patch management4 articles
FBI Boots Accenture Contractor After ShinyHunters Breach Traced to Unpatched System
The FBI removed an Accenture contractor following a data breach by the ShinyHunters cybercrime group, which exploited an unpatched vulnerability in Oracle's PeopleSoft HR platform to access personal information of thousands of bureau employees. FBI cyber chief Brett Leatherman confirmed the breach resulted from the contractor's failure to apply a security patch issued to secure the system. ShinyHunters claimed the attack was intended to pressure the FBI over a report the group alleged contained false information about them, though law enforcement has since arrested two alleged leaders of the group.
AI Just Killed Security Through Obscurity. It Was Never That Healthy to Begin With.
AI has rendered "security through obscurity" completely obsolete, as both defenders and attackers now use AI agents to rapidly discover vulnerabilities in systems that were previously considered secure due to their complexity or obscurity — including decades-old protocols and critical industrial control systems. While this is accelerating the pace of vulnerability discovery to record levels, AI-generated patches remain unreliable, succeeding only around a quarter of the time, meaning defenders face a growing backlog with inadequate automated tools to address it. Security experts warn that organisations must move beyond simply finding and patching individual bugs, and instead focus on identifying systemic process failures to prevent vulnerabilities at scale.
ServiceNow RCE Flaw Exploited Within Days of Patch — But Who's Actually Behind It?
A critical remote code execution vulnerability in ServiceNow (CVE-2026-6875) is reportedly being exploited in the wild just days after patches were released on July 14 and technical details were publicly disclosed. Threat intelligence firm Defused observed exploitation activity on July 18, though closer analysis revealed the payload was identical to a published proof-of-concept rather than an independently developed exploit. ServiceNow states it has found no evidence of compromise on its hosted instances, and there is speculation the activity may originate from security researchers rather than malicious threat actors.
One Researcher Is Making Microsoft's Life Very Difficult, Six Weeks Running
A security researcher known as "Nightmare Eclipse" has disclosed six Windows vulnerabilities over six weeks, including three new ones — YellowKey, GreenPlasma, and MiniPlasma — revealed shortly after Microsoft's May 2026 Patch Tuesday. These flaws target core Windows security components, enabling attacks such as BitLocker bypass, privilege escalation to SYSTEM, and exploitation of a vulnerability Microsoft believed it had patched in 2020. Microsoft has only officially patched one of the six flaws so far, and experts warn that the researcher's deliberate timing — releasing disclosures immediately after Patch Tuesday — maximises the window of exposure before the next patch cycle.