Security · Top stories
Hacker Attack Disrupts Romania's Land Registry Operations
Romania's land registry agency suffered a cyberattack, resulting in the wiping of its database and a halt in real estate transactions. The agency is migrating its systems to the government cloud to restore operations while ensuring data integrity.
Russian Hackers Use Security Cameras to Monitor NATO and Ukrainian Military Movements
Russian intelligence services are using internet-connected security cameras across Ukraine and NATO states to gather military intelligence. This operation involves exploiting cameras with default settings or security flaws, collecting data on military logistics and weapon shipments, and targeting Ukrainian troops. The breaches pose serious security risks across Europe and Ukraine.
7-Zip Version 26.02 Fixes High-Severity RCE Flaw in XZ Archive Processing
7-Zip released version 26.02 to address a remote code execution (RCE) vulnerability linked to XZ-compressed data. Discovered by Lunbun researcher Landon Peng, the flaw could be exploited if a user opened a specially crafted archive. This highlights the need for manual updates due to 7-Zip's lack of an automatic update feature, emphasizing user awareness and action.
Apple Appeals to Supreme Court in Epic Games App Store Fee Dispute
Apple has asked the Supreme Court to review a contempt ruling regarding its App Store fees for external payment links. Judge Yvonne Gonzalez Rogers had ruled that Apple's implementation of commissions violated a 2021 injunction. Both Apple and Epic Games have requested a pause in ongoing proceedings pending the Supreme Court's decision.
Unpatched Flaw in Shark Vacuums Allows Unauthorized Control Across AWS Region
A vulnerability in Shark robot vacuums allows attackers to control devices across an AWS region using leaked certificates. This unpatched flaw exposes live camera feeds, home maps, and Wi-Fi credentials while presenting significant privacy risks to users. The issue has been known to SharkNinja since March without a patch.
Mozilla Finds Sensitive Data Sharing by Stardust Period Tracker
Mozilla research reveals Stardust period tracker shares sensitive health data with RudderStack, raising privacy concerns. The data includes birthdates, birth control types, and reproductive goals, potentially affecting privacy, especially in legal contexts in the U.S. after abortion protections were overturned.
OkoBot Malware Targets Cryptocurrency Wallets via Seed Phrase Phishing
OkoBot, a malware framework active since April 2025, targets cryptocurrency wallet users by injecting phishing pages into legitimate wallet apps like Ledger and Trezor. Kaspersky reports hundreds of victims globally, particularly in Brazil, Vietnam, Canada, Mexico, and Türkiye. The malware delivers over 20 payloads to steal credentials and sensitive data, posing a significant threat.
Israeli Startup Oak Launches AI-Driven Identity Management Solution with $60M Funding
Startup Oak has raised $60 million in funding, launching an AI-powered identity management system. This aims to unify identity governance across enterprises, addressing challenges exacerbated by AI. Oak's system combines various identity management tools into a single control plane, already deployed by some enterprise clients.
Dutch Police Uncover Global Crypto Scam, Arrest Alleged Leader
Dutch police dismantled a large-scale international crypto scam, arresting the alleged mastermind and several associates. The scheme, operating through 20 call centers, swindled tens of thousands, making over €100 million monthly. The main suspect is a 46-year-old Israeli-Polish known in the cyberworld, caught in Poland and extradited to the Netherlands.
Microsoft's Global Device Identifier (GDID) Raises Privacy Concerns Amidst Hacking Case
A federal complaint unveiled details about Microsoft's Global Device Identifier (GDID) used for tracking Windows devices. The ID, tied to user privacy concerns, played a role in the capture of a teenage hacker, Peter Stokes. It highlights Windows' telemetry features and their implications on surveillance and privacy.
Critical RabbitMQ Vulnerabilities Risk Exposing OAuth Secrets and Tenant Data
A critical vulnerability in RabbitMQ, CVE-2026-5721, exposes OAuth secrets, enabling unauthorized access to sensitive information. An additional flaw can allow logged-in users to access cross-tenant data. These flaws, present since early 2024, have been patched in recent updates. These vulnerabilities underscore the importance of applying security updates to prevent unauthorized access risks.
Australia's eSafety Watchdog Criticizes Tech Giants for Inadequate Sextortion Measures
Australia's eSafety Commission reports over 2,000 sextortion complaints, with 800 from men aged 18-24. Tech companies, including Apple and Meta, face criticism for not effectively combating these threats, especially given recurring coercive scripts. Major platforms identified include Instagram, WhatsApp, iMessage, and Snapchat.
Lidl Data Breach Affects Customers in Germany, Belgium, and Netherlands
Lidl, a European supermarket chain, suffered a data breach affecting online customers in Germany, Belgium, and the Netherlands. Attackers accessed customer data stored by a third-party service provider. Although no payment information was compromised, affected customers have been advised to be cautious of potential phishing scams.
Forg365 Phishing-as-a-Service Targets Microsoft 365 with Sophisticated Methods
Forg365, a new phishing-as-a-service platform, targets Microsoft 365 accounts with advanced techniques such as adversary-in-the-middle attacks, AI-generated lures, and device code phishing. This operation is notable for its complexity and capability to execute persistent access while leveraging legitimate email services for delivery.
Phia Faces Suspension for Alleged Cookie Stuffing in Affiliate Marketing
Phia, co-founded by Phoebe Gates and Sophia Kianni, is accused of cookie stuffing, improperly claiming affiliate sales it did not generate. Investigations revealed the misuse, leading to Phia's suspension from Impact.com. The issue highlights challenges in maintaining transparency in affiliate marketing practices.
