
Australian fixed‑income firm FIIG Securities was hit with a AU$2.5 million civil penalty after the Federal Court found it failed to protect client data for over four years. A 2023 ransomware attack exfiltrated roughly 385 GB of personal and financial information belonging to about 18,000 clients. The court also ordered a AU$500,000 contribution to ASIC’s enforcement costs and mandated a compliance program overseen by an independent cyber‑risk expert. This marks the first time a civil fine has been imposed for cybersecurity breaches under an Australian Financial Services licence.

The European Union Agency for Cybersecurity (ENISA) has published an updated International Strategy aimed at reinforcing the EU’s cyber‑defence ecosystem through selective global cooperation. The revision aligns partnerships with the EU’s policy objectives, highlighting collaborations with Ukraine, the United States,...

Senegal’s Directorate of File Automation (DAF) confirmed a cyberattack that forced a shutdown of national ID card, passport and biometric services. Ransomware group The Green Blood Group claims to have exfiltrated 139 TB of citizen records and posted samples on the...

The UAE Cyber Security Council warned that roughly 60% of financial cyberattacks begin with stolen usernames and passwords. As digital banking expands, compromised credentials have become the primary gateway for fraud, identity theft, and unauthorized access to sensitive financial data....

Singapore launched its largest coordinated cyber‑defense effort, Operation Cyber Guardian, after the UNC3886 advanced threat actor targeted all four major telcos—M1, Singtel, StarHub and Simba. More than 100 cyber defenders from six government agencies worked with the operators to contain...

OpenAI announced Trusted Access for Cyber, a program that provides vetted defenders with controlled access to its most advanced cybersecurity model, GPT‑5.3‑Codex, via ChatGPT. The initiative pairs this privileged access with $10 million in API‑credit grants to support defensive research and...

Substack announced that a security breach exposed subscriber email addresses, phone numbers and internal metadata after attackers accessed the data in October 2025. The intrusion went undetected until February 2026, giving threat actors a four‑month dwell time. The company confirmed...

The FDA reissued its final medical‑device cybersecurity guidance on February 4, updating references to reflect the new Quality System Management Regulation (QMSR) that took effect on February 2. The revision aligns the guidance with ISO 13485:2016, embedding the international standard into the U.S....

Mountain View police chief Mike Canfield ordered an immediate shutdown of the city’s Flock Safety automated license‑plate reader (ALPR) system after discovering that hundreds of unauthorized law‑enforcement agencies had been able to query the data for more than a year....

On Jan 29, 2026, Lakelands Public Health confirmed a cyberattack that disrupted internal systems but left sensitive health records untouched. The agency activated its incident‑response plan, isolated affected assets, and hired a leading cybersecurity firm to investigate and restore services....

Foxit Software released security updates on February 3 2026 that remediate two moderate‑severity cross‑site scripting (XSS) vulnerabilities (CVE‑2026‑1591, CVE‑2026‑1592) in Foxit PDF Editor Cloud, and a related XSS flaw (CVE‑2025‑66523) in Foxit eSign patched on January 15 2026. The flaws allowed crafted file attachment...

Cyble and The Cyber Express are hosting a free Zoom webinar on Feb 24, 2026 titled “AI, Ransomware & Hacktivism: The Cyber Risk Shift Most Leaders Are Failing to See.” The session will be led by Lt Gen (Dr) Rajesh...

A ransomware group breached the servers of secondary school Onze‑Lieve‑Vrouwinstituut Pulhof in Berchem, forcing a shutdown of internal systems. The school refused to pay the initial ransom and the attackers escalated by demanding €50 per child from parents, threatening to...

Britain and Japan announced a new cyber strategic partnership during Prime Minister Keir Starmer's Tokyo visit, following his stop in Beijing. The agreement pairs cybersecurity cooperation with joint efforts to secure critical mineral supply chains essential for advanced manufacturing and...

Ad fraud is escalating into a systemic threat that undermines the digital economy’s trust. In 2024 mobile ad fraud rose 21% and programmatic scams siphoned nearly $50 billion, while the ad‑fraud detection market is set to exceed $2 billion by 2034. Dhiraj...

Cyble Research & Intelligence Labs uncovered ShadowHS, a Linux post‑exploitation framework that operates entirely in memory. The tool leverages a weaponized version of hackshell with an AES‑256‑CBC encrypted loader, enabling fileless execution via /proc//fd/. ShadowHS provides an operator‑controlled environment for...

A coordinated cyber‑attack wave hit Bumble, Panera Bread, Match Group and CrunchBase, with the hacker group ShinyHunters claiming responsibility. The intrusions stemmed from phishing and vishing tactics that compromised contractor or employee credentials, granting brief, limited access to internal networks....

The American Hospital Association unveiled two new guides—Strategies for Medical Surge Management During Public Emergencies and Strategies for Cyber Preparedness in Health Care—to help hospitals navigate both public health crises and cyber threats. Both resources adopt the “four S’s” framework—staffing,...

A Nebraska federal grand jury has indicted a total of 87 defendants in a sprawling ATM jackpotting conspiracy tied to the Venezuelan gang Tren de Aragua. The scheme used a variant of the Ploutus malware to hack ATMs nationwide, stealing...

