Category: Cybersecurity & Malware

The Pentagon’s Defense Manpower Data Center has notified over 3 million military service members that their personal information was stolen in a security breach. Hackers exploited a vulnerability in the agency’s file-sharing system to gain unauthorized access between October 2025 and July 2026. The compromised data includes Social Security numbers, names, dates of birth, contact information, sex, race, and military personnel information, though the specific details vary for each individual affected.

The Defense Manpower Data Center manages records for military, civilian, contractor, and veteran personnel and distributes benefits and entitlements information to various government agencies. In response to the breach, the Pentagon is offering 12 months of complimentary credit monitoring services through IDX, with affected individuals required to enroll by August 19, 2027. The agency stated it has implemented cybersecurity incident response measures and is working to enhance the system’s security defenses.

Source: Read the full story at BleepingComputer

This summary was written with AI assistance from the linked source.

Kiteworks, a secure file-sharing software company, has released patches addressing 126 vulnerabilities in its systems. Among these flaws is a maximum-severity code injection vulnerability affecting the Email Protection Gateway component of the Kiteworks Private Content Network. The vulnerability, tracked as CVE-2026-54154, was discovered through the company’s bug bounty program. Unauthenticated attackers could potentially exploit a combination of input-handling flaws to achieve code execution and gain full administrative control of the affected appliance. The flaw impacts all Email Protection Gateway versions before 9.4.1 and has been patched in later releases.

Additionally, Kiteworks fixed 11 critical vulnerabilities related to authentication bypass, admin account takeover, and cross-site scripting in its Core and Email Protection Gateway components. The company serves thousands of global corporations and government agencies through its Private Content Network, which has over 100 million end-users. Earlier this month, Kiteworks had advised customers to shut down servers due to threat intelligence warning of potential zero-day attacks, but lifted the advisory after deploying patches and finding no evidence of compromise or suspicious activity.

Source: Read the full story at BleepingComputer

This summary was written with AI assistance from the linked source.

Zero Trust security measures are widespread in enterprises, yet a significant vulnerability remains during employee onboarding and service desk processes. Human error and manual trust establishment create opportunities for attackers, particularly when organizations must verify new employees who lack established authentication methods. The FBI has warned that threat actors, including North Korean IT workers, exploit this gap by using fraudulent identities and stolen documents to secure remote positions and access corporate networks. This reverses typical attack patterns, as attackers pass hiring processes and receive legitimate credentials rather than stealing existing ones.

The credential enrollment phase presents additional risk, as new employees may rely on weaker authentication before registering stronger methods like multi-factor authentication or security keys. Organizations must implement dedicated identity verification processes during onboarding, such as government-issued document validation combined with biometric checks, before issuing credentials and access. By treating identity proofing as a required workflow step rather than a discretionary decision, organizations can establish confidence in new hires before creating accounts and granting system access.

Source: Read the full story at BleepingComputer

This summary was written with AI assistance from the linked source.

Law enforcement agencies from ten countries conducted a coordinated operation called “Operation KillSwitch” on September 30 to dismantle the KillSec ransomware gang. The operation resulted in the seizure of the group’s data leak site and servers, the arrest of three suspects, and the identification of a 16-year-old as the gang’s alleged main administrator. Investigators searched eight properties across Greece, Romania, Spain, and the United Kingdom while also targeting the group’s criminal proceeds. The investigation, led by German authorities, identified suspects believed to hold roles as an administrator, developer, negotiator, and affiliate within the cybercrime organization.

KillSec has been active since approximately 2024, exploiting software vulnerabilities and poorly secured devices to breach corporate systems and steal data for extortion purposes. Authorities determined that approximately 500 of the group’s attacks were successful, with at least 70 linked to German organizations. During the operation, law enforcement seized roughly 110 terabytes of stolen data and shut down five servers. Investigators discovered that group members used artificial intelligence to build their ransomware infrastructure and identify potential victims. The examination of seized evidence continues as authorities work to trace criminal proceeds, including cryptocurrency, and identify additional victims and perpetrators.

Source: Read the full story at BleepingComputer

This summary was written with AI assistance from the linked source.

Microsoft has made Windows settings backup and restore a default feature for enterprise devices running Windows 11 version 26H2 that are connected to Microsoft Entra. The backup tool preserves user Windows settings and Microsoft Store applications when devices are reset, replaced, upgraded, or reimaged. Originally introduced as an optional feature two years ago, the tool progressed through public preview in May 2025 and became generally available in August 2025 before being activated by default following the September 29 release of Windows 11 26H2.

The automatic activation applies only to devices in non-EU Digital Markets Act regions that do not have existing backup policy configurations. Microsoft stated that administrators retain complete control over the feature through mobile device management solutions and can disable it using Microsoft Intune or Group Policy. The restore functionality remains disabled by default and requires explicit administrator configuration, while existing policy settings take precedence over the new default behavior.

Source: Read the full story at BleepingComputer

This summary was written with AI assistance from the linked source.