#weeklyreport — Public Fediverse posts

State of (in)security - Week 33, 2026

During week 33 of 2026 (Aug. 10–17), there were 9 advisory/vulnerability events and 42 incidents affecting roughly 39.5 million people, a sharp rise from the prior week. Unauthorized access, ransomware/malware, and third-party compromises were leading causes, and healthcare, government, and IT hit hardest. Major items included Poland's medical data breach affecting 19 million citizens, actively exploited flaws in Magento, VMware vCenter, SharePoint, GeoServer and SAP, and large patch releases from Microsoft (421 fixes), SAP, Siemens, Adobe and Zoom.

**Update your Mac and Zoom today, both have flaws attackers are already using to take over machines with no password and no clicks from you. If you run servers, patch anything internet-facing first: vCenter, SharePoint, Adobe Commerce/Magento, and SAP Commerce Cloud are all under active attack right now. Then push the regular Windows update.**
#cybersecurity #infosec #knowledge #weeklyreport
https://beyondmachines.net/event_details/state-of-in-security-week-33-2026-v-m-1-n-l/gD2P6Ple2L

State of (in)security - Week 32, 2026

During week 32 of 2026 (Aug. 3–10), the security landscape saw 13 advisories/vulnerabilities and 28 incidents. Advisories are down but incidents are up week over wee. Known impacted individuals jump from ~207,000 to over 1.2 million, the largest incident is the SplitVPN breach at 865,336 records. Third-party compromise was the leading cause (8 incidents), healthcare and government were the hardest-hit sectors. Attack activity included actively exploited flaws in IBM Langflow, Apache Tomcat, JetBrains TeamCity, Metabase, and N-able N-central, plus the Shai-Hulud npm supply chain attack.

**Several of this week's advisories share a pattern worth remembering: the vendor fix stops future exploitation but leaves anything already stolen fully valid. If an affected system was internet-reachable before you patched, treat the patch as step one and credential rotation as step two: keys, tokens, API credentials, and service accounts the host could reach. For systems where malware has reached the system, rotating keys is not enough. Wipe those devices.**
#cybersecurity #infosec #knowledge #weeklyreport
https://beyondmachines.net/event_details/state-of-in-security-week-32-2026-r-a-6-s-x/gD2P6Ple2L

State of (in)security - Week 31, 2026

Week 31 of 2026 saw 16 advisory/vulnerability events and 22 incidents. Advisories more than doubled week-over-week and incidents fell. Known impacted individuals dropped sharply to roughly 207,000 (largest: the Tribeca Film Festival misconfiguration exposing 163,171 people). Unauthorized access, ransomware, and social engineering drove most breaches together with actively exploited zero-days in Arista VeloCloud, Fortinet FortiOS SSL-VPN, Cisco Secure Firewall Management Center, and JFrog Artifactory.

**Patch everything you self-host right now, starting with the ones already under active attack (Cisco FMC, Fortinet, Rails, GitLab, TeamCity, vBulletin, Adobe Campaign) and your Apple devices and Chrome. Keep admin interfaces off the public internet, and where a breach may already have happened: VeloCloud, Rails, Ruflo. Rotate every credential and key afterward.**
#cybersecurity #infosec #knowledge #weeklyreport
https://beyondmachines.net/event_details/state-of-in-security-week-31-2026-a-i-x-5-d/gD2P6Ple2L

State of (in)security - Week 30, 2026

During week 30 of 2026, cybersecurity monitoring recorded 7 advisories and 28 incidents/breaches affecting roughly 80 million individuals. The largest breach is Suno exposing 55.3 million users and AI training source code. Malware/ransomware and unauthorized access are the leading causes of incidents and healthcare and IT/software as the most-targeted industries.

**Patch the actively exploited on-premises SharePoint (CVE-2026-50522), self-hosted ServiceNow, Fastjson 1.x Java apps, Oracle systems (July 2026 Critical Patch Update), and WordPress. Then update Firefox and Thunderbird and confirm your Adobe Acrobat Chrome extension is running version 26.5.2.3 or later.**
#cybersecurity #infosec #knowledge #weeklyreport
https://beyondmachines.net/event_details/state-of-in-security-week-30-2026-w-0-e-b-i/gD2P6Ple2L

State of (in)security - Week 29, 2026

During the week of July 13–20, 2026, there were 21 security advisories (including actively exploited flaws in SharePoint, Fortinet, and SonicWall, plus Microsoft's record 570-vulnerability Patch Tuesday) and 31 incidents affecting roughly 977,000 individuals. Unauthorized access is the leading cause and healthcare by far the hardest-hit industry.

