Microsoft has reminded customers that systems running Home and Pro editions of Windows 11 24H2 will stop receiving updates in two months. "On October 13, 2026, Windows 11, version 24H2 Home and Pro editions, and Windows 10 Enterprise LTSB 2016 will reach end of updates," Microsoft warned in a message center update. "After this date, devices running these editions will no longer receive monthly security and non-security preview updates containing protections from the latest security threats." However, according to its support website, Windows 11 24H2 Enterprise and Education editions will remain under mainstream support until October 2027. Customers are advised to upgrade to Windows 11 25H2 (also known as the Windows 11 2025 Update), which has become generally available in September 2024 as a minor update installed through an enablement package.
The Cybersecurity and Infrastructure Security Agency (CISA) said Tuesday that the Medusa ransomware gang has breached more than 500 critical infrastructure organizations in the United States since June 2021. This was revealed in a joint advisory in coordination with the Department of Health and Human Services (HHS) and the Federal Bureau of Investigation (FBI). "As of April 2026, Medusa actors have impacted more than 500 victims across multiple critical infrastructure sectors, including Healthcare and Public Health, Defense Industrial Base, Critical Manufacturing, Government Services and Facilities, Information Technology, and Financial Services," they said. "Other victims include organizations in the medical, education, legal, insurance, technology, and manufacturing industries." This is an update to a joint report published in March 2025, which said the Medusa ransomware operation had impacted an estimated over 300 critical infrastructure organizations.
Cybersecurity researchers have flagged a global cybercrime operation that abuses thousands of hacked WordPress websites as infrastructure to disseminate malware, commandeer infected hosts, store stolen documents, screenshots, and activity logs created to track the status of the activity. "The operation doesn't rely on a single piece of malware, but on a whole toolkit of criminal software
A JavaServer Pages (JSP) web shell deployed following the exploitation of a critical security flaw in PTC Windchill and FlexPLM servers is specifically designed for the enterprise Product Lifecycle Management (PLM) software, according to new findings from ReliaQuest. The cybersecurity company characterized the web shell as a fully equipped extortion platform capable of mapping sensitive vault
Comcast is promoting WiFi-based motion detection as a part of its new Xfinity Shield home protection platform, allowing routers and wireless devices to detect people moving through a home without cameras or motion sensors. This feature was announced as part of a new Xfinity Shield product offering on Tuesday, a new application suite that combines cybersecurity, physical home monitoring, and family safety features through Xfinity WiFi and the Xfinity app. Part of this new offering is WiFi Shield, which is included at no additional cost for Xfinity Internet customers with compatible gateways. It combines Xfinity's CyberSecure network protection, Family Settings, and WiFi Motion, with Home Watch, Away Watch, and Dark Watch modes used to control when notifications are generated. Comcast is also launching Shield Select for $15 per month, which adds an indoor camera, door/window sensor, cloud video storage, and 24/7 urgent response functionality.
A Heights Finance breach exposed personal and financial data of over 1.2 million people after hackers compromised a third-party cloud platform. Heights Finance is a U.S. consumer finance company that provides personal loans and related lending services, mainly to customers who may have limited access to traditional bank credit. It is part of Heights Finance Holdings Co. Heights Finance Holdings is notifying more than 1.2 million people that on May 7, 2026, Heights Finance discovered unauthorized access to a third-party cloud platform storing customer data. The company launched an investigation with external cybersecurity experts and notified federal law enforcement. “On May 7, 2026, Heights discovered that an unauthorized actor gained access to a cloud-based platform hosted by a third party that we use to store certain customer data. This activity was limited to the cloud-based platform only—it did not affect any of our loan management systems or other computer systems or networks. We immediately activated our incident response protocols, brought in outside cybersecurity specialists to investigate, and reported the incident to federal law enforcement.” reads the notice of data breach. “We have since confirmed that the cloud-based platform is secure and that there is no ongoing security threat. Our operations were not impacted by this incident and have continued safely and securely.” Heights said its internal systems and operations were not affected, the platform has been secured, and there is no ongoing threat. The compromised customer information included contact details, financial and bank account data, government IDs and dates of birth. The affected data varies by person and may involve Heights Finance customers, loan applicants, people who inquired about its products, or former borrowers of Curo Management and related brands. Heights Finance is offering affected individuals 24 months of free credit monitoring and identity protection. The company said dark web monitoring has found no evidence that the stolen data has been published. No threat actor has claimed responsibility, and no known ransomware or extortion group has been linked to the breach so far. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Heights Finance)
A custom Java web shell likely linked to the Clop ransomware gang was designed specifically for PTC Windchill and FlexPLM servers, with built-in features to decrypt credentials, enumerate file repositories, and steal files. Cybersecurity company ReliaQuest analyzed the web shell after it is believed to have been deployed in recent data theft attacks exploiting CVE-2026-12569, a critical remote code execution vulnerability affecting PTC Windchill. ReliaQuest says the implant is not a generic web shell repurposed for the attacks, but was instead built with detailed knowledge of Windchill's internal APIs, database schema, keystore, and file-vault structure. "This appears to be an application-specific evolution of Clop's established mass-exploitation playbook," ReliaQuest said in a report shared with BleepingComputer.
