#BeyondMachines

MyPillow allegedly suffered a data breach after the Play ransomware group claimed a breach and leaked 9.8 GB of sensitive internal data, including Social Security numbers and financial records.

Kennedy McLaughlin & Associates, an Australian accounting firm, confirmed a data breach after the Qilin ransomware group published stolen client financial records and internal company data.

New Zealand health supplement manufacturer Alpha Group Holdings has been listed on the Qilin ransomware leak site, though no stolen data has been published to verify the claim.…

UK Visa Portal exposed over 100,000 sensitive documents, including passports and selfies, due to a misconfigured Amazon S3 bucket and a backend website bug.

Carnival Corporation reported a data breach resulting from a social engineering attack on an employee account that exposed names, addresses, and government identification numbers.

Rich Products Corporation reported a data breach affecting approximately 200 individuals after a phishing attack compromised a third-party vendor's employee email account.

Gogs is reported to have a critical unpatched authenticated RCE vulnerability (CVSS 9.4) that allows users to execute arbitrary code via malicious branch names during rebase operations.…

Pick n Pay confirmed a data breach of its legacy delivery app, exposing personal details and partial payment information of users registered before 2022. The 639MB database is being sold on the dark web.

Everest Ito Group, LLP reports a data breach that exposed the names and Social Security numbers of an undisclosed number of individuals.The firm id offering two years of identity monitoring services.

Juventus Football Club reported a data breach at a third-party photographic supplier that exposed an archive of event images captured between 2023 and 2025.

OpenAI suffered a supply chain attack via the TanStack npm library, leading to the theft of code-signing certificates.

NGINX disclosed a critical 18-year-old heap buffer overflow vulnerability (CVE-2026-42945) in its rewrite module that allows unauthenticated remote code execution or denial-of-service via crafted HTTP requests.

OpenLoop Health, a telehealth infrastructure provider, expirienced a data breach in January 2026 that exposed the personal and medical information of 716,000 individuals.

Foxconn's North American factories suffered a ransomware attack by the Nitrogen group, resulting in the alleged theft of 8TB of data including confidential hardware schematics for major tech clients.…

West Pharmaceutical Services suffered a global ransomware attack on May 4, 2026, involving data stolen and system encryption that disrupted manufacturing and shipping operations.

Škoda Auto disclosed a data breach after attackers exploited a vulnerability in its online shop software to access customer personal information and hashed login credentials.…

RubyGems suspended new account registrations after attackers uploaded hundreds of malicious packages containing exploits to the repository.

PHP released emergency updates to fix five vulnerabilities, including two critical use-after-free flaws (CVE-2026-6722 and CVE-2026-7261) that allow unauthenticated remote code execution via the SOAP extension.

Ahmed Al-Kadi Private Hospital in South Africa suffered a ransomware attack on April 18, 2026, leading to network encryption and potential patient data exposure.…

SAP's May 2026 security update addresses 15 vulnerabilities, including two critical flaws (CVE-2026-34263 and CVE-2026-34260) that allow unauthenticated remote code execution and SQL injection.