A malicious LNK sample appears to target a Russian-speaking victim, using a decoy CommuniGate Pro implementation questionnaire aimed at Delovye Linii. The infection chain downloads a tar archive, launches a second LNK, and sideloads calibre-launcher.dll to contact www.ncloudtechlab[.]online and retrieve additional payloads. #CommuniGatePro #DelovyeLinii #ncloudtechlabonline #calibrelauncherDLL
A 68-year-old man in the U.K. was sentenced to more than six years in prison for running an illegal IPTV service that generated nearly £981,000 over three years. Police seized 80 servers used in the operation, which streamed pirated content from major rights holders including the BBC, ITV, Sky, the Premier League, and the Motion Picture Association. #PIPCU #CityofLondonPolice #BBC #ITV #Sky #PremierLeague #MotionPictureAssociation
A maximum-severity flaw in the GiveWP WordPress plugin, tracked as CVE-2026-82222, can let an unauthenticated attacker achieve arbitrary command execution on the hosting server by chaining multiple vulnerabilities. GiveWP fixed the issue in version 4.16.7.2, and site administrators should update immediately to protect affected installations through 4.16.7.1. #GiveWP #CVE-2026-82222
PaperCut has released Emergency Patch Release 2 for PaperCut NG and MF after researchers found ways to bypass the original fix for two actively exploited vulnerabilities, CVE-2026-81578 and CVE-2026-82078. The flaws can be chained to bypass authentication and achieve remote code execution, and PaperCut is urging customers to upgrade and restrict access to trusted IPs while it continues investigating the attacks. #PaperCut #CVE-2026-81578 #CVE-2026-82078
Google announced new network security protections in Android 17 to improve connection privacy, including support for Encrypted Client Hello (ECH), which helps hide the websites and apps users access from network observers. The update also strengthens local network permissions, enables Certificate Transparency by default, and lets carriers disable 2G to reduce…
Threat actors are exploiting newly patched flaws in PaperCut NG and PaperCut MF to bypass authentication and execute arbitrary code on vulnerable servers. Huntress and watchTowr observed limited real-world activity using chained exploits, post-exploitation reconnaissance, and Java .class payloads to fingerprint systems and collect data. #PaperCutNG #PaperCutMF #CVE-2026-82078 #CVE-2026-81578…
This week’s roundup covers major cybersecurity developments, including the Log4j alert being described as a “known security non-finding,” U.S. Bancorp distancing itself from LockBit’s claims, and active credential exposure findings affecting AWS, GitHub, Stripe, OpenAI, and Telegram. It also highlights mobile banking malware expansion, confirmed breach impacts at Paylogix and Manchester…
The investigation traced a GitHub staging account to an email address that also appeared in a stealer log, confirming the operator’s workstation was compromised and exposing its files, browser history, and build artifacts. Those artifacts revealed a broader Blind Eagle-style operation involving RATs, phishing templates, bulk email tooling, crypters, and infrastructure across GitHub, DuckDNS, Bitbucket, AWS S3, and related services. #BlindEagle #AsyncRAT #DcRat #Remcos #XWorm #GitHub #DuckDNS #Bitbucket #AWS_S3
ReliaQuest reports Gryxa, a new toolkit used by a financially motivated threat actor to maintain access across 324 listed hosts, and assesses that much of it was built with a commercial AI coding agent. The toolkit uses RMM abuse, layered persistence, credential theft, and response-aware countermeasures, while collecting Windows logs and host artifacts after defenders try to remove it. #Gryxa #ReliaQuest #Chromium #MicrosoftDefender #Telegram
Hangzhou Qihan Biotech Co., Ltd. (CN), a Hangzhou-based biotech specializing in gene editing and cell/organ therapies including cancer treatments, experienced ransomware activity attributed to a global threat actor. The company’s efforts to make immune-privileged cell and xenogeneic organ therapies accessible worldwide were disrupted, impacting data and operations. #China
Vigilia (UY) reported that a global ransomware threat actor compromised its systems, disrupting support and care services for people, including assistance in medical facilities, home care, ambulance transportation, and administrative coordination. The company indicated that insurance policies and coordination of medical consultations and tests were impacted, with effects in #Uruguay.
The ransomware claim from threat actor rhysida states that Valley Health Team 9,056,196 files were encrypted/exfiltrated, including large SQL databases containing the clinic’s entire lifetime of information. The reported impact includes 160,870 patients, 4.18 million diagnoses, 7.6 million unencrypted EHR scans with SSNs/passports and financial records, ending with the impacted country(s): #unknown
Over 8,300 Internet-exposed Gitea servers remain unpatched against CVE-2026-60004, a critical code injection flaw that is being actively exploited for remote code execution. CISA and Shadowserver have urged urgent patching after reports of attackers using the issue to deploy cryptocurrency mining malware on vulnerable systems. #Gitea #CVE-2026-60004 #Shadowserver #CISA
NIST’s NVD backlog and selective enrichment of newer CVEs are creating delays and gaps in vulnerability intelligence, making it harder for defenders to determine what truly affects their environments. Action1 argues that teams must combine multiple sources, real-time endpoint context, and automated remediation to keep pace with rapidly growing vulnerability volume. #NVD #NIST #Action1 #VulnCheckNVD #MSRC #CISAKEVCatalog
Hit Group’s casinos in Slovenia were hit by a cyberattack, forcing the closure of six gaming venues in Nova Gorica and across the country. The cause, scope, and possible impact on customer records remain under investigation. #HitGroup #NovaGorica