Ransomware
LockBit successor group hits three European logistics firms in one week
A crew using rebuilt LockBit 4.0 tooling encrypted warehouse systems in Rotterdam, Hamburg and Gdansk after entering through unpatched VPN appliances.
Latest news
Every story from the SentriXa newsroom, newest first: threats, vulnerabilities, security operations, risk and CISO strategy. Free to read.
Incident Response
What 19 seconds of containment looks like inside a ransomware precursor
A step-by-step reconstruction of how one security team stopped shadow copy deletion before any file was encrypted.
Threat Intelligence
Silent Ledger: how a supply-chain lure reached crypto exchanges
A poisoned developer package and a fake recruiter persona gave the operators access to build systems at two exchanges.
Vulnerabilities
OpenGate VPN flaw CVE-2026-001 exploited within 48 hours of disclosure
Mass scanning began a day after the advisory. Over 11,000 appliances were still exposed a week later.
Cyber AI
Attackers test LLM agents for automated reconnaissance
Researchers observed agents chaining search, scanning and exploit lookups with little human input.
Privacy & Compliance
NIS2 audits begin: what essential entities are being asked first
Early audits focus on incident reporting timelines, supply chain controls and MFA coverage for administrators.
Nation-State
Frostbyte campaign pivots from energy to EU finance regulators
The espionage cluster tracked as Frostbyte is now sending tailored lures to supervisory staff at three national financial authorities.
Data Breaches
Healthcare billing vendor confirms 2.1 million patient records exposed
Names, insurance numbers and treatment codes were copied from a reporting database through a SQL injection flaw.
IoT Security
Hard-coded credentials found in widely deployed badge reader controllers
A maintenance account with a fixed password is reachable on the management network of thousands of buildings.
Cyber AI
Can AI copilots shorten SOC triage? Early numbers are in
Teams report a 38 percent drop in time spent per low-severity alert, with mixed results on complex incidents.
Cyber Insurance
Insurers start pricing premiums on phishing-resistant MFA adoption
Two large carriers now offer lower rates to companies that move administrators to hardware keys or passkeys.
Cybercrime
Europol dismantles phishing-as-a-service kit used in 40,000 attacks
Investigators seized the panel behind a kit that cloned bank and parcel delivery login pages in 23 languages.
Supply Chain Security
Poisoned Java library pulled after deserialisation backdoor found
A maintainer account takeover led to a release that executed attacker gadget chains on startup.
Fraud & Identity Theft
Deepfake voice calls drive new wave of CFO payment fraud
Finance teams report cloned executive voices requesting urgent supplier payments, often paired with lookalike email domains.
Tracking & Law Enforcement
Police seize servers behind Carnival Loader banking trojan
Brazilian and Spanish police took down command servers and arrested two suspected developers.
Data Protection
Immutable backups cut ransomware recovery time by half, survey shows
Organisations with object-locked backups restored operations in a median of 4 days instead of 9.
Cyberwarfare
Undersea cable operators tighten monitoring after Baltic incidents
Operators are adding acoustic sensing and sharing vessel tracking data after two cables were damaged in a month.
CISO Conversations
A CISO on running security for a 40-country freight network
Elena Marsh explains why she cut her console count from nine to two and what she measures every Monday.
Industrial Cybersecurity
Water utilities patch PLC firmware after remote access warning
An advisory warned that exposed controllers at small utilities accept unauthenticated configuration changes.
Application Security
Prototype pollution bugs still ship in one in five web apps, study finds
An analysis of 9,000 production bundles found outdated helper libraries are the main cause.
Cloud Security
Misconfigured storage buckets remain top cloud risk for third year
Public access settings and disabled logging account for most cloud findings in a new survey of 600 organisations.
CISO Roundtable
CISO roundtable: budgets hold steady while AI tooling grows
Twelve security leaders compare 2027 plans. Headcount is flat, but most are funding AI-assisted triage.
Endpoint Security
Windows Print Spooler bug returns with a new escalation path
A crafted printer driver install grants SYSTEM privileges on fully patched Windows 11 machines.
Identity & Access
MFA fatigue attacks fall where number matching is enforced
Push bombing success rates dropped by 90 percent in tenants that require users to type a displayed code.
Cybersecurity Funding
Identity threat detection startups raise $410M in Q3
Investors are backing companies that spot account takeover and privilege abuse across multiple identity providers.
Mobile & Wireless
Banking trojans abuse Android accessibility services in new campaign
Fake utility apps request accessibility access, then read one-time codes and overlay bank login screens.
Network Security
HTTP/2 rapid reset variants still knocking over unpatched edges
Stream cancellation floods peaked at 212 Gbps last week, mostly against older reverse proxies.
ICS Events
Industrial security summit agenda focuses on OT asset visibility
Sessions at next month's summit in Munich cover passive asset discovery, safe patching windows and vendor remote access.
M&A Tracker
M&A tracker: 31 cybersecurity deals announced in September
Cloud security and data protection drew the most buyers, with private equity behind a third of deals.