A critical insecure‑deserialization flaw in React Server Components, identified as CVE‑2025‑55182 or “React2Shell,” is being actively exploited worldwide. The vulnerability affects react‑server‑dom‑webpack, –parcel and –turbopack versions 19.0‑19.2, allowing attackers to execute arbitrary code and deploy a range of malware, including...

Russian security firm Delta suffered a large‑scale external cyberattack on Jan 26, crippling its alarm, home, and vehicle security platforms. The breach disabled online services, phone lines, and the mobile app, leaving thousands of customers unable to control alarms or unlock...

Canada’s Privacy Commissioner Philippe Dufresne launched Data Privacy Week 2026 (Jan 26‑30) with a focus on privacy‑by‑design, urging organizations to embed data protection from the outset. He highlighted recent high‑profile breaches—including Aylo, 23andMe, TikTok, and an investigation into X’s Grok chatbot—to...

The CyberExpress article argues that the traditional network perimeter is no longer sufficient for data privacy, and that the true protection now lies at the moment of access. It highlights the rise of the “Identity‑Data Gap” and the shift toward...

ShinyHunters has resurfaced with an onion‑based data leak site, claiming breaches of SoundCloud, Betterment and Crunchbase tied to a new vishing campaign targeting SSO credentials at Okta, Microsoft and Google. The group warns that more victims will follow. In parallel,...

Manage My Health, a New Zealand digital health portal, confirmed a breach that accessed documents in its My Health Documents feature, affecting over 120,000 patients. While live clinical systems remained untouched, fraudsters are now impersonating the service to send phishing and...

A Vodafone Business survey of 1,000 UK senior leaders reveals that one in ten believe their company would not survive a major cyberattack. While 63% say the risk of attack has risen over the past year, only 45% have ensured...

Google Chrome’s built‑in password manager offers convenience but accumulates credentials across devices, creating a hidden security liability. The article details how to delete individual, multiple, or all saved passwords on desktop, Android, and iOS, and explains how Chrome sync propagates...

Threat hunting is shifting from reactive incident response to proactive, pattern‑based defense as attackers repeatedly exploit known vulnerabilities. Experts at Qualys argue that focusing on adversary telemetry—such as weaponization, ransomware links, and dark‑web chatter—enables teams to anticipate exploitation cycles. Automation...

The Anchorage Police Department (APD) disclosed a cybersecurity incident on Jan 7, 2026 involving its third‑party data‑migration vendor, Whitebox Technologies. APD reported no evidence that its systems or data were compromised and immediately shut down affected servers while revoking vendor access....

California Privacy Protection Agency appointed Nicole Ozer to its board, reinforcing the state’s privacy agenda. Ozer, former ACLU tech director and executive at UC Law San Francisco, brings extensive experience in privacy law, AI, and digital civil liberties. Her appointment...

The Domain Name System (DNS) remains a critical yet vulnerable internet backbone, with 88% of organizations reporting at least one DNS attack in 2023. Attacks such as hijacking, cache poisoning, and DDoS floods can redirect users, cause service outages, and...

Kyowon Group disclosed a cyberattack that began on the morning of Jan 10, prompting the company to isolate affected systems and shut down parts of its internal network. The breach forced the main website and several affiliate sites offline, with service...

The first week of 2026 saw a wave of cyber incidents spanning education, activism, corporate, and government sectors. Higham Lane School in England shut down after ransomware crippled systems for 1,500 students, while Australian insurer Prosura faced unauthorized access exposing...

CISA has added two high‑severity flaws to its 2026 Known Exploited Vulnerabilities (KEV) catalog: CVE‑2025‑37164, a code‑injection bug in Hewlett Packard Enterprise OneView rated 10.0, and CVE‑2009‑0556, a 9.3‑severity remote‑code‑execution issue in legacy Microsoft PowerPoint 2000‑2004. Rapid7 published a proof‑of‑concept...

President Donald Trump signed a memorandum ordering the United States to withdraw immediately from three major cyber‑security coalitions: the European Centre of Excellence for Countering Hybrid Threats, the Global Forum on Cyber Expertise, and the Freedom Online Coalition. The exits...

Australian insurer Prosura confirmed a cyber incident on Jan 3, 2026 after detecting unauthorized access to internal systems. The breach led the company to temporarily disable its self‑service portal, halting online policy purchases, claims and account management. Fraudulent phishing emails were sent...

On Jan 6 2026, CERT/CC disclosed CVE‑2025‑65606 affecting the TOTOLINK EX200 range extender. An authenticated attacker can upload a malformed firmware file that forces the device into an error state, automatically launching an unauthenticated root‑level telnet service. The telnet console provides full...

At the Chaos Communication Congress in Hamburg, hacktivist Martha Root publicly deleted three white‑supremacist sites—WhiteDate, WhiteChild and WhiteDeal—while the audience cheered. The live takedown was accompanied by the release of data on more than 6,000 users from the dating platform,...

A proxy server acts as an intermediary between client devices and the Internet, forwarding requests, filtering data, and returning responses. The guide distinguishes forward proxies, which protect users by masking IPs, enforcing policies, caching content, and inspecting traffic, from reverse...

A critical vulnerability (CVE‑2025‑68668) in n8n’s Python Code Node lets authenticated users bypass the sandbox and execute arbitrary system commands. The flaw affects all n8n versions from 1.0.0 up to, but not including, 2.0.0 and carries a CVSS score of...