January 2026
4 pieces, newest first.
- A hospital knew in August and could say what happened in January
January 27, 2026 · 3 sources
159 days between detecting an intrusion and being able to say what was taken. Notification cannot start until that second clock stops.
- A 9.4 in the single sign-on, and the patch did not help
January 21, 2026 · 4 sources
An authentication bypass in FortiCloud SSO, exploited from 21 January against devices that were already fully patched.
- The automation platform was the credential store nobody inventoried
January 7, 2026 · 4 sources
A CVSS 10.0 chain in n8n reached a forged administrator session. What it opened was every credential the platform had been given.
- 716,000 people, 120 brands, and a company none of them chose
January 7, 2026 · 4 sources
A telehealth platform behind 120 consumer brands was accessed across two days. Two irreconcilable totals are still in circulation.