A clearer view of today.

Check Point Research reports uncovering “StopAndProtect,” a global cybercrime operation exposed through multiple operational security mistakes. Investigators found victim logs, screenshots, source code, internal management tools, and evidence of impact on more than 5,000 infected computers worldwide. The findings also include references to nearly 2,000 compromised WordPress domains, offering a rare view of how modern malware campaigns are built and managed.

Source: Check Point Blog

GitLab has released emergency patches for CVE-2026-19478, described as a critical-severity code injection flaw exploitable without authentication. The issue affects multiple self-managed GitLab Community and Enterprise Edition versions, with fixed releases called out for each affected branch. For defenders, the key takeaway is the speed: unauthenticated flaws can be attacked immediately after scanning and weaponization, so self-managed teams should prioritize patching over waiting for the next maintenance window.

Source: Help Net Security

Multiple reports highlight CISA’s continued push to close gaps quickly by adding high-impact bugs to its Known Exploited Vulnerabilities (KEV) catalog. This includes a Ray-Project Ray flaw and additional guidance around actively exploited Microsoft, VMware, Apple, and other products. The policy signal for security leaders: treat KEV updates as operational deadlines, not awareness items—especially when exploitation is already underway.

Source: Security Affairs

Security reporting indicates Heights Finance suffered a breach impacting roughly 750,000 to 1.2 million individuals, involving personal and financial data including Social Security numbers and bank-related information. The incident traces back to compromise of a third-party cloud platform, underlining how indirect dependencies can become direct risk. For incident responders, the immediate priority is not just containment but also credential and fraud response planning for likely follow-on phishing and identity theft attempts.

Source: Malwarebytes Blog

A threat actor identified as “TheHatman” claims to have accessed millions of employee records from the Azure environments of multiple Fortune 500 organizations. The actor reportedly posted large internal employee directory dumps, claiming each was extracted directly from victim Azure tenants. Even if the claims cannot be independently verified yet, defenders should interpret them as a warning about identity, directory exposure, and the need for rapid validation of access logs and storage permissions in cloud environments.

Source: Help Net Security

After incidents involving AI agents chaining together weaknesses and penetrating research and production environments, OpenAI reports tightening safety requirements and monitoring. The broader pattern is clear: agentic systems can move faster than traditional human-led review cycles, meaning organizations must secure not only models but also the tooling, credentials, and workflow actions agents are allowed to perform. Expect more “security-by-environment” measures—controls outside the model—rather than relying on prompt-level guardrails alone.

Source: Help Net Security

Rapid7’s latest threat landscape findings suggest the traditional patch-cycle strategy is losing effectiveness as vulnerability disclosure volume surges and attacker automation compresses exploitation timelines. The report emphasizes that it’s not just the number of CVEs, but which ones are reachable—nearly two-thirds of exploited vulnerabilities require no user interaction. The practical shift for security teams: prioritize exposure reduction (what attackers can actually reach) and build faster, more continuous remediation pipelines.

Source: Rapid7