, allows unauthenticated attackers to abuse a default authentication client and submit crafted input to trigger arbitrary code execution with high impact on confidentiality, integrity and availability.
