Today's cybersecurity headlines reveal critical updates on new vulnerabilities, widespread data breaches, and the ongoing evolution of ransomware and AI-driven threats. We also see significant policy developments as governments and tech giants strive to enhance digital security.
Microsoft Patches RoguePlanet Defender VulnerabilityVulnerability
Microsoft has released a patch for the 'RoguePlanet' vulnerability (CVE-2026-50656) in its Malware Protection Engine. This privilege escalation flaw could allow attackers to gain SYSTEM privileges on affected Windows systems.
Why it matters: Keeping your operating system and security software up to date is crucial to protect your business from attackers seeking to exploit known flaws for system control.
Read more at The Hacker News ↗
New 'GhostLock' Linux Kernel Vulnerability DiscoveredVulnerability
A 15-year-old vulnerability dubbed 'GhostLock' has been found in the Linux kernel, affecting all major distributions since 2011. This flaw could allow attackers to achieve root access on compromised systems.
Why it matters: If your website or services run on Linux servers, ensure they are promptly patched to prevent unauthorized root access, which can lead to complete system compromise.
AI Coding Tools Vulnerable to 'GhostApproval' Symlink AttacksVulnerability
Researchers have uncovered 'GhostApproval' symlink flaws in several popular AI coding assistants, including Amazon Q Developer and Google Antigravity. These vulnerabilities could allow malicious code projects to take control of a developer's machine.
Why it matters: Be cautious when using AI coding tools with untrusted code, as these vulnerabilities could lead to your development environment being compromised.
Read more at The Hacker News ↗
AssuranceAmerica Data Breach Exposes 6.9 Million Drivers' RecordsBreach
American insurance provider AssuranceAmerica has reported a data breach impacting nearly 7 million drivers. Attackers accessed the company's systems earlier this year, compromising customer records.
Why it matters: Even if your business isn't directly targeted, your customers' data could be exposed through third-party services you rely on, highlighting the importance of robust vendor security.
Read more at BleepingComputer ↗
Japanese Telco KDDI Suffers Breach Affecting 12 MillionBreach
Japanese telecommunications company KDDI experienced a data breach impacting 12 million customers. The incident resulted from attackers exploiting a zero-day vulnerability in a third-party email system used for ISPs.
Why it matters: Supply chain attacks are a significant risk; evaluate the security of all third-party services and software that interact with your business data.
'GodDamn' Ransomware Uses Signed Kernel Driver to Disable DefensesRansomware
A new ransomware variant, 'GodDamn,' a rebrand of Beast ransomware, has been observed using the PoisonX kernel driver to neutralize security software. This driver was reportedly signed by Microsoft, enabling it to bypass defenses.
Why it matters: Ransomware threats continue to evolve with sophisticated evasion tactics. Implement robust endpoint detection and response (EDR) and regularly back up your data to minimize impact.
Read more at The Hacker News ↗
New GigaWiper Backdoor Combines Wiping, Fake Ransomware, and SpywareThreat
Microsoft has analyzed 'GigaWiper,' a destructive Windows backdoor that bundles disk wiping, fake ransomware, and spyware capabilities. This modular malware allows operators to choose different destructive actions for compromised systems.
Why it matters: Advanced persistent threats often use multi-stage tools; strong network segmentation and continuous monitoring are vital to detect and contain such sophisticated attacks.
Read more at The Hacker News ↗
Attackers Leverage Dormant GitHub Accounts for Corporate ReconnaissanceThreat
Datadog Security Labs warns of campaigns using old or compromised 'ghost' GitHub accounts and OAuth tokens to systematically map corporate GitHub organizations, repositories, and user accounts via the API.
Why it matters: Ensure all GitHub accounts associated with your organization are secured with multi-factor authentication (MFA) and regularly review access permissions for dormant or inactive accounts.
Read more at The Hacker News ↗
npm 12 Disables Install Scripts by Default to Enhance Supply Chain SecurityPolicy
GitHub has released npm version 12, which now disables install scripts by default, making their execution opt-in. This significant change aims to reduce supply chain risks inherent in package dependencies.
Why it matters: For small businesses developing software or websites, this change reduces the risk of malicious code being executed automatically during package installation, improving software supply chain security.
Read more at The Hacker News ↗
EU Sues Member States for Failing to Implement NIS2 Cybersecurity LawPolicy
The European Union has initiated legal action against Ireland, Spain, France, and the Netherlands for their significant delays in transposing the NIS2 Directive. This directive aims to bolster the cybersecurity of critical infrastructure across member states.
Why it matters: Businesses operating within the EU, especially those in critical sectors, must understand and prepare for the requirements of NIS2, as enforcement will likely intensify.
This round-up is compiled and summarised in our own words from public reporting; follow the links above for full details at the original sources.