**Patch these right away: Microsoft (Windows, Office, and on-premise SharePoint Server), Chrome and other Chromium browsers, Firefox, FortiSandbox, SonicWall SMA1000, self-hosted ServiceNow, Splunk Enterprise, and WordPress core. These are either actively exploited or have public exploit code. Also remove or block the vulnerable miniOrange WordPress plugin and the risky VS Code extensions (Live Server, Code Runner, Markdown Preview Enhanced), since those have no patches available yet.**
#cybersecurity #infosec #knowledge #weeklyreport
https://beyondmachines.net/event_details/state-of-in-security-week-29-2026-s-u-m-0-m/gD2P6Ple2L

State of (in)security - Week 28, 2026

Week 28 of 2026 saw 17 security advisories and 26 incidents (down from 28 the prior week), with roughly 2.7 million individuals impacted. The largest breach is Moody Bible Institute's exposure of 2.3 million records via a PeopleSoft zero-day. Ransomware/malware and unauthorized access were the leading causes (7 incidents each), healthcare was the hardest-hit industry, and several actively exploited flaws were reported in products including Adobe ColdFusion, Gitea, Joomla extensions, and Langflow.

**Make sure to update your Joomla and plugins. They are under heavy attack!**
#cybersecurity #infosec #knowledge #weeklyreport
https://beyondmachines.net/event_details/state-of-in-security-week-28-2026-p-s-9-s-y/gD2P6Ple2L

State of (in)security - Week 27, 2026

During week 27 of 2026 (June 29–July 6), cybersecurity activity rose to 17 advisories and 28 incidents affecting roughly 6.6 million people, led by the 4.38 million-record Aflac Japan breach. Unauthorized access, ransomware, and software-vulnerability exploits drive most incidents. Most impacted industries are healthcare, government, and financ. The week saw reports of exploitation of critical flaws in Oracle E-Business Suite, SharePoint, and SimpleHelp RMM, and mass patches from Adobe, Apple, Google, and others. We also see the first reported end-to-end ransomware attack executed by an AI agent (JadePuffer).

**Patch your Chrome and Chromium based browsers. Iit's trivial to do: the browser updates itself when you close and reopen it, and all your tabs come back. Then focus on patching key flaws in phpBB, WebSphere, JetBrains, OpenWrt routers, Kemp LoadMaster.**
#cybersecurity #infosec #knowledge #weeklyreport
https://beyondmachines.net/event_details/state-of-in-security-week-27-2026-u-v-8-z-8/gD2P6Ple2L

State of (in)security - Week 26, 2026

During week 26 of 2026, security teams tracked 12 advisories (including five active exploits affecting Cisco, Ubiquiti, Lantronix, PTC Windchill, and a WordPress SMTP plugin) and 20 incidents. Breaches affect roughly 16 million individuals, driven largely by KDDI's potential leak of 14 million email credentials. The incidents skew heavily toward healthcare and were caused mainly by software vulnerability exploits, malware/ransomware, phishing, and third-party/supply-chain compromises (e.g., LastPass, Polymarket, Tata Electronics).

**This week's lesson is publicly accessible services. Gravity SMTP plugin for WordPress, Webmin and self hosted mail server on Synology all have critical issues. Flaws won't stop appearing, just make sure to follow them regularly.**
#cybersecurity #infosec #knowledge #weeklyreport
https://beyondmachines.net/event_details/state-of-in-security-week-26-2026-p-v-u-2-0/gD2P6Ple2L

State of (in)security - Week 25, 2026

During week 25 of 2026, there were 13 advisory/vulnerability events (including actively exploited zero-days in Cisco Catalyst SD-WAN Manager, Fortinet FortiSandbox, and Oracle PeopleSoft) and 20 incidents affecting roughly 3 million individuals. The largest being the Texas Parks and Wildlife breach (3.09M records via a third-party vendor). Incidents were driven mainly by malware/ransomware (6), third-party compromise (4), and unauthorized access (4), hitting healthcare, IT/software, and government sectors hardest.

