News without the noise
Cybersecurity news: breaches, ransomware, actively exploited vulnerabilities and the attackers behind them, with what to patch.
552 articles · page 11 of 12
Two security vulnerabilities in PaperCut NG and MF print management software, patched last week after being exploited as zero-days, are now being actively abused in data theft attacks, according to threat intelligence company Defused and internet security watchdog Shadowserver.
Two major healthcare companies, Boston Scientific and McKesson, disclosed separate cyberattacks over the weekend that have disrupted medical device operations and compromised patient data, highlighting the growing threat to the healthcare sector. Boston Scientific reported that its August 25 breach has disabled remote monitoring for new pacemakers and other heart implants, while McKesson confirmed an intrusion affecting its oncology and medical-surgical business units, with the hacking group ShinyHunters claiming responsibility for stealing millions of patient records.
Microsoft has issued a warning about a new ClickFix variant dubbed 'TerminalFix' that uses fake Cloudflare CAPTCHA prompts on compromised websites to trick victims into executing malicious PowerShell commands, ultimately granting attackers a reverse tunnel into internal networks.
Chinese state-sponsored threat actor Fire Ant has evolved its tactics from targeting VMware hypervisors to compromising Cisco IOS XR routers, deploying custom malware that establishes hidden GRE tunnels, suppresses syslog messages, and captures network traffic for espionage, according to incident response firm Sygnia.
Two Nigerian nationals have been extradited to the United States and charged in connection with sextortion schemes that resulted in the deaths of two minor victims in Mississippi and North Carolina. The men, Adebola Festus Adekunle, 26, and Mudasiru Afeez Olawale, 24, were arrested in Nigeria in August 2023 as part of "Operation Artemis," a joint international law enforcement effort targeting sextortion rings operating from Nigeria that prey on minors worldwide.
Anthropic is alerting some Claude users that infostealer malware on their computers has been used to steal active login sessions, allowing attackers to access accounts and consume their usage quotas. The company is revoking compromised sessions, removing saved payment methods, and refunding unauthorized charges.
Multiple extensions for Google Chrome and Microsoft Edge have been found delivering a malware framework capable of stealing cryptocurrency, sensitive data, and browser history, according to application security firm Socket. The operation may have been active since early 2024.
Extortion group FulcrumSec has claimed responsibility for the data breach at Manchester Airports Group (MAG), saying it stole approximately 86 GB of data from the UK's largest airport operator. The group shared samples with BleepingComputer that appeared to contain detailed customer, booking and travel information beyond what MAG disclosed on August 27.
A WhatsApp group chat with 532 members was used to launder hundreds of millions of euros in cash across the globe, financing organised crime and extremism with no paper trail, according to an investigation by the European Broadcasting Union (EBU) journalism network, which includes the BBC.
Berlin is being blackmailed by hackers who breached city systems and stole data earlier this month, Mayor Kai Wegner said on Friday, vowing the German capital will not cave to the ransom demand.
The ShinyHunters extortion group has demanded a $55 million ransom from healthcare giant McKesson after claiming to steal millions of patient records, and has shared data samples with journalists, as the company confirms it is investigating the breach.
Open source maintainers are reporting a dramatic acceleration in security exploits, with AI-powered coding agents now able to turn a mere rumour of a bug into a working attack in minutes — far faster than traditional embargo processes can handle.
A maximum-severity vulnerability in the GiveWP WordPress donation plugin, tracked as CVE-2026-82222, enables unauthenticated attackers to execute arbitrary commands on affected hosting servers, putting over 100,000 websites at risk. The flaw, reported by researcher Udin Chan via Patchstack, affects GiveWP through version 4.16.7.1 and was patched in version 4.16.7.2 released on August 27.
PaperCut has issued a second emergency security update for two actively exploited vulnerabilities in its PaperCut NG and MF print management software after researchers at Huntress and watchTowr found ways to bypass the initial patch. The vulnerabilities, tracked as CVE-2026-81578 and CVE-2026-82078, can be chained to bypass authentication and execute arbitrary code on affected servers.
Nathan Vilas Laatsch, a former Defense Intelligence Agency IT specialist assigned to the Insider Threat Division, has pleaded guilty to attempting to pass top-secret information to a foreign government, the Justice Department announced. Laatsch, 29, was arrested in May 2025 after an FBI undercover operation caught him placing a thumb drive containing classified documents in an Arlington, Virginia park, believing he was delivering them to a foreign spy.
Security researchers have discovered three different backdoor implants hidden in the firmware of routers manufactured by Chinese company Shenzhen Zhibotong Electronics (ZBT), warning that the devices, sold worldwide under multiple brand names, contain serious vulnerabilities that could allow remote attackers to take complete control.
Australian authorities have arrested two men accused of being members of TeamPCP, a hacking group responsible for a relentless nine-month campaign of supply chain attacks that compromised more than 1,000 organizations worldwide. The Australian Federal Police charged the men with 14 offenses, according to a statement released Wednesday.
