60
60
Poland probes MyDr healthcare software breach potentially affecting 19 million people
Poland investigates a breach at healthcare software firm MyDr potentially exposing data of nearly 19 million people and over 12,000 medical facilities.
Polish healthcare software provider MyDr disclosed a cyberattack that may have exposed personal and medical data belonging to nearly 19 million people and more than 12,000 medical facilities. Hackers obtained unauthorized access to historical data held through April 2024, but the company has found no evidence the data has been published. As a precaution, Poland's e-Health Center is replacing digital certificates used by medical systems to connect to the national P1 e-health platform. The Personal Data Protection Office plans to inspect MyDr and security agencies are working to identify those responsible; no threat actor has been attributed.
85
60
60
60
60
60
MikroTik Patches Critical Flaws Chained to Hack Routers
MikroTik patches six RouterOS flaws; two chained as MikroTrick are actively exploited via SSH to fully compromise exposed routers.
MikroTik released patches for six RouterOS vulnerabilities, including actively exploited MikroTrick chain: CVE-2026-67276 (9.2, SSH auth bypass) and CVE-2026-86060 (9.2, privilege manipulation), plus CVE-2026-67277 (8.8). CERT Poland confirms exploitation since September 2, creating an 'ops' account from IPs 82.192.72.4 and 103.102.31.18. Fixed in RouterOS 7.25beta3, 7.24.2, 7.23.4, and 6.49.21; Shadowserver found 120,000+ SSH-exposed MikroTik devices.
84
Poland's CERT Warns of Active Exploitation of Critical Zimbra Collaboration Suite Flaw
CERT Polska confirms active exploitation of critical unauthenticated RCE CVE-2026-73570 in Zimbra Collaboration Suite, patched July 20.
CERT Polska confirmed threat actors are actively exploiting CVE-2026-73570, an unauthenticated OS command injection in Zimbra Collaboration Suite allowing arbitrary shell commands as the zimbra user. Exploitation requires the SNMP trap service via snmp_notify with swatchdog running, which is enabled by default; Shadowserver tracks over 12,100 internet-exposed Zimbra servers. Zimbra fixed the flaw in version 10.1.20 on July 20, 2026, 28 days before exploitation was confirmed. Historical Zimbra targeting includes Winter Vivern, APT29, and APT28 campaigns.
78
NTLM Hash Exploit Targets Poland and Romania Days After Patch
60
60
60
Week in review: Firmware-level Android backdoor found on tablets, Dell zero-day exploited since 2024
60
Kaspersky Security Bulletin 2020
60
Hackers exploit new MikroTik RouterOS flaws to hijack routers
Attackers actively exploit a MikroTik RouterOS SSH authentication bypass and privilege escalation chain, dubbed MikroTrick, to fully hijack internet-exposed routers.
Poland's CERT, with help from GPT-5.5-cyber and GPT-5.6-sol, discovered and confirmed active exploitation of a MikroTik RouterOS chain dubbed MikroTrick: SSH authentication bypass CVE-2026-67276 (incomplete RSA public key validation) chained with privilege escalation CVE-2026-86060 (crafted usernames granting full administrative privileges). A third flaw, CVE-2026-67277, allows unauthenticated kernel memory leaks or router crashes via the bandwidth-test service. Fixes shipped September 3 in RouterOS 7.25beta3, 7.24.2, 7.23.4, and 6.49.21, adding a startup compromise-detection mechanism. Shadowserver data showed 122,500 MikroTik devices with exposed SSH interfaces as of September 5, and the CERT published IoCs including two attacker IP addresses.
82
Banking Trojans: Ursnif Global Distribution Networks Identified
Unit 42 maps banking-trojan distribution networks: spam botnets push Shiotob downloaders and Ursnif, KINS, Tinba at Japan and European targets via compromised web servers.
Unit 42 identified the distribution networks behind banking trojan attacks against Japan, Italy, Spain, Poland, Australia, and Germany. A spam botnet delivered 75 unique Shiotob (Bebloh/URLZone) variants across 7 million spam emails, with Shiotob acting mainly as a downloader that installs Ursnif and the Pushdo spam bot from C2 commands. Over 200 malicious files were hosted on 74 compromised, mostly European small-business web servers between April 2015 and January 2017, with localized invoice and photo-themed email lures per target country.
46
60
60
60
60
60
60
Leaks, data breaches, and ransom notes: The worst hacks of 2026 so far
TechCrunch's 2026 roundup covers SSA data exposure, Iranian water-utility attacks, Klue breach hitting ~200 firms, and Meta AI chatbot account hijacks.
TechCrunch's mid-year roundup highlights a whistleblower claim that DOGE uploaded a live Social Security database copy to an unsecured third-party server, which House Democrats called potentially the largest US breach in history. CISA reported Iranian hackers targeted over 100 US water providers over the summer, while Russian-linked attacks hit Polish, Swedish, and Norwegian energy and water infrastructure. Market research firm Klue was breached via a stale 2022 pilot credential, exposing cloud keys of ~200 customers including Jamf, HackerOne, and LastPass to extortion gang Icarus. Separately, tens of thousands of Instagram accounts were hijacked by abusing Meta's AI chatbot to trigger password resets to attacker-controlled emails.
50
AI-fueled attacks pose ‘active threat’ to water, other sectors, U.S. agencies warn
NSA, CISA, FBI, DOE and EPA warn hackers are using AI-generated scripts to actively attack Siemens S7 PLCs across critical-infrastructure sectors.
A joint cybersecurity advisory from the NSA, CISA, FBI, Department of Energy and EPA warns of an active threat campaign targeting water, food, energy, chemical, manufacturing and commercial facilities via Siemens S7 Series programmable logic controllers. The actors use internet scanning to find exposed or poorly protected PLCs, then deploy AI-generated exploitation scripts disguised as legitimate monitoring tools, an OT first that dramatically lowers the expertise required for ICS attacks. Siemens says no new S7 vulnerabilities are involved, only exploitation of misconfigurations, and it is coordinating with CISA's ProductCERT. The warning follows a joint FBI-EPA advisory confirming attacks at water and wastewater utilities in at least 12 states since July 27.
72
60
60
60
Week in review: Microsoft fixes exploited Office zero-day, Fortinet patches FortiCloud SSO flaw
60
⚡ Weekly Recap: WSUS Exploited, LockBit 5.0 Returns, Telegram Backdoor, F5 Breach Widens
60
Windows NTLM vulnerability exploited in multiple attack campaigns (CVE-2025-24054)
60
60
60
60
60
60
60
60
60
60