**Be VERY careful of unexpected emails that appear to come from services like DocuSign, SharePoint, OneDrive, or Adobe, asking you to enter a code on Microsoft's real sign-in page (microsoft.com/devicelogin). Never enter a code you didn't personally request. If you do, this can silently hand attackers full access to your Microsoft 365 account without ever needing your password or MFA.**
#cybersecurity #infosec #knowledge #weeklyreport
https://beyondmachines.net/event_details/state-of-in-security-week-25-2026-p-5-6-i-y/gD2P6Ple2L

State of (in)security - Week 24, 2026

During week 24 of 2026, there were 20 advisory/vulnerability events (including actively exploited zero-days in Check Point VPN, Langflow, Ivanti Sentry, Google Chrome, and Microsoft Defender, plus critical flaws patched by Microsoft, SAP, Fortinet, Veeam, and others) and 18 incidents affecting over 11.6 million individuals. The largest incident was a Kyushu Electric Power subsidiary breach exposing 10.9 million customer records. Incidents were driven mainly by malware/ransomware and third-party compromises, hitting education and healthcare hardest, with notable breaches at Novo Nordisk, Lincoln Financial, Oracle PeopleSoft (ShinyHunters), and multiple NHS trusts via the Synnovis ransomware attack.

**This week prioritize Microsoft and Oracle products. Oracle has an actively exploited flaw that has been used to compromise multiple organizations.**
#cybersecurity #infosec #knowledge #weeklyreport
https://beyondmachines.net/event_details/state-of-in-security-week-24-2026-m-2-x-c-8/gD2P6Ple2L

State of (in)security - Week 23, 2026

During the week of June 1–8, 2026, there were 15 advisories and 30 incidents (both up week-over-week), affecting roughly 4.8 million individuals, led by the 2.6 million-record DentaQuest breach. Most incidents were caused by malware/ransomware (9), software vulnerabilities (6), and unauthorized access (5), concentrated in the IT/technology and healthcare sectors. Notable threats included multiple actively exploited zero-days and critical RCE flaws (Cisco, Oracle WebLogic, VS Code, Windows Netlogon, and Android). Major ransomware and supply-chain breaches affect healthcare, hospitality, and financial organizations.

**Apply Oracle's July 2024 Critical Patch Update (and all subsequent patches) to your WebLogic Server installations right away, as attackers are actively exploiting this flaw. In the meantime, restrict or disable access to the T3 and IIOP protocols. If the server does not serve public content for external visitors, make sure WebLogic servers are only reachable from trusted internal networks, not the open internet.**
#cybersecurity #infosec #knowledge #weeklyreport
https://beyondmachines.net/event_details/state-of-in-security-week-23-2026-i-o-g-z-h/gD2P6Ple2L

State of (in)security - Week 22, 2026

During week 22 of 2026, we recorded 10 advisory/vulnerability events and 14 incident/breach events (both down week-over-week). Breaches affect roughly 8.2 million individuals, driven largely by a 7.5 million-person Carnival Corporation breach from a social engineering attack. Key threats span active exploits (Ghost CMS, Palo Alto PAN-OS, KnowledgeDeliver), critical RCE vulnerabilities (7-Zip, Samba, Gogs, SharePoint), and ransomware campaigns. Malware/ransomware and third-party compromises are leading incident causes, mostly hitting healthcare.

**Patch Palo Alto Networks PAN-OS / Prisma Access GlobalProtect now, it's already under active attack. Upgrade to 12.1.7, 11.2.12, 11.1.15, or 10.2.18-h6. If you can't patch immediately, disable the authentication override feature or use a separate certificate for cookie encryption that isn't shared with the HTTPS service.**
#cybersecurity #infosec #knowledge #weeklyreport
https://beyondmachines.net/event_details/state-of-in-security-week-22-2026-0-o-4-o-2/gD2P6Ple2L

State of (in)security - Week 21, 2026

During the week of May 18–25, 2026, there were 18 advisories and 23 incidents impacting over 2 million individuals. Healthcare is the hardest-hit industry and the Matferline breach (703,000 student records) is the largest incident. Key threats are actively exploited vulnerabilities in NGINX, Drupal, Microsoft Defender, and ASUS routers, alongs supply chain attacks on Laravel-Lang and NPM packages, and ransomware incidents affecting schools, hospitality, and financial firms.

