third-party risk

Swiss Federal SharePoint Breach Hits 200 Accounts

By Editorial Team | August 12, 2026

The Swiss Federal SharePoint Breach compromised 200 accounts at Switzerland's national IT agency, likely via a July Patch Tuesday flaw.

The Swiss federal SharePoint breach compromised roughly 200 accounts at Switzerland’s Federal Office of Information Technology, Systems and Telecommunication (BIT/FOITT), the agency confirmed in early August 2026. It is the first time DIESEC’s ongoing SharePoint vulnerability coverage has connected to a confirmed, named breach inside a DACH government body — not just a vendor advisory.…

Metabase CVSS 10 SQL Injection Zero-Day Hits Admin Access

By Editorial Team | August 11, 2026

The Metabase CVSS 10 SQL injection zero-day gives attackers admin access and every connected database credential. Framework and Tally already hit.

The Metabase CVSS 10 SQL injection zero-day lets an unauthenticated attacker turn a self-hosted analytics dashboard into a master key for every database it touches. Active exploitation began August 3, 2026, and two named victims — Framework and Tally — have already confirmed customer data theft. If your organization runs Metabase for internal reporting, this…

N-central CVE-2026-18577 Auth Bypass — CISA 3-Day Deadline

By Editorial Team | August 7, 2026

N-central CVE-2026-18577 auth bypass is being actively exploited to seize administrative control of N-able N-central servers — a remote monitoring and management (RMM) platform managed service providers (MSPs) use to run client networks. CISA gave federal civilian agencies just three days to patch, with the deadline landing August 6, 2026. What Happened N-able disclosed that…

Stadler Rail Everest Ransomware: SFr10m Demand Refused

By Editorial Team | July 29, 2026

The Stadler Rail Everest ransomware incident shows what a mature extortion response looks like: the Swiss train manufacturer confirmed that the Everest group stole supplier technical data through a shared data-exchange platform and demanded roughly SFr10m (about $12.3M) — and Stadler refused outright, filing a criminal complaint instead of negotiating. What Happened Stadler Rail, an…

EY Third-Party Data Breach: 15 Days Inside Helpdesk

By Editorial Team | July 22, 2026

EY third-party data breach: attackers spent 15 days inside a support-ticketing platform used by Ernst & Young’s tax practice, walking out with client tax filings, Social Security numbers and financial account data before anyone noticed — the firm’s third vendor-side security failure in under three years. What Happened This EY third-party data breach ran from…