Russian cyberattacks claimed by hacker group Noname057 targeted around 120 government and Olympic-linked websites just hours before the Milan-Cortina Winter Olympics, and Italian authorities say the incidents were effectively neutralised. The assault prompted a layered security escalation combining DDoS-focused cyber defences with the deployment of thousands of police and military personnel…
Category: Cyber Security News
Substack disclosed that attackers accessed user email addresses, phone numbers, and internal metadata in October 2025, but the compromise went undetected until February 3, 2026. The company says credit card numbers and passwords were not accessed and the vulnerability has been fixed, though the four-month detection gap raises concerns about monitoring…
Multiple critical vulnerabilities in the n8n workflow automation platform (tracked as CVE-2026-25049) let any authenticated user who can create or edit workflows escape the sandbox and achieve remote code execution on the host server. Researchers demonstrated PoCs showing sanitization and type-confusion bypasses that evaded earlier fixes, and n8n has released patches—users should update to the patched versions and rotate keys and credentials to mitigate risk. #CVE-2026-25049 #n8n
A threat actor is compromising NGINX servers by injecting malicious ‘location’ blocks that rewrite requests and forward traffic via proxy_pass to attacker-controlled backends, hijacking user traffic without disrupting service. Discovered by DataDog, the multi-stage toolkit targets Baota-managed hosts and sites on several Asian TLDs and gov/edu domains, preserves headers and full URLs to appear legitimate, and exfiltrates mapping data to a C2 at 158.94.210[.]227. #NGINX #Baota
On 28 November 2025 Sysdig researchers observed an attacker gain full administrative control of a company’s AWS cloud environment in just eight minutes after finding exposed test credentials in a public S3 bucket. The breach combined Lambda code injection and privilege escalation into a ‘frick’ account, with indicators of LLM-assisted automation…
CISA has been silently updating its Known Exploited Vulnerabilities (KEV) catalog by switching vulnerabilities from “unknown” to “known” when evidence shows ransomware groups exploit them, without issuing public advisories. Researcher Glenn Thorpe found 59 such flips in 2025—many affecting Microsoft and edge/network appliances—and warned defenders need clearer alerts and prioritization; #CISA…
Rui-Siang Lin, operating as “Pharaoh,” ran Incognito Market into a $105+ million darknet narcotics enterprise that facilitated hundreds of thousands of transactions and sold fentanyl-laced pills linked to at least one reported death. In March 2024 Lin was sentenced to 30 years, signaling that industrial-scale dark web marketplaces and their operators…
The 2026 breach of Harvard University’s Alumni Affairs and Development by the ShinyHunters collective exposed about 115,000 sensitive records, including detailed donor wealth, family networks, and admissions-related flags. The attackers likely used vishing and an SSO/MFA bypass to access SaaS platforms, underscoring the urgent need for phishing-resistant MFA and Zero Trust defenses. #ShinyHunters #HarvardUniversity
Amaranth Dragon, a threat actor linked to APT41, has been conducting espionage attacks against government and law enforcement organizations across Southeast Asia by exploiting the WinRAR path traversal flaw CVE-2025-8088. The group used legitimate tools alongside a custom Amaranth Loader and Cloudflare-backed C2 infrastructure to deliver encrypted payloads (including the Havoc framework and the TGAmaranth RAT), employ strict geofencing, and maintain stealth and persistence. #AmaranthDragon #CVE2025-8088 #WinRAR #TGAmaranthRAT
Attackers deployed a custom EDR killer that abuses a long‑revoked EnCase kernel driver (EnPortv.sys) to detect and terminate 59 security tools on infected hosts. The intrusion used compromised SonicWall SSL VPN credentials without MFA, leveraged a pre‑2015 signing exception that allowed the revoked driver to load, and Huntress recommends MFA, HVCI/Memory Integrity, WDAC/ASR, and monitoring for OEM‑masquerading kernel services. #EnCase #SonicWall
Flare researchers discovered more than 10,000 public Docker Hub images in late 2025 that leaked production API keys, cloud tokens, CI/CD credentials, and AI model access tokens, exposing thousands of live non-human identities. These structural failures enabled real-world compromises like the UNC5537 Snowflake intrusions and the prolonged Home Depot token exposure, underscoring the need to detect, rotate, and revoke long-lived machine credentials. #UNC5537 #Snowflake
CISA ordered U.S. federal agencies to patch a five-year-old GitLab server-side request forgery vulnerability (CVE-2021-39935) that is being actively exploited. Although GitLab issued a patch in December 2021, CISA set a three-week deadline for federal agencies under BOD 22-01 and urged all organizations to prioritize mitigations. #CVE-2021-39935 #GitLab
CISA confirmed that threat actors are exploiting a high-severity VMware ESXi sandbox escape tracked as CVE-2025-22225, which Broadcom patched in March 2025. Organizations are urged to apply vendor mitigations or follow BOD 22-01 guidance after CISA added the flaw to its Known Exploited Vulnerabilities list. #CVE-2025-22225 #VMwareESXi
ShinyHunters claims it stole data from over 14 million Panera Bread accounts and leaked a 760MB archive after Panera refused to pay extortion demands. The group said it accessed systems using a Microsoft Entra SSO code obtained through a vishing campaign, and HIBP reported roughly 5.1 million unique email addresses and…
Security researchers attribute the Notepad++ update hijacking to the Chinese state-linked APT Lotus Blossom, which abused the project’s update infrastructure to deliver a newly identified backdoor called Chrysalis to targeted victims. The trojanized NSIS installer sideloaded a renamed Bitdefender Submission Wizard (BluetoothService.exe) to load encrypted shellcode and a malicious DLL, using…