
SAP Fixes OAuth2 SSRF That Can Expose BTP Application Credentials
SAP fixed an OAuth2 SSRF in Cloud SDK for Python that can expose BTP app credentials via tenant_subdomain. Learn affected versions and upgrade guidance.

SAP fixed an OAuth2 SSRF in Cloud SDK for Python that can expose BTP app credentials via tenant_subdomain. Learn affected versions and upgrade guidance.

TFG disclosed a cyberattack disrupting IT systems at Phase Eight, Hobbs and Whistles, with stores trading while data exposure remains under investigation.

Netskope reports XWorm uses 46 plugins for GPS, audio, webcam and authenticated browser session control on Windows systems.

GitLab patched CVE-2026-97229, a CVSS 10.0 CI/CD flaw that could allow unauthenticated code execution via crafted regex, plus three high-severity fixes.

Progress disclosed 31 MarkLogic Server flaws, including five critical issues that could let delegated admins gain persistent control or run elevated code.

Reported attack forced European supermarket refrigeration into defrost mode, spoiling food; Danfoss connection and cause remain unconfirmed.

Attackers reportedly triggered defrost cycles on refrigeration controllers at French supermarkets, raising temperatures as Paris prosecutors investigate.

Three Yandex data centers were hit by drones in a week, forcing shutdowns, emergency mode and disruptions to cloud customers and consumer services.

Microsoft says Windows 11 23H2 Enterprise, Education and IoT Enterprise get their last security update in November 2026 and should upgrade to 26H2.