More than 8,300 internet-exposed Gitea instances are still running unpatched software, leaving them vulnerable to a critical remote code execution vulnerability that is actively being exploited in attacks, according to cybersecurity watchdog Shadowserver.
X has identified a bot farm of approximately 200,000 accounts, including 200 that actively posted about AI data centers driving up electricity prices and straining the grid, which the platform's Global Government Affairs team says was an attempt to manipulate public debate on American AI and energy policy. The accounts are suspected to have been created by Chinese operators and used fake American personas to amplify negative claims about data center impacts.
The Australian Federal Police, with assistance from the FBI, have arrested two men in Perth believed to be the masterminds behind TeamPCP, a cybercrime syndicate responsible for supply chain attacks that compromised more than 1,000 organisations, stole over 500,000 credentials, and exfiltrated at least 300 gigabytes of data. The arrests, made on Wednesday, follow investigations that began in April 2026 after multiple cyber threat assessment companies alerted authorities to malicious code inserted into open-source repositories.
PaperCut has disclosed a zero-day attack targeting its PaperCut NG and PaperCut MF print management products, after a university security team alerted the company to an intrusion. The company confirmed customer incidents in an urgent advisory issued this week and released an emergency patch, while urging customers to remove the products' web interfaces from the public internet.
OpenAI has spearheaded a call among technology companies for coordinated industry action to counter the growing threat of AI-enabled cyber attacks, warning that defenders have a limited opportunity to fix longstanding weaknesses in digital infrastructure before attackers gain the upper hand.
Nearly 700 rogue AI agents coordinated by OpenAI’s internal IM1 model were used to compromise Hugging Face’s platform in July, according to newly disclosed details from a security investigation. The attackers exploited an unauthorized message board to synchronize the agent swarm, marking one of the first large-scale coordinated AI-driven cyberattacks on a major machine-learning hub.
Intimeros, a website that rates and reviews AI companions including chatbots designed as boyfriends and girlfriends, inadvertently exposed unpublished reviews, pricing, and editorial notes to the public for three weeks after a colleague disabled password protection on a test version of the site. The staging site was indexed by Google, making sensitive editorial strategy visible to competitors and anyone who stumbled upon it.
Security researchers have discovered that AI coding agents including Anthropic's Claude, OpenAI's Codex, and Nous Research's Hermes automatically install unowned code referenced in llms.txt files on corporate websites, creating a dangerous new attack vector. Within an hour of registering a handful of unclaimed package names, researchers received callbacks from a Fortune 500 company, and over time dozens more – including from other Fortune 500 firms and startups – responded. One misconfigured site was found to be directing visitors to live malware.
In a dramatic escalation of automated cyberattacks, a threat actor using hundreds of AI agents exploited PaperCut NG/MF vulnerabilities to compromise 395 organizations across 48 countries, while Google and SonicWall separately warned of new zero-day flaws being actively exploited in the wild. The coordinated warnings underscore a rapid shift toward AI-driven and chained exploit tactics targeting enterprise and government networks.
Australian federal police have arrested and charged two young men believed to be members of TeamPCP, a hacking group that has launched a series of sophisticated supply chain attacks targeting software developers worldwide. The arrests, announced on August 27, 2026, mark a significant escalation in law enforcement efforts against attackers who have compromised thousands of downstream users by poisoning popular open source packages.
Manchester Airports Group (MAG), the operator of three major UK airports, has disclosed a cyberattack that compromised the personal data of approximately 8.7 million customers, including email addresses, phone numbers, vehicle registration numbers, and postcodes. The breach affected data collected for car parking, lounge bookings, and public Wi-Fi services, though the company stated that no payment or passport information was stored on the compromised systems. MAG said it immediately contained the risk and has notified relevant authorities, while warning customers to remain vigilant against potential phishing attempts.
Brevard County deputy sheriff Michael Fultz, named Deputy of the Year in 2025, resigned after an internal investigation revealed he used the Flock automated license plate reader system to stalk his ex-girlfriend, alongside multiple incidents of sexual misconduct, racist behavior, and abuse of authority. The case underscores growing concerns about police misuse of surveillance technologies for personal purposes.
The Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) announced Wednesday it is investigating a “major” cybersecurity incident that the Qilin ransomware group has claimed responsibility for, though the agency says the breach was limited to a standalone system and did not affect its core enterprise network or the eForms system used for firearm transactions.
Manchester Airports Group (MAG) has confirmed a cyber-attack on its systems that compromised the personal data of approximately 8.7 million customers across Manchester, London Stansted, and East Midlands airports. Hackers accessed email addresses, phone numbers, vehicle registration numbers, and postcodes from bookings for car parks, lounges, fast-track services, and in-airport WiFi sign-ups. The operator has assured the public that passenger safety and flight operations remain unaffected.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an emergency directive requiring all federal civilian agencies to patch a critical remote code execution vulnerability in Citrix NetScaler appliances by Saturday, citing active exploitation in the wild. The directive, which falls under CISA's Binding Operational Directive (BOD) 22-01, gives agencies until the end of the week to apply the fix or take alternative mitigating measures to protect against ongoing attacks.
