Patch Now: 25-Year-Old cURL Flaw, Chrome Updates, and Ransomware Surge

by The Creator | Jun 25, 2026

Ransomware recovery starts with backups that attackers cannot reach. This week's 50% surge in European ransomware attacks targeting manufacturers signals an urgent shift in U.S. threat patterns, particularly in Connecticut and the Northeast.

A critical 25-year-old vulnerability in cURL software was just patched, affecting 30 billion devices worldwide. This legacy flaw reminds us that hidden security gaps can lurk in widely-used code for decades. Businesses should ensure automatic updates are enabled for all networked software.

Google Chrome released urgent security updates addressing 18 vulnerabilities, including four critical flaws that could allow attackers to escape the browser's security sandbox. All Chrome users should update immediately.

A sophisticated new phishing kit targeting AWS users can steal both passwords and multi-factor authentication codes in real time. This represents an evolution in phishing tactics, even MFA isn't foolproof. Employee training on verifying login pages is essential.

For Mac users, a newly disclosed flaw allows any standard user to disable critical enterprise security tools like EDR and MDM. Organizations using Macs should review their security configurations immediately.

Finally, ransomware attacks in Europe have surged over 50% in the past year, with manufacturing and supply chain sectors heavily targeted. This trend is expected to impact U.S. businesses, especially in the Northeast. Connecticut business owners should prioritize robust backup strategies and comprehensive employee cybersecurity training.

The key takeaway: cybersecurity requires multiple layers of defense, not a single solution. Stay vigilant, keep systems updated, and invest in ongoing security awareness.

How should small manufacturers approach ransomware recovery?

European ransomware attacks climbed 50% over the past year, with manufacturing and supply chain sectors in the crosshairs. Connecticut manufacturers and professional services firms face the same exposure as U.S. attacks follow. Ransomware recovery depends on three controls: automated offsite backups disconnected from production networks, documented incident response procedures that name who contacts law enforcement and regulators, and employee training on phishing that precedes most attacks. CISA and Connecticut DAS both recommend testing backup restoration quarterly. The single most important action: verify your backups work outside your network today, not during an attack.

Key takeaways

Ransomware recovery requires offsite backups disconnected from production networks; test restoration quarterly
Phishing attacks now steal both passwords and MFA codes; employee training on credential verification is mandatory
A 25-year-old cURL vulnerability affected 30 billion devices; enable automatic updates for all networked software immediately
Manufacturing and supply chain sectors face 50% higher attack rates; prioritize incident response planning now

Frequently asked questions

What should we do if ransomware locks our systems?

First, isolate infected machines from the network immediately to stop spread. Restore from clean backups stored offsite. Contact law enforcement (FBI local office) and your insurance carrier within hours. Do not pay ransom without legal counsel.

How often should we test ransomware recovery backups?

CISA recommends quarterly restoration tests to ensure backups are clean and complete. Test one department per month on a schedule so the process becomes routine.

Why is MFA not stopping these phishing attacks?

The new AWS phishing kit steals both passwords and real-time MFA codes by capturing login pages. Train employees to verify the exact URL and domain before entering credentials. Look for subtle spelling differences.

Which sectors should prioritize ransomware recovery plans first?

Manufacturing, supply chain, and professional services face the highest attack rates. Any firm relying on continuous production or client deadlines cannot afford downtime without a recovery plan.