Microsoft has started testing a faster File Explorer and a less cluttered and more customizable context menu in Windows 11 preview builds rolling out to Insiders this week. As the File Explorer team explained in a Monday blog post, the changes focus on improving File Explorer speed, performance, and reliability and addressing customer-reported issues. The redesigned context menu experience also aims to make it faster, reduce clutter, and make it more customizable than ever before. At the bottom of the new right-click menu, Microsoft also added a "Customize menu" shortcut to the Settings page, where users can tweak the context menu to suit their preferences. "We've continued refining File Explorer based on that feedback, removing friction and improving the details that help make everyday tasks feel more natural and predictable. For example, file renames no longer get interrupted by background file synchronization, and case-only filename changes now appear immediately," Microsoft said.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that ransomware gangs are also exploiting a high-severity Windows Task Host vulnerability that was flagged as actively exploited in April. Task Host is a core Windows system component that allows DLL-based processes to run in the background and prevents data corruption by ensuring they close properly during shutdown. Tracked as CVE-2025-60710, this Windows privilege escalation security flaw was patched by Microsoft in November 2025 and stems from a link following weakness that affects Windows 11 and Windows Server 2025 devices. Following successful exploitation, local attackers with basic user permissions can gain SYSTEM privileges and take full control of unpatched devices. While it didn't share any details regarding ongoing attacks and Microsoft has yet to update its security advisory to confirm in-the-wild exploitation, CISA added CVE-2025-60710 to its list of actively exploited vulnerabilities on April 13 and gave Federal Civilian Executive Branch (FCEB) agencies two weeks to secure their systems.
GitLab patched a critical GraphQL flaw that let unauthenticated attackers remotely modify or delete public projects on self-managed servers. GitLab pushed out an emergency patch this week to address a critical flaw, tracked as CVE-2026-19478 (CVSS score of 9.4), that could let an attacker with zero credentials remotely modify or delete public projects and user data. “GitLab has remediated an issue that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQL directive.” reads the advisory. GitLab issued an emergency patch on August 17, five days after its regular update. The vulnerability impacts only self-managed installations, users should upgrade to versions 19.2.4, 19.1.6, 19.0.8, and 18.11.11. There’s a gap worth flagging for anyone still sitting on an older release. The available patches don’t cover the 18.2 through 18.10 branches, even though those versions technically fall inside the affected range. If you’re running anything in that window, staying put isn’t really an option; you’ll need to upgrade to a patched branch entirely rather than waiting for a fix that isn’t coming for your current one. hiimguardian reported the flaw through the company HackerOne bug bounty program. A second, less severe issue shipped in the same release. CVE-2026-19650 (CVSS score of 7.1), involves a cross-site request forgery weakness in how GitLab’s GraphQL handles multiplex queries, letting an unauthenticated attacker trigger mutations through GET requests due to improper validation. Unlike the critical flaw, this one needs a victim to actually interact with something, so it’s a real risk but a considerably narrower one. There’s no evidence either bug has been exploited in the wild yet, and no public proof-of-concept code has surfaced as of publication. That’s the good news. The less comforting part is GitLab’s own disclosure policy: full technical details typically go public on the company’s issue tracker 90 days after the patching release, which puts a working understanding of exactly how this bug functions squarely in mid-November, plenty of time for someone motivated enough to reverse-engineer the patch diff themselves before then. This is not the first serious GitLab issue in recent months. Last month, researchers released working exploit code for another remote-code-execution flaw affecting self-managed servers. Organizations running GitLab on their own infrastructure should therefore treat this patch as a priority, especially given the critical severity and the fact that the vulnerability requires no authentication or user interaction. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, GitLab)
Confirm this action.
Leaving now will discard your changes.