CVE-2025-9636 Cross-Origin Opener Policy Vulnerability in pgAdmin 4

pgAdmin = 9.7 is affected by a Cross-Origin Opener Policy COOP vulnerability. This vulnerability allows an attacker to manipulate the OAuth flow, potentially leading to unauthorised account access, account takeover, data breaches, and privilege escalation...

Cloudflare Confirms Data Breach Linked to Salesforce and Salesloft Drift

Cloudflare confirms a Salesforce-linked data breach via Salesloft Drift, exposing customer support case data but leaving core systems…...

TransUnion Data Breach: 4.4 Million US Consumers’ Data Stolen

A TransUnion data breach exposed 4.4 million US consumers' Social Security numbers via a Salesforce hack. The attack…...

CVE-2025-58061

OpenEBS Local PV RawFile before v0.10.0 stores persistent volume data under /var/csi/rawfile/ with world-readable permissions, enabling non-privileged users to access potentially sensitive data such as databases in Kubernetes workloads. The issue is fixed in v0.10.0. Affected product: OpenEBS Loc...

ShinyHunters and Scattered Spider Linked to Farmers Insurance Data Breach

Farmers Insurance reports a breach affecting 1.1 million customers. Learn how the attack, linked to groups ShinyHunters and…...

Google Reveals UNC6395’s OAuth Token Theft in Salesforce Breach

A new advisory from Google and Mandiant reveals a widespread data breach in Salesforce. Learn how UNC6395 bypassed…...

National Public Data Relaunches Despite 2.9 Billion SSNs Breach

It is business as usual at National Public Data NPD despite the breach that exposed 3 billion Social Security numbers and the subsequent leak...

Nearly 1M SSNs and Health Records Exposed in Marijuana Patient Database

Ohio Medical Alliance exposed a medical marijuana patient database containing 957,000 records, including SSNs, IDs, health files, and…...

Australian ISP iiNet Reports Data Breach, Customer Accounts Stolen

Australian ISP iiNet confirms data breach as hackers stole 280,000 email accounts, phone numbers and user data using…...

Why Your Security Culture is Critical to Mitigating Cyber Risk

After two decades of developing increasingly mature security architectures, organizations are running up against a hard truth: tools and technologies alone are not enough to mitigate cyber risk. As tech stacks have grown more sophisticated and capable, attackers have shifted their focus. They are...

A week in security (August 11 – August 17)

Last week on Malwarebytes Labs: Italian hotels breached for tens of thousands of scanned IDs National Public Data returns after massive Social Security Number leak Romance scammers in Ghana charged with more than $100 million in theft Netflix scammers target jobseekers to trick them into handing...

The vulnerability of the formSetWanPPTPcallback() function in the HTTP POST Request Handler of the D-Link DIR-513 router’s microprogramming software allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the formSetWanPPTPcallback function /goform/formSetWanPPTPpath of the HTTP POST Request Handler component in the microprogramming software for D-Link DIR-513 is caused by a buffer overflow. Exploiting this vulnerability could allow an attacker to compromise the confidentialit...

Threat Actor Claims to Sell 15.8 Million Plain-Text PayPal Credentials

A seller named ChuckyBF is offering 15.8M PayPal logins with emails, passwords, and URLs. The data may come…...

National Public Data returns after massive Social Security Number leak

Remember that data broker nobody had ever heard of, but managed to leak a database which contained the data of some 2.9 billion people? It's back, and this time with a search function. National Public Data suffered an alleged breach in 2024 against a data base that, it turned out, carried 272...

IBM 2025 Cost of a Data Breach Report: Lessons for API and AI Security

IBM’s 2025 Cost of a Data Breach Report offers one of the clearest and most comprehensive views yet of how AI adoption is shaping the security landscape. While breach numbers are relatively low – only 13% of organizations reported breaches involving AI models or applications – the report reveals ...

Connex Credit Union Data Breach Affects 172,000 Members

Connex Credit Union breach exposes data of 172000 members, legal probe launched, experts urge victims to monitor accounts…...

Bouygues Telecom Hit by Cyberattack, 6.4 Million Customers Affected

A cyberattack on Bouygues Telecom exposed data for 6.4 million customers. Find out what information was compromised and…...

Vehicle Management addcompany.php File SQL Injection Vulnerability

Vehicle Management is a vehicle management system. Vehicle Management suffers from a SQL injection vulnerability that stems from the lack of validation of externally entered SQL statements in the parameter company in the file /addcompany.php. An attacker can exploit this vulnerability to execute...

Vehicle Management /filter.php File SQL Injection Vulnerability

Vehicle Management is a vehicle management system. Vehicle Management suffers from a SQL injection vulnerability that stems from the lack of validation of externally entered SQL statements in the parameter from in the file /filter.php. An attacker can exploit this vulnerability to execute illegal...

Leaked Credentials Up 160%: What Attackers Are Doing With Them

When an organization's credentials are leaked, the immediate consequences are rarely visible—but the long-term impact is far-reaching. Far from the cloak-and-dagger tactics seen in fiction, many real-world cyber breaches begin with something deceptively simple: a username and password. According ...