In today’s cybersecurity news…

Feds require Anthropic to ban ‘foreign national’ access to Fable, Mythos

Following up on a product that has dominated headlines this past week, Anthropic has “suspended access to its two most capable AI models, Fable 5 and Mythos 5, for all users worldwide after the U.S. government issued an export control directive ordering the company to block access by any foreign national.” This directive, which was sent to Anthropic late Friday, cites “national security authorities and bars access to both models by foreign nationals inside or outside the United States, including Anthropic’s own foreign-national employees.” This happened just at the moment that Anthropic started rolling out Fable 5 to all Pro, Max, and Enterprise customers. so this rollout is now offline.

(BleepingComputer)

Maine disables data breach notification portal after fake disclosures

The Attorney General’s Office of the state of Maine has “taken its public data breach reporting portal offline after fraudulent breach disclosures were published on the state’s website, prompting a review of procedures to prevent abuse in the future.” The fake notifications related to Discord and the multiplayer social virtual reality platform VRChat, a filing that proved fraudulent. The Attorney General’s Office says it has now temporarily disabled public access to the breach notification database while it reviews reporting procedures to reduce similar abuse in the future. “Companies can continue to submit breach notifications through the reporting service, but members of the public seeking copies of disclosures must now contact the Attorney General’s Office directly.”

(BleepingComputer)

ShinyHunters extorts universities through exploiting an unpatched Oracle flaw

Researchers from Mandiant and Google Threat Intelligence Group are warning that the gang is exploiting an Oracle PeopleSoft zero-day vulnerability, potentially infiltrating the networks of more than 100 organizations, many of which are in higher education. This includes the University of Nottingham, as we reported on Friday. These attacks date back to at least May 27, according to Mandiant, and involve the exploitation of a CVE numbered (CVE-2026-35273) defect in Oracle PeopleSoft PeopleTools. The defect allows unauthenticated attackers to execute remote code and take over affected servers. This campaign is still active and the vulnerability remains unpatched.

(Cyberscoop)

Critical Splunk Enterprise flaw warning

Teams from Cisco’s Splunk have released security updates “to address a critical security flaw in Splunk Enterprise that could be exploited to conduct unauthenticated file operations and even remote code execution.” The CVE numbered vulnerability (CVE-2026-20253) has a CVSS rating of 9.8. In select Splunk Enterprise versions, an unauthenticated user could create or truncate arbitrary files through a PostgreSQL sidecar service endpoint,” Splunk said in an alert this week. Cisco says Splunk Cloud is not impacted by the vulnerability as Postgres sidecars are not used in the product.

(The Hacker News)

Huge thanks to our episode sponsor, ThreatLocker

Pharma company Novo Nordisk reports cyberattack

The Danish pharmaceutical giant says, “data related to clinical trial participants was stolen as part of a cyberattack.” The patient data stolen had been pseudonymized, meaning there were no direct links to names or other personal identifiers, the company said. The attack focused on data supporting the company’s Wegovy weight-loss drug. Although the company, which also manages the Ozempic weight loss product, does not believe there is “an immediate risk stemming from the breach, it nonetheless warned patients to remain vigilant for anything that could be connected to the data stolen during the attack.”

(The Register)

KPMG pulls report on AI usage due to apparent hallucinations

“Professional services firm KPMG has pulled a report titled, ‘Redefining excellence in the age of agentic AI,’ after numerous organizations said the report’s claims about their AI usage were untrue. The research group GPTZero identified numerous inaccuracies in the report, which had been published in October 2025. These inaccuracies stemmed from AI hallucinations, which suggests the firm used AI to help write a report about AI. Companies such as Swiss multinational investment bank UBS, the UK’s National Health Service, Swiss Federal Railways, and Transport for London “all told the Financial Times that the report’s claims about their AI usage were either untrue or misleading.

(TechCrunch)

Microsoft fixes Windows update failures linked to WUSA installer

This was a known issue “that caused Windows updates released since May 2025 to fail when installed via the Windows Update Standalone Installer (WUSA) from a network share.” It affects Windows 11 24H2/25H2 and Windows Server 2025 devices on enterprise networks and is not a common method for installing updates on home devices. The company says, “These issues might occur on devices that installed updates released May 28, 2025 (KB5058499) and later.” Microsoft first mitigated this known issue automatically on home and non-managed business devices through a Known Issue Rollback Group Policy beginning September 2025.

(BleepingComputer)

Ukrainian Conti hacker pleads guilty

Following up on a story we covered in November, Ukrainian national Oleksii Lytvynenko, who had been extradited from Ireland to the U.S., has now pleaded guilty to conspiracy to commit wire fraud for his work with the Conti ransomware operation. “Prosecutors said he helped conduct attacks between 2021 and 2022, during which victims’ systems were encrypted, data was stolen, and Bitcoin ransom payments were demanded from organizations in the U.S. and other countries.”  He is scheduled to be sentenced on September 10, 2026, and faces up to 20 years in prison.

(Security Affairs)