News
Spring AI Vector Store Query Injection: Affected Versions and the Safe Update
AIDevelopmentSecurity
Spring AI, a popular Java framework for building generative-AI apps, has an 8.6 flaw (CVE-2026-47835) in its vector database integrations. Special characters let an attacker run unauthorized queries against Elasticsearch and others with no login, risking data exfiltration. Fixed in 1.0.9 / 1.1.8; developers should update now.
2026.06.1651 views
News
No attacks on Cisco SD-WAN's five new flaws, and CVE-2026-20310 is 9.1 not 9.9
SecurityGlobal CompaniesInfrastructure
Cisco Catalyst SD-WAN Manager, the system that centrally manages a company's WAN, has a vulnerability already confirmed to be exploited (CVE-2026-20262). With just a low-privileged login, an attacker can overwrite server files and seize root. Fixed releases are out; affected organizations should update now.
2026.06.1635 views
News
Takeover Flaw in the PAM Tool Fortra BoKS: CVE-2026-9862, Update to s-9.0.0.5 / s-8.1.0.23 Now
Global CompaniesSecurityInfrastructure
Fortra Core Privileged Access Manager (BoKS), used to centrally manage admin access across server fleets, has a 9.8 flaw (CVE-2026-9862). With no login, an attacker on the internal network can take over the central server and seize company-wide privilege. Fixed releases s-9.0.0.5 and s-8.1.0.23 are out; affected orgs should update now.
2026.06.1634 views
News
Max-Severity Takeover Flaw in a WooCommerce Invoice Plugin: CVE-2026-52704, Update to 2.0.9 Now
SecurityDevelopment
WooCommerce PDF Invoice Builder, a popular plugin for generating invoice PDFs on WordPress stores, has a max-severity flaw (CVE-2026-52704, scored 10.0). With no login required, anyone can take over the shop's server over the internet. The fixed version 2.0.9 is out; update affected stores now.
2026.06.1628 views
News
Takeover Flaw in Foxit's AI PDF Tool: CVE-2026-12057, a Crafted PDF Can Lead to Remote Code Execution
AIGlobal CompaniesSecurity
Foxit AI, the browser-based AI PDF service, has a takeover flaw (CVE-2026-12057, severity 8.6). Feeding it a crafted PDF lets instructions hidden inside the file call out to an external program and run attacker code. Foxit applied a fix on June 15, 2026, and there are no reports of abuse so far.
2026.06.1534 views
Roundup
Hacker and Ransomware Groups Explained: Qilin, Anonymous, and Attacks on Japan
PrivacySecurityLawsuits & Regulation
A guide to the hacker and ransomware groups you see in the news—Qilin, Anonymous, North Korea's Lazarus and more—sorted into four types: ransomware, state-backed, social extortion and hacktivist. Where they came from, who's in them, which famous companies they hit, and what it means for ordinary life, including groups that struck Japan's Asahi, KADOKAWA and local governments.
2026.06.1563 views
Roundup
Asahi Net Profit Falls 36.7% (Confirmed): The Full Ransomware Chain Behind It, From Breach to Earnings
SecurityJapanese CompaniesPrivacy
In June 2026 Asahi Group cut its net-profit outlook from 167.5 billion to 120 billion yen, blaming the September 2025 ransomware attack. We trace the nine-month chain—breach via a VPN device, halted orders and shipping, 115,513 leaked records, the refusal to pay Qilin, and the 47.5-billion-yen hit—and explain what hole was breached and how the company responded.
2026.06.15158 views
Roundup
What Is the Hotel Core System "NEHOPS"? The Jtas Cleaning Integration, Explained
AIJapanese Companies
NEC's hotel core system NEHOPS—covering booking, front desk and accounting—deepened its integration with Edeyans' room-cleaning system Jtas in June 2026. Order items and requests now pass in real time instead of once a day, and free memos are parsed by AI into cleaning instructions. We explain what NEHOPS is, what it automates, and what it means for hotels and guests.
2026.06.1520 views
Roundup
Why ANA's Domestic Renewal Turned to Chaos: The Changes and Causes Explained
Japanese CompaniesInfrastructure
ANA replaced the domestic booking system it used for ~50 years with Amadeus Altéa, the same platform as its international flights. Since the May 19, 2026 renewal, users report online check-in glitches, seat-assignment errors and inquiry replies taking two weeks to two months. We explain what changed (three-tier fares and more), why customer touchpoints broke down, and how it differs from past migration failures.
2026.06.15102 views
News
Is Your Mitsubishi Wi-Fi Air Conditioner Safe? Hard-coded Password Flaw (CVE-2026-5667)
Japanese CompaniesSecurity
Mitsubishi Electric disclosed that many Wi-Fi-enabled home appliances—air conditioners, refrigerators, water heaters, IH cooktops, rice cookers and more—shipped with a hard-coded password (CVE-2026-5667). Appliances left with Wi-Fi on but never connected to a home router can let a nearby third party read operating data or change settings. Here are the affected models and what to do now.
2026.06.1573 views
News
LiteSpeed cPanel Plugin: 2nd Takeover Flaw CVE-2026-54420, Fix v2.4.8
SecurityGlobal CompaniesInfrastructure
A second takeover flaw, CVE-2026-54420, hits the LiteSpeed cPanel plugin a month after the first. One cheap plan can seize neighbors' sites. Fix: v2.4.8.
2026.06.1432 views
News
Claude Fable 5 is back after 19 days as US export controls lift
Global CompaniesAILawsuits & Regulation
Three days after launch, Anthropic disabled Claude Fable 5 and Mythos 5 worldwide to comply with a US Commerce Department export-control directive targeting foreign nationals. Users and companies in Japan are caught in the cutoff too.
2026.06.1343 views