**Patch Chrome/Chromium browsers immediately (two critical flaws plus others affecting Edge, Opera, Brave, Vivaldi) and audit any builds using @antv, echarts-for-react, or Laravel-Lang Composer packages from May 19–22, 2026 onward, since these supply-chain compromises may have already stolen CI/CD credentials. Also prioritize patching NGINX, Drupal, and Trend Micro Apex One — all actively exploited and commonly found in public-facing platform stacks.**
#cybersecurity #infosec #knowledge #weeklyreport
https://beyondmachines.net/event_details/state-of-in-security-week-21-2026-v-u-h-z-g/gD2P6Ple2L

State of (in)security - Week 20, 2026

Between May 11–18, 2026, there were 18 vulnerability advisories and 16 cybersecurity incidents affecting roughly 839,000 individuals. Ransomware/malware driving most breaches and the OpenLoop Health breach (716,000 individuals) is the largest breach. Major issues include actively exploited zero-days (Cisco SD-WAN, Microsoft Exchange OWA) and critical patches from Adobe, Apple, Microsoft, SAP, and Fortinet.

**If you installed any @tanstack/* packages on May 11, 2026, disable the dead-man's switch first (systemctl --user stop gh-token-monitor.service on Linux or unload the com.user.gh-token-monitor.plist LaunchAgent on macOS) and remove persistence hooks from .claude/ and .vscode/ directories before rotating any credentials. Revoking tokens first will trigger destruction of your home directory. Only after persistence is disabled should you rotate all secrets (GitHub, AWS, npm, SSH, Vault), block *.getsession.org at DNS, and pin GitHub Actions OIDC publishers to specific branches.**
#cybersecurity #infosec #knowledge #weeklyreport
https://beyondmachines.net/event_details/state-of-in-security-week-20-2026-6-x-n-5-c/gD2P6Ple2L

State of (in)security - Week 19, 2026

Between May 4–11, 2026, the cybersecurity landscape saw 13 advisories and 14 incidents, with active exploits hitting Ivanti EPMM, Palo Alto PAN-OS, and DAEMON Tools (supply chain), along critical flaws in Chrome, MOVEit, PostgreSQL/MariaDB, and Ollama AI servers. Major breaches included ransomware attacks on Fiserv, Liberty Mutual, and Champion Homes, an AWS data center overheating outage disrupting financial platforms, and a $155,000 prompt injection theft from a Grok-linked crypto wallet.

**Patch your browser (Chrome/Edge/Brave/Opera) and your Android phone today, both have critical flaws. And never run .exe files sent by "recruiters" on social media, no matter who the message appears to come from.**
#cybersecurity #infosec #knowledge #weeklyreport
https://beyondmachines.net/event_details/state-of-in-security-week-19-2026-5-8-v-k-b/gD2P6Ple2L

State of (in)security - Week 18, 2026

During week 18 of 2026 (April 27–May 4), there were 13 vulnerability advisories and 26 incidents affecting roughly 9.6 million individuals, with the largest being the Pitney Bowes breach by ShinyHunters (8.2M records); ransomware and malware drove most incidents, hitting healthcare and IT hardest. Critical vulnerabilities were patched across major platforms including GitHub, Microsoft Entra ID, Spring Boot, cPanel, and the Linux kernel.

**This week the most critical items are your Linux and cPanel patches. If you run Linux servers, especially shared environments like Kubernetes clusters, CI/CD runners, or multi-tenant hosts, patch your kernel immediately. If you can't patch right away, disable the vulnerable module by running echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf followed by rmmod algif_aead, and for untrusted code environments block AF_ALG socket creation via seccomp as a long-term safeguard.

