Weekly News

Your Weekly Cyber Update

Welcome to this week’s IT Security Cork digest. Stay informed with the latest in cybersecurity news, vulnerabilities, and practical steps your small business can take.

Published 2026-06-24 by IT Security Cork. Every item links to its original source.

This Week at a Glance

This week, Microsoft confirmed a zero-day vulnerability in its Defender software, known as RoguePlanet. This privilege escalation flaw poses a significant risk, emphasizing the need for timely patching to protect your systems.

Feature of the Week

Big Breaches in the Headlines

Two breaches made waves this week. Neither targets small businesses directly, but both carry a lesson worth taking on board.

ShinyHunters dumps 45 GB of stolen data after a ransom is refused

The well-known extortion group ShinyHunters published a 45 GB cache of data it had stolen from MSG, reportedly after the company declined to pay its ransom demand.

What small businesses should take from it: Attackers increasingly steal data and threaten to leak it, rather than just locking your files - and paying is never a guarantee it disappears. The priority is stopping the theft in the first place: turn on multi-factor authentication, limit who can reach sensitive data, and keep an eye out for unusual large downloads or transfers.

Attendee directory for an invitation-only tech retreat leaked online

Internal records and the full attendee directory for Dialog - an exclusive, invitation-only retreat for tech investors, politicians and financiers, co-founded by Peter Thiel - were leaked online.

What small businesses should take from it: Even small, exclusive, well-funded circles get breached, often through a guest list, a booking system, or another third party rather than a direct hack. Your customer lists and the outside services you rely on are part of your attack surface too, and deserve the same care as your own systems.

Vulnerabilities to Know About

HIGH SMB: HIGH NCSC Ireland Alerts and Advisories - 2026-06-18

SimpleHelp Authentication Bypass Critical Vulnerability

A critical authentication bypass issue in SimpleHelp could allow unauthorized users to access sensitive areas of the system.

What is it? SimpleHelp is remote-support software that lets IT staff connect to and control computers over the internet.

Why it matters: This flaw can lead to unauthorized access, compromising your business data and customer information.

Action: Update SimpleHelp software immediately to patch this vulnerability.

HIGH SMB: HIGH NCSC Ireland Alerts and Advisories - 2026-06-18

Veeam: Backup and Replication Critical Vulnerability

A critical vulnerability in Veeam's Backup and Replication could jeopardize data security by allowing unauthorized access or data corruption.

What is it? Veeam is backup and data-recovery software businesses use to protect their files and servers.

Why it matters: Data backups are vital for recovery in case of breaches or data loss; this flaw could leave you vulnerable.

Action: Check for any pending updates for Veeam Backup and Replication and apply them.

Microsoft / Windows Updates

MEDIUM SMB: MEDIUM NCSC Ireland Alerts and Advisories - 2026-06-18

Security Feature bypass in Windows OS(Multiple) - YellowKey

A security feature bypass issue in multiple Windows OS versions could let attackers manipulate security settings.

Why it matters: Exploited, this vulnerability could compromise your system's security measures, putting your business at risk.

Action: Ensure your Windows OS is up to date and monitor for any security patches.

Irish / EU Cyber Notes

HIGH SMB: HIGH CISA Cybersecurity Advisories - 2026-06-23

CISA Adds Four Known Exploited Vulnerabilities to Catalog

CISA has added four notable vulnerabilities, including issues related to Ubiquiti UniFi OS that could allow network attacks.

Why it matters: These vulnerabilities are actively being exploited, which can significantly endanger small businesses like yours.

Action: Review your Ubiquiti devices and apply any recommended updates to mitigate these risks.

CVEs: CVE-2025-67038, CVE-2026-34908, CVE-2026-34909, CVE-2026-34910

This Week from the ITSC Honeypot

We run a honeypot — a decoy server hosted on an Irish internet connection and deliberately left open — so we can observe the automated attacks that target everyday devices online. In the last 24 hours alone it logged 43,142 attack attempts from 40 countries.

Most-tried logins

#	Username	Password	Attempts
1	root	(blank)	665
2	root	admin	61
3	345gs5662d34	345gs5662d34	34
4	root	3245gs5662d34	11
5	localadmin	localadmin	5

Where the attacks came from

China 56%
United States 15%
Sweden 9%
Germany 2%
South Korea 2%
Taiwan 2%
Other countries 15%

Default or weak logins like these are exactly what attackers count on - use strong, unique passwords and turn on multi-factor authentication. Once in, the attacks were fully automated (each break-in attempt lasted about 6s on average), immediately probing the machine and trying to install malicious software, which is why prompt patching matters.

Small Business Action Checklist

Monitor for the upcoming Microsoft Defender patch and apply it promptly.
Update SimpleHelp software to fix the authentication bypass vulnerability.
Ensure Veeam Backup and Replication is up-to-date for data security.
Check your Windows OS for updates related to the security feature bypass.
Review and update your Ubiquiti devices to combat the identified vulnerabilities.

Wondering if any of this affects your business?

Most of the issues above are hard to spot on your own. The ITSC Pulse Platform continuously checks your business devices for missing updates, risky or outdated software, weak settings, and the kinds of vulnerabilities covered in this digest - then shows you in plain English exactly what needs attention. IT Security Cork can set it up for you and help you act on what it finds.

Talk to us about ITSC Pulse

Browse all weekly editions