Ransomhouse ransomware reportedly targeted the City of Beacon, disrupting municipal operations and demanding ransom payments. The City of Beacon, US #UnitedStates
Elastic Security Labs identified a Shai-Hulud campaign that compromised the keyv maintainer and spread a self-propagating CHAINDROP worm through trojanized npm packages, affecting hundreds of packages and exposing a massive developer ecosystem. The operation steals credentials, uses smart-contract-based C2 resolution and GitHub-backed fallback exfiltration, and targets AI, cloud, GitHub, SSH, Kubernetes, and npm secrets. #ShaiHulud #CHAINDROP #keyv #Claude #OpenAI #Anthropic #npm-cache.com #awqhnjewqjkl.icu
A critical authorization bypass in Paperclip, tracked as CVE-2026-41679, could let remote attackers self-register, approve a CLI challenge, and gain code execution with the server’s permissions. Oasis Security also reported two additional flaws in Paperclip, including sensitive data disclosure and a DNS rebinding weakness that could enable code execution on developer…
This episode features Edna Conway discussing how organizations can strengthen resilience through better cybersecurity governance, supply chain risk management, and collaboration across sectors. It also explores the impact of AI, blockchain, quantum computing, and geopolitical shifts on future digital infrastructure and workforce readiness. #EdnaConway #SecurityWeekTV…
Zenity disclosed two AI browser attack chains against ChatGPT Atlas and the Claude in Chrome extension, showing how indirect prompt injection can enable phishing, account takeovers, and unauthorized Amazon purchases. The research highlights how agentic browsers can be manipulated across authenticated sessions, with reports shared to OpenAI and Anthropic. #ChatGPTAtlas #ClaudeinChrome…
AhnLab SEcurity intelligence Center linked Larva-26005 to Xctdoor campaigns in Korea, including 2026 attacks disguised as Veraport and SoftCamp installers and LNK-based phishing cases that delivered XcLoader and Xctdoor. The report also connects these operations to earlier CRAT activity, Hansom ransomware, Ngrok, and Lazarus-related tradecraft, while listing related IOCs such as…
Unit 42 reports a surge in AI token jacking, where attackers steal legitimate API keys to rack up massive usage charges through transfer stations and gray-market proxy services. The article explains how stolen tokens, compromised developer accounts, and supply-chain infections like Shai-Hulud and Miasma fuel the abuse, while recommending spending limits,…
Caravan.kz was hit by a ransomware attack claimed by the Black Field group, which demanded payment and threatened to leak copied or falsified corporate and personal data. The technical team worked continuously to contain the incident and restore services, while Kazakhstan’s authorities were notified and are assisting with the case. #Caravan.kz #BlackField
The SharePoint servers of the Canton of Graubünden’s cantonal administration were hit by a cyberattack, likely through the exploitation of Microsoft SharePoint software vulnerabilities. Initial analysis found no evidence of data loss or compromised accounts, but the authority is throttling the website to apply a security update after a similar incident affected the federal government. #SharePoint #Microsoft #CantonofGraubünden
The Municipality of Sithonia in Greece was hit by a ransomware attack that disrupted both the central administration and the management of local ports and boat shelters. Authorities are investigating the incident, while the extent of intercepted data and the availability of usable backups remain unclear. #Sithonia #HellenicPolice #PersonalDataProtectionAuthority
Primary Eye Care in the United States reported a ransomware incident attributed to the dragonforce threat actor. The claim centers on access to eyecare services, which can include options such as LASIK, cataract surgery, glasses, contact lenses, and routine eye tests, impacting #UnitedStates
Hope’s Windows was targeted by the cry0 ransomware group, with encrypted systems and demands accompanying the attack. The incident is described as “Coming soon,” impacting operations in the United States. #UnitedStates
EduSpa reported a ransomware incident attributed to the dragonforce threat actor. Parkmungak has been operating since 1972, but the claim does not specify any impacted country, so no country is listed. #unknown
VulnCheck disclosed ENDLESSDOORS, a factory-shipped backdoor embedded in at least 20 Zbtlink router models and present across all 21 available firmware images. The implant runs at boot, phones home to multiple command-and-control endpoints, and can be hijacked to grant attackers a live root shell on affected devices. #ENDLESSDOORS #Zbtlink #rctl…
Threat actors are exploiting CVE-2026-63077, a critical JetBrains TeamCity vulnerability that can allow unauthenticated remote code execution through HTTP/S requests. CISA has added the flaw to its Known Exploited Vulnerabilities catalog and is urging rapid patching of TeamCity On-Premises systems. #JetBrains #TeamCity #CVE202663077 #CISA…