CubePilot said a DNS hijacking attack on its cubepilot[.]org domain let an attacker redirect traffic, capture credentials, and obtain valid TLS certificates for all subdomains. The company has restored control, revoked the certificates, taken key services offline, and warned users to reset passwords and avoid firmware downloaded on July 24-25. #CubePilot #cubepilotorg #PhilipRowse
Unknown threat actors used a multi-package npm campaign to impersonate Alibaba private packages and deliver a staged downloader that ultimately deployed a targeted RAT against developers using Alibaba Group tools. The final payload enabled data theft, remote command execution, lateral movement through DingTalk, and platform-specific persistence across macOS, Windows, and Linux. #lib-mtop #aone-cli #DingTalk #AlibabaGroup
AI-assisted vulnerability discovery from systems like Anthropic’s Project Glasswing and Microsoft’s MDASH produced 1,061 flaws in the first half of 2026, but VulnCheck found they were not more likely to be exploited than other disclosed vulnerabilities. The report also notes that exploitation is happening faster after CVE publication, with content management systems, network edge devices, operating systems, server software, and AI products among the most targeted categories. #ProjectGlasswing #MDASH #Daybreak #VulnCheck #CVE
The FBI says advanced AI models like Anthropic’s Mythos could help adversaries find and exploit vulnerabilities in widely used software, creating new challenges for law enforcement. The bureau is also expanding its own AI use for facial recognition, investigative triage, and other internal operations while still working through risk management requirements. #Anthropic #Mythos #FBI #ToddHemmen
A coordinated cyberattack disrupted water and wastewater utilities across more than 30 Minnesota communities, prompting state and federal agencies to help contain and investigate the incident. Officials said water quality was not affected, while warnings about internet-connected operational technology and possible Iranian-linked threat activity raised concerns about future attacks on critical infrastructure. #CyberAv3ngers #CISA #EPA #FBI #SCADA #PLC
A critical flaw in vBulletin, tracked as CVE-2026-61511, lets unauthenticated attackers execute arbitrary PHP code through template rendering and can lead to remote code execution on vulnerable servers. The issue affects vBulletin 5.x and 6.x releases, has a public proof-of-concept, and was patched in v6.2.2 with backports to select 6.x versions, while older 5.x users are advised to upgrade. #vBulletin #CVE-2026-61511 #EgidioRomano #SSDSecureDisclosure
U.S. and Australian agencies have issued CI Fortify guidance to help critical infrastructure operators isolate vital OT systems before a cyberattack or major disruption occurs. The advisory highlights persistent threats from Volt Typhoon, Salt Typhoon, and pro-Russian hacktivists targeting sectors like water, energy, telecommunications, and transportation. #VoltTyphoon #SaltTyphoon #CISA #ACSC #FBI #AmericanWater
Researchers found more than 36,000 internet-exposed BMC management interfaces running IPMI, with nearly 25,000 leaking password-derived authentication hashes before login because of CVE-2013-4786 in IPMI v2.0. The exposure affects systems from vendors including HPE and Supermicro, and attackers could use the flaw to crack weak or factory-set passwords offline and gain…
Tengu is a Mirai-derived botnet that uses multiple persistence tricks, including a hardware watchdog reboot loop, to survive process termination on compromised Linux devices. Nozomi Networks Labs found it supports many DDoS methods, proxying, command execution, and payload retrieval, with samples tied to C2 infrastructure at 64[.]89.163.8 and telemetry also showing…
Anthropic said Claude Mythos Preview helped derive a key-recovery attack against HAWK-256 by exploiting a hidden lattice symmetry, and the company released reproducibility code while stressing that the result does not affect production systems. It also reported a 200- to 800-fold speedup for an attack on seven-round AES-128, but said the…
Krefeld Pinguine’s website was taken offline after a malware attack overnight on July 25–26, prompting the club to act quickly to prevent further damage and protect visitors. The club is now investigating the incident and working on a secure solution, while no data exfiltration has been confirmed so far. #KrefeldPinguine
Pierrefitte-sur-Loire Mairie’s website is temporarily unavailable following a cyberattack affecting its hosting provider, o2switch. Technical teams are working to restore access as quickly as possible. #Pierrefitte-sur-Loire #o2switch
LM Mobilidade identified a cyberattack and temporarily shut down its systems as a precaution while assessing the scope and severity of the incident. The company has stated that, so far, there is no evidence of compromise involving personal data. #LMMobilidade
Franz Krause artworksgroup was targeted by the akira threat actor in a ransomware claim involving the planned exfiltration of 81GB of corporate data, including employee and client information, financials, contracts and agreements, NDAs, and confidential files. The victim is described as a streamlined media and event management agency focused on budget efficiency and client satisfaction, with the impacted countries not specified in the claim. #N/A
B-K Tool & Design, a US-based turn-key automation solutions provider, was targeted by the ransomware threat actor cmdorganization. The incident impacted United States #UnitedStates