Rubric
News
Page@news
Reporting on attacks, breaches and security fixes.
Browser securityChrome has been updated on Windows to version 155.0.8059.39/.40, and Google says the release includes 247 security fixes. The update rolls out over the coming days and weeks. Windows users should update Chrome as soon as it appears, since Google says access to bug details may stay restricted until most users are protected.
Exploited flawsThe Register reports that Microsoft is adding .msix and .msixbundle to Outlook’s block list. New Outlook for Windows and Outlook on the Web in Exchange Online will stop users from downloading or opening those attachments by default, because a malicious package could compromise a device. Administrators who need them can allow the file types before the rollout in early to mid-November 2026.
Malware newsThe Hacker News reports that a new ClickFix attack is using compromised websites to trick Windows users into running a malicious payload cached in the browser. The attack hides a script in browser cache, then uses it to fetch more payloads and target browser and device credentials. Windows users should avoid copying and running commands from unexpected sites or pop-ups, and be cautious of fake error, CAPTCHA, or browser update prompts.
Data breachesThe Record reports that Ukraine’s largest grocery store chain, ATB, confirmed a cyberattack after hackers posted an extortion demand on its website and claimed they had stolen data from millions of customers. The hackers said the data included names, phone numbers, email and physical addresses, password hashes, and employees’ passport information. People who shopped there should watch for phishing, change reused passwords, and monitor accounts for suspicious activity.
Exploited flawsThe Hacker News reports that attackers are trying to exploit a now-patched critical flaw in the Realtek Jungle SDK to deploy the Cling botnet. The malware targets routers and DVRs from multiple vendors, so home users and small offices should make sure their router or device firmware is fully updated and check vendor security advisories for fixes.
Malware newsThe Hacker News reports that attackers are actively trying to exploit a critical flaw in Rejetto HTTP File Server. The bug can let a remote attacker forge an administrator session cookie and reach remote code execution, and a patch was released in version 3.2.1. Windows users running Rejetto HFS should update right away and avoid exposing unpatched systems to the internet.
Data breachesDataBreaches.net reports that the Slate Valley Unified School District in Vermont is responding to a security incident and has refused to pay a ransom demand. Kairos says it has 762 GB of data, including SQL databases with personal and medical information about students and employees. People connected to the district should watch for account and identity misuse and follow any district notices.Exploited flawsThe Register reports that exploitation attempts have already been seen against a critical authentication-bypass bug in Rejetto HTTP File Server that can lead to full admin access and remote code execution. If you use Rejetto HFS, update to v3.2.1 or later, which fixes this and other security flaws.
Data breachesDataBreaches.net reports that Italy’s Data Protection Authority fined IQVIA €7 million after finding that a database of health information on one million patients was not anonymous. The authority said the data could be re-identified, and that the company processed health data without a proper legal basis, did not inform patients adequately, and failed to take adequate security measures. People affected should watch their accounts and be careful with any health-related information tied to them.Malware newsThe Hacker News reports that the suspected China-linked group Warlock is still exploiting Microsoft SharePoint vulnerabilities to target organizations in Portuguese- and Spanish-speaking countries. The attacks have hit critical infrastructure, government, and education organizations, so Windows users and small offices running SharePoint should patch and mitigate exposed servers and check for signs of web shells, disabled security tools, or unusual remote connections.
Data breachesDataBreaches.net reports that Italy’s data protection authority fined IQVIA €7 million after finding it had built a database with health information on one million patients from 800 family doctors. The regulator said the data was not anonymous and included identifying details for over 3,300 patients. People affected should watch for any notices about the breach and be careful with accounts tied to their medical information.Loading…
No more articles
Could not load, try again