If you use cPanel or WHM on your servers, this is urgent, you are being hacked. Immediately run /scripts/upcp --force to apply the emergency patch, then verify the version with /usr/local/cpanel/cpanel -V. Until you've confirmed the update, block external access to ports 2083 and 2087. If you are using cPanel as a customer, reach to your hosting provider to confirm that they have updated cPanel.**
#cybersecurity #infosec #knowledge #weeklyreport
https://beyondmachines.net/event_details/state-of-in-security-week-18-2026-p-9-4-5-m/gD2P6Ple2L

State of (in)security - Week 17, 2026

Between April 20–27, 2026, there were 10 vulnerability advisories and 21 cybersecurity incidents impacting nearly 1 million individuals, with the largest being the UK Biobank breach exposing 500,000 records. Key threats included ransomware attacks, extortion campaigns (ADT, Udemy, Canada Life), critical vulnerabilities across Oracle, Microsoft ASP.NET Core, and Atlassian, plus actively exploited flaws in Cisco, Zimbra, and D-Link products.

**If you use the Bitwarden CLI (@bitwarden/cli) version 2026.4.0, treat it as fully compromised - uninstall it immediately, downgrade to 2026.3.0, and rotate every credential on that machine (GitHub/npm tokens, AWS/GCP/Azure keys, SSH keys, .env secrets). Block audit.checkmarx.cx at your network egress and audit your GitHub account for unauthorized repos or workflow changes.**
#cybersecurity #infosec #knowledge #weeklyreport
https://beyondmachines.net/event_details/state-of-in-security-week-17-2026-x-h-q-2-3/gD2P6Ple2L

Really need to remember to manually scrobble all the records…. #LastFM #WeeklyReport #xp

State of (in)security - Week 16, 2026

Week 16 of 2026 saw 17 advisories and 22 incidents, with 16.7 million individuals impacted, driven largely by the McGraw-Hill Salesforce misconfiguration breach (13.5M) alongside major ransomware, phishing, and third-party compromises affecting healthcare, finance, and tech sectors. Key vulnerabilities included actively exploited zero-days in Microsoft products, critical flaws in Cisco, Fortinet, SAP, and Adobe, and a systemic RCE risk in the MCP protocol.

**This week third party libraries and AI are the focus: If you're using Claude Code, update immediately to the latest version and stop using authentication helpers. Instead, set the ANTHROPIC_API_KEY environment variable directly. If you use Axios in your applications, start planning an update to version 1.15.0 or later. Make sure your nginx-ui instances are isolated from the internet and accessible from trusted networks only.**
#cybersecurity #infosec #knowledge #weeklyreport
https://beyondmachines.net/event_details/state-of-in-security-week-16-2026-q-8-4-u-9/gD2P6Ple2L

State of (in)security - Week 15, 2026

During the week of April 6–13, 2026, there were 9 vulnerability advisories and 23 data breach/incident events, up from 20 the prior week affecting over 41,500 known individuals across sectors like IT, healthcare, and government, with malware/ransomware and third-party compromises as the leading causes. Major events included several actively exploited zero-days (e.g., Adobe Reader, Chrome), major breaches at organizations like LAPD (7.7 TB leaked) and a Chinese supercomputing center (10 PB), and multiple ransomware attacks disrupting healthcare and other critical services.

**Update your Adobe Acrobat and Reader immediately because attackers are already using this flaw to take over computers through simple PDF files. If you cannot patch right away, use a browser-based PDF viewer as a temporary safety measure and disable Javascript in your Adobe Acrobat and Reader.**
#cybersecurity #infosec #knowledge #weeklyreport
https://beyondmachines.net/event_details/state-of-in-security-week-15-2026-n-p-y-k-7/gD2P6Ple2L

State of (in)security - Week 14, 2026

During the week of March 30–April 6, 2026, cybersecurity activity included 11 vulnerability advisories (featuring actively exploited zero-days in Citrix, Fortinet, and TrueConf) and 20 incidents dominated by ransomware/malware (5), third-party compromises (3), and heavily hitting healthcare (6) and tech (4). At least 178,530 individuals are affected, led by the DocketWise breach exposing 116,000 immigration client records.

**This week, focus on patching critical and actively exploited flaws in Cisco and Fortinet. Hackers love these systems, because they can't really be isolated from the internet - they are designed to be visible.**
#cybersecurity #infosec #knowledge #weeklyreport
https://beyondmachines.net/event_details/state-of-in-security-week-14-2026-4-w-k-u-i/gD2P6Ple2L

State of (in)security - Week 13, 2026

During the week of March 23–30, 2026, cybersecurity incidents surged to 32 (up from 14 the prior week), impacting over 14.6 million individuals, with malware/ransomware as the leading cause (11 incidents) and healthcare and government as the most targeted sectors. The week also saw 16 vulnerability advisories, including critical zero-days in F5 BIG-IP and Telegram alongside supply chain attacks and breaches affecting organizations from the European Commission to major healthcare providers.

