The attack surface keeps expanding in plain sight. |
From browser add-ons and automation tools to cloud providers and national defenses, attackers are finding quiet ways in while pressure builds on those left to respond.
Read past newsletters here. |
|
| Here’s what you need to know: |
|
|
900K Chrome Users Exposed by Rogue Extensions |
Malicious Chrome extensions masquerading as productivity tools quietly exposed sensitive AI conversations from over 900,000 users. OX Security researchers say the extensions abused trusted Chrome APIs and misleading “anonymous analytics” permissions to capture full ChatGPT and DeepSeek conversations. |
At the time of writing, Google continues to investigate the extensions and the campaign is still active in the wild. Remove malicious extensions immediately, lock down extension installs with allowlists, monitor browser and network activity, apply DLP to AI usage, and train users. |
Extortion Gang Claims 1M Brightspeed Records |
A broadband provider is investigating extortion claims alleging the theft of sensitive customer data. Brightspeed says it is investigating Crimson Collective’s claims that data from more than one million customers was stolen, potentially exposing personal, account, and limited payment information across 20 states. The investigation is ongoing at this time.
Strengthen identity and cloud access controls, monitor for unusual data movement, apply DLP and logging, and regularly test incident response plans. |
Critical n8n Flaw Enables Remote Code Execution |
A critical vulnerability was disclosed in the n8n workflow automation platform that allows authenticated users to execute arbitrary code on affected systems.
The flaw affects both self-hosted and cloud-based n8n deployments, allowing authenticated users to execute untrusted code and potentially fully compromise affected instances. A patch has been released for the vulnerability.
Patch n8n to version 1.121.3 or later immediately, restrict access to trusted users, disable the Git node on unpatched systems, rotate secrets, and monitor logs closely for signs of misuse. |
|
|
Hackers claim they breached your company — what’s your first move? |
|
|
Yesterday's Pulse Check Results |
If an attacker landed in your test environment today… |
|
|
Security Tools You Can Use |
|
|
UK Unveils £210M National Cyber Plan |
The UK government has launched a £210 million cyber action plan in response to nationally significant cyber incidents more than doubling to 204 cases year over year.
Officials say the plan marks a shift from reactive patching to proactive cyber defense, led by a new Government Cyber Unit coordinating efforts across departments and raising resilience requirements for critical-sector partners. |
The move signals growing regulatory pressure on incident reporting, response readiness, and software security as governments treat cyber risk as a systemic issue.
Review incident response plans and reporting timelines now to align with emerging regulatory expectations before mandates take effect. |
SafePay Ransomware Squeezes Regulated SMBs |
New analysis shows SafePay ransomware deliberately targets regulated SMBs to maximize operational and compliance pressure. Flare researchers found that over 90% of SafePay’s victims are SMBs — large enough to pay but often lacking resilience to prolonged downtime or regulatory scrutiny. This targeting strategy maximizes pressure by exploiting the limited financial and operational flexibility of smaller organizations.
Integrate ransomware leak intelligence into risk workflows, harden identity and access controls, limit lateral movement, improve detection and backups, and regularly test incident response plans. |
|
|
How Secure Are Today’s Small Businesses? |
Small and mid-sized businesses are increasingly targeted by cybercriminals because they often lack dedicated security teams but still hold valuable data. As a result, attackers view SMBs as high-impact targets where relatively simple attacks can cause outsized disruption. |
Source: Tim Mossholder/Unsplash |
How to reduce cyber risk for SMBs: |
-
Enforce strong identity hygiene by using multi-factor authentication, limiting user privileges, and monitoring accounts for unusual activity.
- Reduce exposure to common attacks by patching systems promptly and training employees to recognize social engineering attempts.
-
Improve resilience by maintaining regular, offline backups and ensuring logs and alerts are in place to detect and respond to incidents quickly.
|
Strong security habits don’t require enterprise budgets — just consistent execution of a few well-chosen controls to reduce risk without added complexity. |
|
|
| Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field.
|
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2026 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
