57
60
60
57
57
57
57
57
60
45
60
57
60
Week in review: Records allegedly stolen from Azure tenants, Medusa ransomware hits 500+ orgs
Week in review: Medusa ransomware hit 500+ orgs per CISA, millions of Azure tenant records allegedly stolen, SafePal and French tax authority breaches disclosed.
Help Net Security's weekly roundup covers the FBI, CISA, and HHS joint advisory update reporting Medusa ransomware has breached more than 500 organizations since June 2021, and threat actor TheHatman's claim of millions of employee records stolen from Azure tenants of Fortune 500 firms including McDonald's, Vodafone, Kyndryl, and Tata Consultancy Services, per Hudson Rock. It also covers the SafePal breach affecting 39,798 customers, France's DGFiP breach exposing data on 678,000 individuals, and UT San delaying its fall semester after a cyberattack. Security items include critical unauthenticated GitLab flaw CVE-2026-19478, an actively exploited patched macOS Screen Sharing flaw deploying a cryptominer, US charges against 17 Mabna Institute Iranian hackers over 31TB of stolen academic data, and Google Mandiant's AI agents finding 100+ high-severity vulnerabilities.
42
60
Week in review: ServiceNow pre-auth RCE exploited in the wild, Hugging Face breached
60
60
60
60
60
60
45
60
57
AI girlfriend review site's secrets were exposed to the world for three weeks
An AI girlfriend review site left secrets exposed to the public internet for roughly three weeks via unprotected testing and staging environments.
An AI companion review site exposed internal secrets to the world for approximately three weeks through unprotected testing and staging sites. The incident shows that non-production environments are often deployed without the access controls applied to production systems. Specific data types, volumes, and whether anyone abused the exposure were not detailed in initial reporting.
30
60
45
57
60
57
60
60
60
45
60
Week in review: GitHub breached via poisoned VS Code extension, critical NGINX flaw exploited
60
60
57
60
57