ServiceNow will buy device intelligence firm Armis for $7.75 billion in cash, aiming to fuse real-time asset discovery and risk prioritization with automated remediation workflows. The combined platform targets unified exposure management across IT, OT, and medical devices, with AI-native detection and response capabilities to reduce mean time to secure sprawling, connected environments.
Source: SecurityWeek
Aflac breach exposes personal and health data of 22.6 million people
US insurer Aflac confirmed that attackers stole sensitive data including Social Security numbers, identity documents, and health information affecting 22.6 million individuals. The company is notifying regulators and victims; the scale and data types raise risks of identity theft and fraud for years to come.
Source: TechCrunch
US disrupts large-scale bank account takeover scheme powered by search ads
Authorities seized infrastructure behind a multimillion-dollar operation that used fraudulent search ads mimicking banks to harvest credentials and drain accounts. Investigators say losses reached at least $14.6 million, underscoring the continued abuse of search advertising for brand impersonation and credential phishing.
Source: The Record
Malicious npm package with 56,000 downloads steals WhatsApp credentials and data
A trojanized npm package dubbed “lotusbail” blended legitimate functionality with data theft to exfiltrate WhatsApp session information and deploy a backdoor. The incident highlights supply chain risk in popular developer ecosystems and the need for dependency vetting, provenance checks, and rapid revocation of compromised tokens.
Source: SecurityWeek
Critical n8n workflow platform flaw allows near–full takeover (CVSS 9.9)
A critical vulnerability in the n8n automation platform (CVE-2025-68613) could enable arbitrary code execution under specific conditions, potentially compromising thousands of instances. With tens of thousands of weekly downloads, admins should update immediately and harden instance exposure, secrets handling, and expression evaluation paths.
Source: The Hacker News
Nissan confirms exposure of 21,000 customers via Red Hat GitLab breach
Nissan said personal data of roughly 21,000 customers was stolen after attackers compromised Red Hat’s self-managed GitLab instance, illustrating downstream supply chain impacts. The breach follows claims by the Crimson Collective group and shows how third-party developer platforms can become a pivot point to sensitive customer records.
Source: SecurityWeek
Malware disguised as PoC exploits targets researchers via GitHub
Kaspersky detailed “Webrat,” a trojan spread through GitHub repositories masquerading as proof-of-concept exploits and game cheats, aimed at infosec enthusiasts and aspiring hackers. The malware can steal messenger tokens and crypto wallets, log keystrokes, record screens, and act as a backdoor—reinforcing the need to verify PoCs and isolate testing environments.
Source: Securelist (Kaspersky)
You May Also Be Interested In...
Ransomware attack disrupts Romania’s national water authority
OpenAI says prompt injection attacks are a long-term security challenge
Italy fines Apple €98.6M over App Tracking Transparency rules