https://cyber.murati.net/ Cybersecurity news and analysis: vulnerabilities, threat intelligence, ransomware, AI and cloud security. en-us Sun, 19 Jul 2026 12:00:00 GMT https://cyber.murati.net/posts/records-are-made-to-be-broken-patch-tuesday-raises-triage-stakes https://cyber.murati.net/posts/records-are-made-to-be-broken-patch-tuesday-raises-triage-stakes Sun, 19 Jul 2026 12:00:00 GMT AI Security Microsoft's July 2026 Patch Tuesday shattered every previous record, delivering fixes for 622 unique CVEs — including three zero-days, two of them under active exploitation — and more than 60 critical https://cyber.murati.net/posts/microsoft-july-2026-patch-tuesday-fixes-massive-570-flaws-3-zero-days https://cyber.murati.net/posts/microsoft-july-2026-patch-tuesday-fixes-massive-570-flaws-3-zero-days Sun, 19 Jul 2026 12:00:00 GMT AI Security Microsoft has shipped its July 2026 Patch Tuesday updates, closing a record-setting 570 security flaws across its product line — the largest monthly batch the company has ever released. The rollup inc https://cyber.murati.net/posts/armored-likho-apt-targeting-government-electric-power-entities https://cyber.murati.net/posts/armored-likho-apt-targeting-government-electric-power-entities Sun, 12 Jul 2026 12:00:00 GMT Threat Intelligence Kaspersky has detailed a newly identified advanced persistent threat group it calls Armored Likho, which is running a mix of financially motivated and espionage operations against government bodies, e https://cyber.murati.net/posts/accenture-admits-to-isolated-matter-after-crook-tries-to-flog-alleged-35gb-haul https://cyber.murati.net/posts/accenture-admits-to-isolated-matter-after-crook-tries-to-flog-alleged-35gb-haul Sun, 12 Jul 2026 12:00:00 GMT Data Breach Accenture has acknowledged what it calls an "isolated matter" after a criminal advertised roughly 35GB of data allegedly lifted from the consulting firm's internal systems — a trove said to include so https://cyber.murati.net/posts/microsoft-patches-rogueplanet-defender-zero-day-vulnerability https://cyber.murati.net/posts/microsoft-patches-rogueplanet-defender-zero-day-vulnerability Sun, 12 Jul 2026 12:00:00 GMT Vulnerabilities Microsoft has shipped a fix for a Microsoft Defender zero-day dubbed "RoguePlanet," tracked as [CVE-2026-50656](https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-50656), which lets a loc https://cyber.murati.net/posts/agentic-ai-used-to-conduct-ransomware-attack-via-langflow https://cyber.murati.net/posts/agentic-ai-used-to-conduct-ransomware-attack-via-langflow Mon, 06 Jul 2026 12:00:00 GMT Ransomware Cloud security firm Sysdig has documented what it describes as the first fully agentic, AI-driven ransomware operation: a threat actor tracked as JadePuffer used a large language model to autonomously https://cyber.murati.net/posts/hackers-target-misconfigured-proxies-to-access-paid-llm-services https://cyber.murati.net/posts/hackers-target-misconfigured-proxies-to-access-paid-llm-services Mon, 06 Jul 2026 12:00:00 GMT AI Security Attackers are scanning the internet for badly configured proxy servers that expose access to commercial large language model (LLM) platforms, according to threat intelligence firm GreyNoise. Since lat https://cyber.murati.net/posts/dormant-iran-apt-is-still-alive-spying-on-dissidents https://cyber.murati.net/posts/dormant-iran-apt-is-still-alive-spying-on-dissidents Mon, 06 Jul 2026 12:00:00 GMT Data Breach Iran's oldest known state-aligned hacking crew — tracked as "Prince of Persia" or "Infy" — never actually disappeared. After roughly three years of public silence, SafeBreach researcher Tomer Bar repo https://cyber.murati.net/posts/anonymous-researcher-drops-0-day-exploitarium-repo https://cyber.murati.net/posts/anonymous-researcher-drops-0-day-exploitarium-repo Mon, 06 Jul 2026 12:00:00 GMT Cloud Security An anonymous researcher operating under the handle "bikini" published what they describe as working exploit code for zero-day flaws spanning 15 software products and open source projects, dropping the https://cyber.murati.net/posts/russias-gamaredon-upgrades-its-arsenal-requiring-new-defenses https://cyber.murati.net/posts/russias-gamaredon-upgrades-its-arsenal-requiring-new-defenses Sun, 28 Jun 2026 12:00:00 GMT Cloud Security Russia's long-running Gamaredon cyber-espionage group — also tracked as Aqua Blizzard, Armageddon, and