**Treat AI browser extensions as extremely dangerous high-privilege agents. If you use the Claude Chrome Extension, make sure it's updated to version 1.0.41 or higher immediately! Older versions allow attackers to silently hijack your browser session and access your email, documents, and chat history without any clicks. Review what permissions the extension has and stay alert for suspicious sites that may have exploited this before the patch.**
#cybersecurity #infosec #knowledge #weeklyreport
https://beyondmachines.net/event_details/state-of-in-security-week-13-2026-r-f-h-6-5/gD2P6Ple2L

State of (in)security - Week 12, 2026

During the week of March 16–23, 2026, there were 17 vulnerability advisories and 14 data breach/incident events. Social engineering, phishing, and unauthorized access are the leading causes impacting nearly 9 million individuals across government, healthcare, and tech sectors. Key threats included actively exploited zero-days in Chrome, SharePoint, and iPhones, a major supply chain attack on Aqua Security's Trivy scanner. Major incidents are the 5-million-record Companies House data leak and a paralyzing ransomware attack on Foster City.

**If you use Trivy, trivy-action, or setup-trivy in your pipelines, this is urgent and important! Treat all secrets that ran through affected pipelines as compromised: rotate them now and investigate logs for all systems where those secrets may have given access. Then immediately pin to the known safe versions GitHub Actions to full commit SHA hashes instead of version tags, since tags can be silently rewritten to point to malicious code.**
#cybersecurity #infosec #knowledge #weeklyreport
https://beyondmachines.net/event_details/state-of-in-security-week-12-2026-9-y-7-3-x/gD2P6Ple2L

State of (in)security - Week 11, 2026

During the week of March 9–16, 2026, the cybersecurity landscape saw 22 advisories and 16 incidents including ransomware, data breaches, and actively exploited vulnerabilities in products like SolarWinds, Ivanti, and Salesforce. Over 3.3 million individuals impacted, largely by a single Cal AI breach exposing 3 million records. Malware/ransomware and software vulnerability exploits were the leading causes, hitting sectors from healthcare and finance to consulting and food & beverage.

**If you use AI platforms and chatbots, remember that they are just web applications and have a bunch of other possible flaws. Make sure databases, API endpoints, and system prompts are locked down with proper authentication, access controls, and integrity monitoring, not left exposed as an afterthought. Regularly audit your AI infrastructure for basic web application flaws like exposed APIs, SQL injection, and missing authentication, because even the most advanced AI tools can be undone by classic, well-known security mistakes.**
#cybersecurity #infosec #knowledge #weeklyreport
https://beyondmachines.net/event_details/state-of-in-security-week-11-2026-m-2-h-j-4/gD2P6Ple2L

State of (in)security - Week 10, 2026

During the week of March 2–9, 2026, there were 15 vulnerability advisories (including 5 actively exploited flaws in products like VMware, Cisco, and WordPress) and 17 incidents led by the LexisNexis AWS cloud breach (400K individuals affected), an FBI surveillance systems breach. Multiple ransomware attacks hitt government, healthcare, and education sectors.

**Update your Comet browser, or even better, wipe it from your system. It's too dangerous. Treat AI agents as untrusted insiders and manually restrict their access to sensitive websites or local files. Always enable 'ask before filling' in your password manager to prevent agents from accessing credentials without your explicit consent. Treat AI documentation feeds as executable code and never assume a tool is safe just because it has high GitHub stars. Limit your AI assistant's file system permissions and verify the source of all instructions delivered through MCP servers.**
#cybersecurity #infosec #knowledge #weeklyreport
https://beyondmachines.net/event_details/state-of-in-security-week-10-2026-a-u-t-w-s/gD2P6Ple2L

State of (in)security - Week 9, 2026

During the week of Feb 23–Mar 2, 2026, there were 21 vulnerability advisories and 15 data breach/ransomware incidents, heavily concentrated in healthcare impacting over 53 million individuals, highlighted by the ManoMano breach (38M records) and a billion-record exposure from a system misconfiguration.

