Category: Cyber Security News

GitHub has introduced staged publishing for npm, requiring human maintainer approval with 2FA before packages become publicly installable, adding stronger proof of presence for releases. It also added new install source flags to help developers tightly control non-registry installs amid a surge in supply chain attacks, including large-scale package poisoning by…

Italian authorities dismantled the CINEMAGOAL piracy network, which used a covert app to give users access to Netflix, Disney+, Spotify, and other platforms through stolen authentication codes. The operation, coordinated with Eurojust and known as “Tutto Chiaro,” led to server seizures in France and Germany, widespread searches across Italy, and the identification of resellers, subscribers, and illicit profits. #CINEMAGOAL #Eurojust #GuardiaDiFinanza #Netflix #DisneyPlus #Spotify

Threat actors are abusing the Underminr technique to hide connections to malicious domains by exploiting shared CDN infrastructure and mismatches between DNS, SNI, Host headers, and edge IP routing. The abuse can help conceal C&C traffic, VPN and proxy connections, and bypass Protective DNS and network egress controls across millions of…

CISA has added CVE-2026-9082, a critical SQL injection flaw in Drupal Core, to its KEV catalog after evidence of active exploitation. Imperva reported more than 15,000 attack attempts against nearly 6,000 sites in 65 countries, with gaming and financial services sites among the main targets. #DrupalCore #CVE-2026-9082 #Imperva #CISA…

LiteSpeed User-End cPanel Plugin is affected by CVE-2026-48172, a critical privilege assignment flaw that is being actively exploited to run arbitrary scripts as root. Users should check for signs of exploitation, upgrade to cPanel plugin v2.4.7 or WHM plugin v5.3.1.0, or uninstall the plugin if patching cannot be done immediately. #CVE-2026-48172…

Webworm, a China-backed persistent threat actor, has shifted its targeting from Asia to European governmental organizations and is using stealthier command-and-control methods like Discord, Microsoft Graph, and custom proxy tools. ESET says the group has evolved its tradecraft in 2024–2025, replacing older malware such as McRat and Trochilus with backdoors like EchoCreep and GraphWorm while continuing to probe for vulnerabilities and hidden access points. #Webworm #EchoCreep #GraphWorm #McRat #Trochilus #SoftEtherVPN #Vultr #IT7Networks #WormFrp #ChainWorm #SmuxProxy #WormSocket

Meta agreed to settle a lawsuit brought by Kentucky’s Breathitt County School District over claims that its platforms used addictive design practices that harmed students’ mental health. The case was the first of more than 1,200 similar school district lawsuits targeting Meta, Snap, YouTube, and TikTok, many of which allege that…

The FBI warns that Kali365 is a Telegram-based phishing-as-a-service platform used to capture OAuth tokens and bypass MFA to gain unauthorized access to Microsoft 365 accounts. The service is enabling large-scale attacks against Outlook, Teams, and OneDrive by using branded phishing lures, automated campaigns, and reusable access tokens. #Kali365 #Microsoft365 #Telegram…

Authorities in Europe and North America have dismantled First VPN Service, a criminal VPN platform used to hide the origins of ransomware attacks, data theft, scanning, and denial-of-service activity. The operation seized infrastructure, took down servers, and exposed a service that had supported at least 25 ransomware groups, including Avaddon Ransomware….

The FBI has warned that Kali365 is a growing phishing-as-a-service platform that steals Microsoft 365 OAuth access tokens by abusing device code authorizations and bypassing multi-factor authentication. The tool gives attackers persistent access to accounts and can enable data theft, fraud, extortion, and ransomware activity. #FBI #Kali365 #Microsoft365 #OAuth

Two former executives of C.A. Cloud Attribution, Ltd. pleaded guilty to concealing a long-running tech support fraud operation that targeted victims worldwide through deceptive pop-up alerts and fake technical support calls. Prosecutors said Adam Young and Harrison Gevirtz knew their customers were scamming people, yet helped sustain the scheme that impersonated Microsoft and Apple and used offshore call centers in Tunisia. #C.A.Cloud #AdamYoung #HarrisonGevirtz #Microsoft #Apple

Dutch investigators arrested two men and seized 800 servers tied to Stark Industries, a web hosting operation accused of supporting cyberattacks, disinformation, and sanctioned Russian and Belarusian entities. The infrastructure was allegedly moved to WorkTitans B.V. / THE.Hosting, which authorities and media reports linked to support for the pro-Russian group NoName057(16) and other disruptive operations. #StarkIndustries #WorkTitans #THEHosting #NoName05716

Ghostwriter is targeting Ukrainian government organizations with phishing emails that use Prometheus-themed lures, leading to a multi-stage infection chain that deploys OYSTERFRESH, OYSTERBLUES, and OYSTERSHUCK before loading Cobalt Strike. The broader report also highlights Russia-linked use of AI tools for target scouting and malware generation, along with a pro-Kremlin propaganda campaign…

This week’s roundup covers major cybersecurity developments, including suspected Iranian breaches of US gas station tank monitors, exposed CISA contractor credentials, and a Huawei router flaw that disrupted Luxembourg’s telecom network. It also highlights active exploitation of Four-Faith router vulnerabilities, a high-severity Open WebUI SSRF issue, and new efforts from Anthropic…