BlueAlpha — has substantially modernized its toolkit and command-and-control (C2) practices, acco https://cyber.murati.net/posts/tata-electronics-confirms-cyberattack-as-hackers-leak-data https://cyber.murati.net/posts/tata-electronics-confirms-cyberattack-as-hackers-leak-data Sun, 28 Jun 2026 12:00:00 GMT Ransomware Tata Electronics, the semiconductor and electronics manufacturing arm of India's Tata Group, has confirmed it was hit by a cyberattack that affected portions of its IT infrastructure. The company says https://cyber.murati.net/posts/microsoft-uses-ai-to-link-two-malware-operations-in-racketeering-suit https://cyber.murati.net/posts/microsoft-uses-ai-to-link-two-malware-operations-in-racketeering-suit Sun, 28 Jun 2026 12:00:00 GMT Ransomware Microsoft, working alongside international law enforcement and several security firms, has dismantled the infrastructure behind two prolific information-stealing and loader malware families, StealC an https://cyber.murati.net/posts/europe-evolves-into-ransomwares-favorite-region https://cyber.murati.net/posts/europe-evolves-into-ransomwares-favorite-region Sun, 28 Jun 2026 12:00:00 GMT Ransomware Ransomware operators are increasingly turning their attention to Europe. Security firm Black Kite logged 684 ransomware attacks across the continent in the first four months of 2026 — a 55% jump over https://cyber.murati.net/posts/microsoft-working-on-defender-patch-for-rogueplanet-zero-day https://cyber.murati.net/posts/microsoft-working-on-defender-patch-for-rogueplanet-zero-day Sun, 28 Jun 2026 12:00:00 GMT Cloud Security Microsoft has acknowledged a zero-day elevation-of-privilege flaw in Microsoft Defender, publicly nicknamed "RoguePlanet," and says it is building a security update to fix it. Now tracked as CVE-2026- https://cyber.murati.net/posts/microsoft-defender-rogueplanet-zero-day-grants-system-privileges https://cyber.murati.net/posts/microsoft-defender-rogueplanet-zero-day-grants-system-privileges Sun, 28 Jun 2026 12:00:00 GMT Cloud Security A researcher operating under the handle Nightmare Eclipse has published a proof-of-concept exploit dubbed "RoguePlanet" that abuses a race condition in Microsoft Defender to launch a SYSTEM-level comm https://cyber.murati.net/posts/6-year-ransomware-campaign-targets-turkish-homes-smbs https://cyber.murati.net/posts/6-year-ransomware-campaign-targets-turkish-homes-smbs Mon, 15 Jun 2026 12:00:00 GMT Ransomware A newly published report from Acronis describes a ransomware operation that has likely been running since at least 2020, targeting home users and small or medium-sized businesses (SMBs) across Turkey. https://cyber.murati.net/posts/servicenow-discloses-security-incident-exposing-customer-data https://cyber.murati.net/posts/servicenow-discloses-security-incident-exposing-customer-data Mon, 15 Jun 2026 12:00:00 GMT Vulnerabilities ServiceNow has notified customers of a security incident in which a flaw in a vulnerable API endpoint allowed unauthenticated access to data inside hosted customer instances. The company says it pushe https://cyber.murati.net/posts/microsoft-patches-exchange-server-zero-day-exploited-in-attacks https://cyber.murati.net/posts/microsoft-patches-exchange-server-zero-day-exploited-in-attacks Mon, 15 Jun 2026 12:00:00 GMT Ransomware Microsoft has shipped a fix for an actively exploited Exchange Server flaw that lets attackers run arbitrary JavaScript in the browsers of Outlook Web Access users. Tracked as CVE-2026-42897, the high https://cyber.murati.net/posts/max-severity-ivanti-sentry-flaw-exploited-within-24-hours https://cyber.murati.net/posts/max-severity-ivanti-sentry-flaw-exploited-within-24-hours Mon, 15 Jun 2026 12:00:00 GMT Vulnerabilities A maximum-severity flaw in Ivanti Sentry was being exploited in the wild within a day of becoming public, with attackers leaning on a freely available proof-of-concept to break in. Tracked as CVE-2026 https://cyber.murati.net/posts/google-confirms-exploitation-of-oracle-peoplesoft-zero-day-by-shinyhunters https://cyber.murati.net/posts/google-confirms-exploitation-of-oracle-peoplesoft-zero-day-by-shinyhunters Mon, 15 Jun 2026 12:00:00 GMT Data Breach Google says a critical flaw in Oracle's PeopleSoft software has been exploited as a zero-day by the cybercrime group ShinyHunters to steal data from organizations, with the education sector bearing th