cybersecurity vendors

Attackers obtained credentials belonging to cloud migration vendor ConnectWise SkyKick and used them to gain unauthorized access to more than 173 Microsoft 365 tenants. The vendor-level access allowed compromise of multiple customer environments at once, raising fresh concerns about supply chain security and how managed service providers protect administrative credentials to client systems.

The FBI has suffered a breach that security analysts say points to problems far beyond one agency. Reporting suggests the incident reveals wider weaknesses in how sensitive systems and vendor networks are protected across government and industry. Experts are calling for stronger safeguards, better oversight of third-party access, and a rethink of basic cybersecurity practices in the wake of the intrusion.

Ransomware groups are expanding their targeting of a vulnerability in Palo Alto Networks products, according to Cybersecurity Dive. The report indicates that more threat actors are exploiting the flaw, raising concerns for organisations that rely on the company's security appliances. Administrators are being urged to patch affected systems promptly as exploitation activity grows.

A cyberattack on an education contractor has exposed the personal data of millions of California students, according to Cybersecurity Insiders. The breach reportedly affects a company handling services for California schools, putting student records at risk. Details on the contractor's identity, the scope of the exposure, and notification plans have not yet been confirmed by state officials.

Lexington Hospital Corp. has disclosed a data breach involving a third-party vendor that affected roughly 67,000 people. The incident highlights ongoing cybersecurity risks tied to hospital supply chains, where vendors with access to patient or employee data can expose sensitive information. Details on what data was compromised and notification timelines were not immediately available.

Australian cosmetics brand Napoleon Perdis has confirmed a data breach affecting nearly 340,000 customers after an unauthorized party accessed legacy records stored with third-party provider Retail Express. The incident has raised fresh concerns about retailer reliance on external vendors to hold sensitive customer data, and about how legacy databases are secured long after collection.

Oracle Health has reportedly suffered a data breach affecting close to 20 million patients. Security commentators are describing the scale of the exposure as a sign of fundamental failures in basic data hygiene rather than a sophisticated attack, and the incident is prompting renewed concern about how healthcare data is protected by major vendors.

A critical vulnerability, tracked as CVE-2026-93483, affects Znuny versions up to and including 7.3.6. Attackers can forge the 'Remote-User' HTTP header to gain access to any account, including administrator accounts. Security experts urge administrators to avoid HTTPBasicAuth deployments and to check the vendor's guidance for patches and mitigations while the flaw remains actively discussed in cybersecurity circles.