Archive for July 2026
EY Third-Party Data Breach: 15 Days Inside Helpdesk
EY third-party data breach: attackers spent 15 days inside a support-ticketing platform used by Ernst & Young’s tax practice, walking out with client tax filings, Social Security numbers and financial account data before anyone noticed — the firm’s third vendor-side security failure in under three years. What Happened This EY third-party data breach ran from…
Read MoreWhy Endpoint Protection Isn’t Enough for Modern Small Businesses
Endpoint protection is where most small businesses start their cybersecurity journey — install antivirus or EDR software on every employee laptop, and assume the job is done. After all, if every device is covered, what else is there to protect? The problem is that much of today’s business activity no longer happens solely on those…
Read MoreServiceNow CVE-2026-6875 RCE: Sandbox Escape Exploited
ServiceNow CVE-2026-6875 RCE is now being actively exploited: a critical, unauthenticated sandbox-escape vulnerability in the ServiceNow AI Platform is under attack barely a week after the vendor shipped a fix, and ServiceNow’s own advisory has not yet caught up with independent confirmation of the exploitation. What Happened ServiceNow CVE-2026-6875 RCE traces back to a sandbox-escape…
Read MoreAsyncAPI npm Supply Chain Attack: No Token Stolen
The AsyncAPI npm supply chain attack shows that neither of the two controls teams were told to trust — cryptographic provenance and blocking install scripts — actually stopped it: an attacker published four trojanized packages with valid SLSA/OIDC provenance attestations, without ever stealing an npm token, and the payload runs regardless of –ignore-scripts. What Happened…
Read MoreOracle E-Business Suite CVE-2026-46817 Actively Exploited
Oracle E-Business Suite CVE-2026-46817, a critical flaw, is under active exploitation: an unauthenticated attacker with nothing more than HTTP access can take over Oracle Payments — the module that executes your payment runs. CISA added the flaw to its Known Exploited Vulnerabilities catalog on July 15 and gave US federal agencies three days to fix…
Read More