The National Geospatial-Intelligence Agency is integrating AI into its operations while trying to move quickly enough to keep pace with adversaries without compromising established intelligence methods. NGA is investing in secure, agentic AI systems and a three-to-five-year workforce and infrastructure transformation to ensure AI augments analysts rather than replaces them. #NGA #China
Category: Cyber Security News
VECT 2.0 is marketed as ransomware but a critical flaw in its encryption across Windows, Linux, and ESXi causes files larger than 131,072 bytes to be permanently destroyed, making recovery impossible. The operation’s RaaS affiliate model and partnerships with TeamPCP and BreachForums increase attack reach, but analysts warn that paying ransoms…
A Brazil-origin cybercrime group known as LofyGang has resurfaced after more than three years to target Minecraft players with a new stealer called LofyStealer (aka GrabBot) disguised as a fake “Slinky” hack. The campaign uses a JavaScript loader to deploy “chromelevator.exe” in memory to harvest cookies, passwords, tokens, cards and IBANs…
A critical command-injection vulnerability (CVE-2026-3854) in GitHub’s internal protocol allowed an authenticated user with push access to achieve remote code execution on GitHub.com and GitHub Enterprise Server with a single git push. Discovered by Wiz and patched quickly on GitHub.com with GHES updates released for multiple versions, the flaw could enable…
A critical SQL-injection vulnerability (CVE-2026-42208) in the LiteLLM proxy API key verification allows unauthenticated attackers to send crafted Authorization headers to any LLM route and read or modify the proxy database. Active, targeted exploitation began about 36 hours after disclosure—operators used malicious Authorization: Bearer headers against /chat/completions to extract API and provider credentials, and LiteLLM 1.83.7 fixes the bug with parameterized queries while maintainers recommend rotating keys and applying the workaround if an upgrade isn’t possible. #LiteLLM #CVE-2026-42208
Researchers warn VECT 2.0 ransomware mishandles encryption nonces for chunked large-file encryption, overwriting previous nonces so only the final chunk’s nonce is saved. Because lost nonces are neither stored nor transmitted, most large files—including VM disks, databases, and backups above 128 KB—are effectively destroyed, and the operators have promoted VECT on BreachForums and announced a partnership with TeamPCP to exploit supply-chain compromises. #VECT2.0 #TeamPCP
Anthropic’s Claude Mythos Preview showed that agentic AI can autonomously discover and exploit software vulnerabilities with alarming precision, leading the company to withhold the model from public release. Defenders must adopt a new security architecture built on unified visibility, real-time contextual intelligence, and autonomous agentic control to match attacks operating at…
Vimeo confirmed hackers accessed databases through a third-party analytics vendor, exposing technical data, video titles and metadata, and some customer email addresses while stating video content, user login credentials, and payment card information were not taken. The company disabled Anodot integrations, notified law enforcement, and faces a ransom threat after ShinyHunters…
Resilience’s insurance claims data helps CISOs translate technical cyber risk into monetary terms that CFOs and boards understand, making it easier to secure adequate security budgets. Their manufacturing portfolio shows ransomware caused 90% of incurred loss while misconfigured MFA (26%) and unpatched software (13%) were leading failure points, prompting recommendations to…
Coinbase Cartel is an extortion-only group that has claimed over 100 victims by exfiltrating data rather than encrypting files, allowing systems to remain operational while sensitive corporate information is leaked. Hudson Rock’s intelligence shows the cartel predominantly gains access using old Infostealer‑harvested credentials (e.g., RedLine, Lumma, Vidar) to compromise cloud, FTP, and file‑sharing services, complicating attribution and remediation. #CoinbaseCartel #RedLine
Federal CIO Greg Barbaccia said the government is approaching Anthropic’s Mythos model with measured expectations, acknowledging its potential to speed vulnerability discovery while noting uncertainty about real-world effectiveness. The Office of Management and Budget is preparing a controlled rollout as agencies like the Department of the Treasury seek access, but officials stress laboratory findings must be validated against defended federal networks. #Mythos #Anthropic
Vimeo disclosed that some customer and user data was accessed without authorization after a breach at Anodot, with exposed information mainly consisting of technical data, video titles, metadata, and some email addresses. The extortion group ShinyHunters claimed the incident and threatened to publish data from Vimeo’s Snowflake and BigQuery instances, prompting Vimeo to disable Anodot credentials, remove the integration, and investigate with third-party experts and law enforcement. #Vimeo #ShinyHunters
Illinois Rep. Delia Ramirez has been named the top Democrat on the House Homeland Security panel’s Subcommittee on Cybersecurity and Infrastructure Protection, replacing Eric Swalwell after his resignation. Ramirez, reelected in 2024 and formerly the committee’s vice ranking member, has criticized CISA staffing cuts and data-security decisions tied to the Department of Government Efficiency initiative and has cited incidents like the SolarWinds breach as national security concerns. #DeliaRamirez #CISA
Microsoft will start blocking legacy TLS 1.0 and TLS 1.1 connections for POP and IMAP email clients in Exchange Online beginning in July 2026. Most users running modern clients that support TLS 1.2 or later won’t be affected, but legacy devices and custom applications must be updated or they will fail to connect. #ExchangeOnline #TLS1.2
Application security firm Checkmarx confirmed that the LAPSUS$ threat group leaked data stolen from its private GitHub repository after gaining credentials via a Trivy supply-chain attack linked to TeamPCP. The attackers published malicious Docker images and VSCode/Open VSX extensions for the KICS scanner that exfiltrated credentials, keys, tokens, and config files, and Checkmarx says the repository is blocked while a forensic investigation continues. #LAPSUS #Checkmarx