At least 274 internet-facing Zimbra server instances have been compromised through CVE-2026-73570 exploitation, according to the Shadowserver Foundation. The week also saw attackers actively exploiting a previously patched Citrix NetScaler vulnerability, while security researchers highlighted emerging AI supply chain risks appearing in developer workflows.
Read full article at Help Net Security ↗Hasbro experienced a cyberattack earlier this year that disrupted operations and has now resulted in a data breach disclosure. The breach exposed personal information belonging to company employees.
Berlin's state government has refused to pay extortionists following an August breach of its administrative network, confirming the city as a target of an extortion attempt. Forensic investigations uncovered additional data exfiltration beyond the initial compromise, specifically affecting the Senate Department for Mobility, Transport, Climate Protection and Environment.
Love Electric, a UK broker managing electric-vehicle salary sacrifice schemes, has allegedly suffered a data breach exposing 877,000 driver records now being offered for sale at $600 on a data-breach forum. The incident underscores identity risks inherent in third-party salary sacrifice providers that handle sensitive personal information as part of employee benefit programs. The breach was first advertised by the seller on August 26 on an English-language forum.
A critical ownCloud vulnerability (CVE-2023-49105) has been added to CISA's Known Exploited Vulnerabilities catalog after a Chinese-speaking threat actor exploited it to breach a Philippine nuclear research organization. The flaw carries a CVSS score of 9.8, indicating severe risk, and is actively being weaponized in the wild. Organizations using ownCloud should prioritize patching this vulnerability immediately.