Security Week

1. Israeli Ad Firm Doubled as Candiru’s Zero-Click Spyware Delivery Channel

   Israeli company Discover-Tech’s ads allow threat actors to fingerprint and track devices at scale and infect selected targets.

   The post Israeli Ad Firm Doubled as Candiru’s Zero-Click Spyware Delivery Channel appeared first on SecurityWeek.

2. In Other News: ICS-Sniper Attack, Hacking XWorm Malware Operators, $250k Chrome Exploit

   Noteworthy stories that might have slipped under the radar: BofA adds 1,000 patching contractors, KGB RAT pairs data theft with jump scares, and Langflow flaw under attack.

   The post In Other News: ICS-Sniper Attack, Hacking XWorm Malware Operators, $250k Chrome Exploit appeared first on SecurityWeek.

3. BAE Systems Security Incident Stalls Notices From US Bankruptcy Courts

   A cyber incident affecting contractor BAE Systems has knocked out the Bankruptcy Noticing Center, halting notices nationwide for a week.

   The post BAE Systems Security Incident Stalls Notices From US Bankruptcy Courts appeared first on SecurityWeek.

4. Chinese APT Exploited BeyondTrust Vulnerability as Zero-Day

   Armory Castle exploited CVE-2026-102764 for initial access, deployed custom tools, and deleted logs and artifacts.

   The post Chinese APT Exploited BeyondTrust Vulnerability as Zero-Day appeared first on SecurityWeek.

5. OpenAI Models Hacked Data Portals, Raided a Crypto Wallet to Finish Tasks

   Left without funds for a coding task, an OpenAI model spent test crypto from a stranger’s wallet and left it out of its report.

   The post OpenAI Models Hacked Data Portals, Raided a Crypto Wallet to Finish Tasks appeared first on SecurityWeek.

6. F5, Juniper Networks Patch Critical Vulnerabilities

   Successful exploitation of some of these issues could lead to remote code execution and full device takeover.

   The post F5, Juniper Networks Patch Critical Vulnerabilities appeared first on SecurityWeek.

7. Microsoft Patches Two Dozen RCE Flaws in Office

   In addition to RCE flaws, Microsoft fixed multiple information disclosure bugs and a security bypass issue in Office.

   The post Microsoft Patches Two Dozen RCE Flaws in Office appeared first on SecurityWeek.

8. Proofpoint Inks $6.3 Billion All-Cash Deal to Acquire Varonis

   The Thoma Bravo-owned Proofpoint will acquire Varonis in an all-cash transaction and Varonis will become a private company.

   The post Proofpoint Inks $6.3 Billion All-Cash Deal to Acquire Varonis appeared first on SecurityWeek.

9. Context Is King in the Fight Against Modern Cyberattacks

   Contextual defense helps security teams connect the signals, anticipate what comes next, and stop threats before they escalate.

   The post Context Is King in the Fight Against Modern Cyberattacks appeared first on SecurityWeek.

10. Watch Now: Zero Trust Strategies Summit – All Sessions Available on Demand

    This summit is laser-focused on the next generation of Zero Trust and Identity security, moving beyond theory to deliver actionable strategies.

    The post Watch Now: Zero Trust Strategies Summit – All Sessions Available on Demand appeared first on SecurityWeek.