**Treat AI tool configuration files with the same suspicion as executable binaries. Treat local AI agents as high-privilege and very dangerous Be aware that most AI tools are half-baked extremely vulnerable products that developers didn't design or test properly and push the security problem on the user. Ideally, don't use them. If you do use them, DO NOT TRUST THEM. Isolate them on a separate computer, severely limit their access and granted abilities.**
#cybersecurity #infosec #knowledge #weeklyreport
https://beyondmachines.net/event_details/state-of-in-security-week-9-2026-r-j-g-q-0/gD2P6Ple2L

State of (in)security - Week 8, 2026

During the week of Feb. 16–23, 2026, cybersecurity activity included 11 vulnerability advisories (including critical flaws in Honeywell, Chrome, WordPress plugins, and industrial IoT devices, plus an actively exploited Dell zero-day) and 19 incidents, primarily data breaches and ransomware attacks across healthcare, retail, and hospitality impacting over 1.2 million individuals.

**=As usual, vibe coded and AI applications are dangerous. They are rushed, not tested properly and always in a state of Minimal Viable Product. If possible, AVOID THEM LIKE THE PLAGUE THAT THEY ARE. If you do use OpenClaw, upgrade to version 2026.2.14 or later ASAP. If you can't upgrade right away, make sure OpenClaw is not exposed to any untrusted networks and disable any extensions you're not actively using.**
#cybersecurity #infosec #knowledge #weeklyreport
https://beyondmachines.net/event_details/state-of-in-security-week-8-2026-5-m-n-1-c/gD2P6Ple2L

State of (in)security - Week 7, 2026

During the week of Feb. 9–16, 2026, 19 vulnerability advisories and 16 incidents were recorded. Critical patches were released by major vendors including Microsoft, Apple, Adobe, Fortinet, and Ivanti, several are actively exploited. Data breaches and ransomware attacks hit healthcare, government, and tech sectors and impacted over 50.8 million individuals. The largest exposure was caused from a Firebase misconfiguration in the Codeway AI Chat App leaking 300 million messages.

**Disable AI extensions that have local system access if they also read data from public sources like calendars or email. You should never allow an autonomous agent to bridge untrusted external content directly to your operating system's command line. Treat AI agents as privileged entities and implement monitoring to detect unauthorized command execution.
When developing a product, always make sure to patch your own product instances. Because you are just as exposed, and you don't have a lot of reasonable arguments not to patch.**
#cybersecurity #infosec #knowledge #weeklyreport
https://beyondmachines.net/event_details/state-of-in-security-week-7-2026-r-9-i-o-b/gD2P6Ple2L

State of (in)security - Week 6, 2026

**AI tools are under attack and full of vulnetabilities in the past week. The rule stands, this is a half-baked technology, and everyone is rushing to push out incomplete and very insecure products. Research a lot before deploying, and always deploy with a lot of isolation and blocks from your real life. Or just accept you have installed something imminently vulnerable.**
#cybersecurity #infosec #knowledge #weeklyreport
https://beyondmachines.net/event_details/state-of-in-security-week-6-2026-9-i-9-j-j/gD2P6Ple2L

State of (in)security - Week 5, 2026

During the week of January 26 to February 2, 2026, there were 15 vulnerability/advisory events and 18 security incidents affecting approximately 154,000 individuals, with the largest breach exposing 100,000 users from the StopICE activist platform. Critical vulnerabilities were patched across multiple systems including active exploits in Fortinet FortiOS, Ivanti EPMM, Microsoft Office, and WinRAR. Major data breaches impacted organizations including KPMG Netherlands, Crunchbase, Panera Bread, and Match Group.

**This week focus on patching MS Office. Hackers attack with malicious MS Office documents. Restart all Microsoft 365 and Office 2021 applications immediately to trigger the service-side security fix. For older versions like Office 2016, apply registry workarounds until Microsoft releases a formal patch.**
#cybersecurity #infosec #knowledge #weeklyreport
https://beyondmachines.net/event_details/state-of-in-security-week-5-2026-9-2-a-i-d/gD2P6Ple2L