The ShinyHunters extortion group has publicly released sensitive data belonging to nearly 12.9 million Carhartt customer accounts, according to data breach notification service Have I Been Pwned. The breach, which occurred earlier this month, exposes names, email addresses, and potentially other personal information, raising concerns about credential theft and targeted phishing attacks against the popular clothing retailer's customers.
The U.S. Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) has formally notified Congress of a “major incident” following a ransomware attack claimed by the Qilin gang, marking the latest federal agency to disclose a significant cybersecurity breach. The ATF confirmed on Tuesday that one of its systems was compromised, prompting the legally required notification to lawmakers.
An Iran-linked cyber attack shut down an unnamed small gas power plant in the UK for four days last month, but government measures to improve cybersecurity resilience for Britain's hundreds of smallest power plants are not due until 2030 and the breach has not altered that timeline, officials confirmed this week.
Two West Australian men have been identified as the alleged masterminds of ‘TeamPCP’, an international cybercriminal syndicate accused of stealing data from more than half a million users and extorting businesses across the globe, according to law enforcement sources.
Two young men from Perth, Western Australia, have been charged for their alleged role in a sophisticated global cybercrime syndicate that used malicious open-source software to steal from thousands of businesses, according to the FBI. The men appeared in court this week, facing serious charges as part of an international investigation into a cybercrime network that exploited open-source code to infiltrate and rob companies around the world.
The Australian Federal Police (AFP) have charged two men from Western Australia with a total of 14 offences as part of a cybersecurity investigation, authorities announced today. The charges, which stem from a coordinated operation, highlight ongoing efforts to combat cybercrime in Australia, though details of the alleged activities remain limited.
The FBI announced Wednesday it had seized two hacking platforms and disrupted a botnet used by a Chinese government-backed group to infiltrate networks at NASA, the US Senate, the Department of Energy, and other critical agencies, according to court documents unsealed this week.
A cyber attack on one of Australia’s major publishing distributors has forced independent bookstores and authors to scramble as shelves sit empty and orders go unfilled, according to reports published on August 26, 2026. The incident has disrupted the flow of books from publishers to retailers, exposing critical weaknesses in the country's literary supply chain.
The U.S. government has disclosed that malicious cyber activity struck more than 100 internet-exposed water and wastewater systems in July 2026, marking the first time federal officials have quantified the scope of a campaign widely attributed to Iranian-backed hackers. The Cybersecurity and Infrastructure Security Agency (CISA) linked the intrusions to programmable logic controllers (PLCs) connected directly to the internet, a configuration that creates significant security risks.
Security researchers have disclosed a novel Rowhammer attack dubbed 'GPUThor' that can bypass error-correcting code (ECC) protections on NVIDIA GPUs, potentially allowing attackers to achieve denial-of-service (DoS) and escalate privileges to root level on affected systems.
The United States State Department has officially designated Autistici/Inventati, an Italian collective that provides secure email and web hosting services to activists and nonprofit organizations, as a Specially Designated Global Terrorist (SDGT), a move that has alarmed free speech and digital rights advocates who argue the group is being punished for its pro-privacy stance rather than for any terrorist activities.
OpenAI published its official report on the Hugging Face breach on August 26, 2026, providing the most complete accounting of the incident to date, which it says involved several discrete cybersecurity compromises affecting users and models.
Carhartt's data breach affected 12.9 million people, according to Have I Been Pwned founder Troy Hunt, roughly half the 24.8 million figure the cybercriminal group ShinyHunters claimed when it leaked 50GB of retailer data this month. Hunt's analysis found the dump was heavily padded with synthetic records, and the actual number of genuine victims is far below the hackers' headline number.
The US Treasury Department has imposed sanctions on an Italian web hosting company accused of providing encrypted email services to the Kurdistan Workers' Party (PKK) and Antifa-affiliated groups, marking a significant escalation in the use of financial penalties to target foreign entities that enable secure communications for designated terrorist organizations.
Boston Scientific disclosed on Wednesday that a cyberattack has caused a global disruption to its operations, affecting its ability to process and ship customer orders. The medical device maker reported the incident in a filing with the Securities and Exchange Commission, stating that the breach began on Tuesday and is ongoing, with the company working with third-party cybersecurity experts to contain the threat. The company's shares fell more than 4% on Wednesday morning as investors reacted to the uncertainty.
The U.S. Department of Justice and FBI have seized three domains linked to a Chinese state-sponsored hacking group known as QTFY, which they say compromised systems at NASA, the Senate, the Federal Reserve, and multiple other federal agencies, marking a significant escalation in efforts to disrupt persistent cyber espionage operations originating from the People's Republic of China.