Cybersecurity
France's Tax Agency Is Exempt From Its Own GDPR Fines
DGFiP took 48 days to disclose a breach of 678,000 tax records. French law explicitly exempts the state from the GDPR fines it would impose on a private company.
Cybersecurity
Cybersecurity
SAP Commerce Cloud Bug Was Exploited Before Most Patched It
CVE-2026-58231 scores a perfect 10.0 in SAP Commerce Cloud. No public exploit existed, yet honeypots caught real attacks three days after the patch shipped.
Cybersecurity
Beacon's Breach Falls Outside Every Safety Net
A leaked AWS key let attackers copy Beacon's charity CRM database. Financial firms get DORA, critical infrastructure gets NIS2 - the charity sector gets neither.
Cybersecurity
A Vendor Breach Your DORA Register Can't Explain
RingCentral's own July 28 disclosure blames a "sophisticated social engineering campaign" with no technical detail, after ShinyHunters leaked 1.6 million customer records - leaving EU and UK vendor-risk registers with nothing to update.
Cybersecurity
Shell and Philips Lost Blueprints, Not Passwords
Clop named Shell, Philips, GE and Fiserv among nearly 50 victims of a campaign exploiting a PTC Windchill flaw patched two months earlier. The stolen material was engineering drawings and facility data, not personal records, which means it may dodge GDPR notification while still triggering NIS2 duties few manufacturers have mapped.
Cybersecurity
N-central's Second Hotfix Came After the Ransomware Did
Microsoft attributes a new ransomware strain, StormEncryptor, to a China-linked group that broke into customer networks through the same N-able N-central flaw a first patch failed to close. N-able shipped a second hotfix on August 10, four days after confirming attackers had already reached managed endpoints.
Cybersecurity
Adobe Commerce Bug Let Attackers Steal Sessions
CVE-2026-71362 lets an unauthenticated attacker switch a customer session on Adobe Commerce or Magento. Sansec was blocking real attacks within hours of the patch.
Cybersecurity
Two SharePoint Bugs Now Chain to Full RCE
CVE-2026-55040 and CVE-2026-63520 were patched a month apart, but chained together they give unauthenticated remote code execution on every supported on-prem SharePoint version.
Cybersecurity
Germany's NIS2 Grace Period Has Ended
Germany's BSI stopped shielding late NIS2 registrants on July 31. Official figures show a registration gap near 40 percent - and utilities are hit hardest by the law's own complexity.
Cybersecurity
Attackers Hit 361 vCenter Servers Before KEV Listed It
A CVSS 9.8 vCenter flaw was under active exploitation across 47 countries within five days of its patch, per DFIR firm QUIRSO. Weeks later it still is not on CISA's KEV catalog.
Cybersecurity
Your Patched Windows Defender Still Has a Door
A researcher's ShieldBreak proof-of-concept, published August 12, defeats Microsoft's July fix for CVE-2026-50656 on fully patched Windows 10, 11 and Server 2025. Patch compliance no longer means protected.
Cybersecurity
Trezor Breach Turns Addresses Into a Target List
ShipMonk, Trezor's shipping provider, was breached through a Metabase flaw, exposing addresses of nearly 13,700 hardware wallet buyers. Chainalysis data shows why that list is worth more to criminals than a password.
Page 1 / 11
The Operator Brief
One considered note on infrastructure, governance, and measurement, most mornings. No theory.