LastPass says Klue breach affected customer information, but passwords remain secure.

Top stories: Klue suffered a supply-chain breach that exposed customer contact details and support case records (including LastPass customer information) after attackers stole OAuth tokens; LastPass states customer vaults and passwords remain secure. Attackers are observed exploiting a high-severity SSRF-to-root flaw (CVE-2026-20230) in Cisco Unified Communications Manager, with active exploitation reported. An alleged administrator of the Market0Day and Spoxy criminal marketplaces was extradited to the US, accused of running phishing kits and defrauding financial institutions.