Introduction: what happened Sotheby’s has disclosed a data breach following a July 24, 2025 intrusion in which an unknown actor removed files from the company’s environment. Subsequent review confirmed exposure of highly sensitive personal data—including full names, Social Security numbers…
Introduction: a zero-day chain from LFI to RCE Gladinet has released security updates for its CentreStack (and hosted equivalents) after researchers observed in-the-wild exploitation of a new bug tracked as CVE-2025-11371. The flaw is an unauthenticated Local File Inclusion (LFI)…
Introduction: what is CVE-2025-20352? CVE-2025-20352 is a stack overflow in the SNMP subsystem of Cisco IOS and IOS XE. Under specific conditions, it lets an attacker crash devices (DoS) or—if they already have higher privileges—execute code as root on affected…
Introduction: what happened and why it matters F5 disclosed that a nation-state actor maintained long-term persistence in parts of its network and exfiltrated files, including portions of BIG-IP source code and non-public vulnerability information. In response, multiple governments issued urgent…
Introduction: what was compromised and by whom Dairy Farmers of America (DFA)—a Kansas-based, farmer-owned cooperative—confirmed a June cyberattack that exposed personal data of employees and cooperative members. Breach notices filed with Maine’s attorney general list 4,546 affected individuals and enumerate…
Introduction: What’s affected and why it matters Multiple memory-corruption flaws in Fuji Electric’s V-SFT—the Windows-based configuration software used to program MONITOUCH HMI panels—can be abused via a malicious project file to achieve arbitrary code execution on the engineer/operator workstation. Successful…
Introduction: what happened and what data was exposed Sotheby’s has disclosed a data security incident after detecting on July 24, 2025 that “certain Sotheby’s data appeared to have been removed” from its environment by an unknown actor. A subsequent review—completed…