A clearer view of today.

Dutch authorities arrested the co-owners of two related hosting firms and seized 800 servers allegedly used by Russia to stage cyberattacks, influence operations, and disinformation across the EU. The companies had assumed control of infrastructure from Stark Industries Solutions, an ISP sanctioned by the EU for supporting Russian intelligence-linked activity. The takedown underscores growing European law enforcement pressure on “bulletproof” hosting that enables cross-border campaigns. Organizations relying on third-party infrastructure should reassess provider risk and monitor for service disruptions or data exposure tied to seizures.

Source: KrebsOnSecurity

Attackers are mass-exploiting CVE-2026-26980, a critical Ghost CMS SQL injection bug, to inject malicious JavaScript for “ClickFix” malware campaigns. More than 700 unpatched sites have been compromised, reportedly including prominent universities and well-known internet brands. Operators should urgently update Ghost, audit content templates and themes, and rotate API keys; defenders should watch for injected JS and anomalous redirects.

Source: SecurityWeek

A large-scale campaign injected fake automated commits to add malicious GitHub Actions workflows across more than 5,500 repositories. The payloads aimed to exfiltrate developer credentials, CI secrets, keys, and tokens—turning build pipelines into data theft vectors. Teams should audit workflows and recent commits, revoke and rotate tokens, enforce branch protections, and enable secret scanning/Dependabot at scale.

Source: SecurityWeek

New research indicates TeamPCP now operates across three package ecosystems in parallel, reportedly reached GitHub’s internal codebase, and even trojanized a Microsoft-published Python SDK. The group appears to have open-sourced parts of its framework, potentially lowering the barrier for copycats. Organizations should tighten package provenance controls (e.g., provenance attestations/Sigstore), pin and verify checksums, and continuously monitor for malicious dependency updates.

Source: SANS ISC

Mandiant detailed exploitation of CVE-2026-5426, an ASP.NET ViewState deserialization flaw stemming from hard-coded machine keys reused across installations of the KnowledgeDeliver LMS. Attackers used the zero-day to achieve unauthenticated RCE, deploy the in-memory BLUEBEAM (Godzilla) web shell, and ultimately drop Cobalt Strike Beacon. Immediate actions: rotate unique machine keys per instance, apply vendor updates, restrict exposure, and hunt for Event ID 1316 anomalies and suspicious w3wp.exe child processes.

Source: Google Cloud Threat Intelligence

Google’s threat intel team reports a rapidly maturing Chinese-language phishing-as-a-service ecosystem that interacts with victims live to capture OTPs, bypassing MFA, and monetizes stolen payment data by provisioning cards into attackers’ digital wallets. Operators heavily leverage RCS and iMessage to evade carrier filters and use AI-driven page generators to defeat signatures. Enterprises should accelerate FIDO2/WebAuthn adoption, strengthen device fingerprinting and risk checks for wallet provisioning, and enhance on-device link protection.

Source: Google Cloud Threat Intelligence

Amid AI-assisted exploitation and automated scanning, CERT-In now requires organizations to remediate critical vulnerabilities on internet-exposed systems within 12 hours “where feasible.” The mandate ups the operational tempo for patching and may drive changes in asset discovery, SBOM usage, maintenance windows, and emergency change procedures. Security leaders should reassess vulnerability SLAs, streamline approvals, and expand compensating controls for cases where rapid patching isn’t possible.

Source: TheHackerNews

You May Also Be Interested In...