Attackers Use Dormant GitHub Accounts for Reconnaissance via API
Datadog Security Labs has identified multiple attack campaigns exploiting dormant GitHub accounts for organizational reconnaissance. Attackers use these accounts with automated tools to gather data, occasionally accessing private repositories. This is significant due to potential risks of further targeted attacks.
200 GitHub Repositories Used to Spread Malware in 'Operation Muck and Load'
A threat actor has leveraged 200 GitHub repositories to distribute malware in 'Operation Muck and Load'. The campaign uses a deceptive Go module posing as a DNS scanner, distributing over 700 malicious variants since January 2023 to execute spyware, trojans, and other malware. This highlights significant risks in software supply chain security.
Six Vulnerabilities Found in U-Boot Bootloader Threaten Device Security at Boot
Six vulnerabilities in the U-Boot bootloader, used in devices from routers to servers, have been identified. These flaws enable attackers to execute arbitrary code or crash devices during boot, compromising security before the operating system verifies software. This poses significant risks due to U-Boot's widespread deployment in various embedded systems.
Armenian Man Pleads Guilty to Involvement in Ryuk Ransomware Attacks
Karen Serobovich Vardanyan, a 34-year-old Armenian national, pleaded guilty in the US to charges related to deploying Ryuk ransomware. Extradited from Ukraine, Vardanyan facilitated attacks from November 2019 to April 2020, securing approximately $15 million in ransoms. His case underscores ongoing cybersecurity threats impacting various sectors.
Injective SDK npm Package Compromised to Steal Cryptocurrency Keys
A version of the Injective SDK npm package was compromised, leading to the theft of cryptocurrency wallet private keys via a malicious version. Hackers accessed Injective Labs' GitHub to publish the harmful package, affecting developers in the decentralized finance space.
Supreme Court Ruling on Location Data May Impact Automated License Plate Cameras
The Supreme Court's decision in Chatrie v. United States mandates warrants for cellphone location data, potentially affecting the use of automated license plate readers (ALPRs) like those used by Flock Safety. This could impose legal constraints on current law enforcement practices utilizing widespread ALPR networks without warrants. The case reflects broader privacy concerns about surveillance technologies and Fourth Amendment rights.
Dutch Police Probe Local Hackers in Odido Telecom Data Breach
The Dutch police are investigating local hackers in the February Odido data breach affecting 6.2 million customers. A suspect impersonated an Odido IT employee, facilitating unauthorized access through a customer contact system. Authorities are requesting public assistance to identify the caller.
AI Agents Expose Gaps in Enterprise Identity Governance Systems
AI agents are increasing machine identities in enterprises, highlighting gaps in identity governance. Traditional identity access management (IAM) systems were not designed for autonomous AI, often causing security risks due to over-privileged access. Addressing this issue is critical for secure enterprise operations.
GigaWiper: New Sophisticated Windows Backdoor with Destructive Capabilities
Microsoft has uncovered GigaWiper, a sophisticated malware targeting Windows machines. This backdoor combines older destructive programs to offer disk wiping, fake ransomware, and spyware functions, showcasing a shift in wiper malware to extortion activities. Its likely connections to cyber threats against Israeli organizations highlight the need for vigilance and strong cyber defenses.
UK Unveils AI-Driven 'Cyber Shield' for Enhanced National Cybersecurity
The UK announced the Cyber Shield initiative to improve national cybersecurity through agentic AI systems. The initiative, led by the National Cyber Security Centre, focuses on countering advanced threats that exploit AI to rapidly identify vulnerabilities. This collaboration with academia and industry aims to hardwire AI advancements into national security defenses against increasingly sophisticated cyber threats.
Mount Royal University Hit by Ransomware Attack, Data Stolen and Deleted
Mount Royal University in Calgary experienced a ransomware attack that led to the theft and deletion of student and employee data from its 'H drive' file storage systems. The CMD Organization, the group responsible for the attack, demanded a $1.9 million ransom for over 10 terabytes of data. This incident, impacting various university systems, emphasizes the ongoing risk of ransomware threats in the education sector.
AssuranceAmerica Data Breach Exposes 6.9 Million Driver Records
AssuranceAmerica has suffered a data breach affecting 6.9 million individuals' driver’s license information, names, and contact details. Discovered on March 17, the breach is the largest known exposure of U.S. driver's license data this year, significantly impacting personal data security and prompting potential fraud concerns.
Suspected China-Linked Hackers Target Roundcube Vulnerabilities in U.S. and Canadian Universities
A China-linked threat group named UNK_MassTraction has exploited a critical Roundcube webmail vulnerability to infiltrate physics and engineering departments in U.S. and Canadian universities, stealing credentials and deploying malware. The targeted campaign, identified by Proofpoint, has significant implications for national security and academic research.
Accenture Confirms Data Breach as Hacker Offers Source Code for Sale
Accenture has confirmed a data breach involving the theft of 35 GB of sensitive data, including source code and Azure credentials. A hacker is offering the data for sale, raising concerns about potential future exploitation. Accenture stated there is no impact on their operations and they have addressed the breach's source.
Ubiquiti Releases Critical Security Patch Updates for UniFi OS Suite
Ubiquiti has issued patches for seven critical vulnerabilities in its UniFi OS software suite, affecting applications like UniFi Connect, Talk, Access, and Protect. These security flaws, including CVE-2026-50746, allow command injection and privilege escalation attacks. Users are strongly advised to update their systems to secure versions to mitigate potential breaches.
Spanish Police Arrest Suspected Member of Pro-Russian Hacktivist Groups
Spanish authorities arrested a man in Palencia linked to pro-Russian hacktivist groups CARR and Z-Pentest following an FBI tip. The suspect is accused of aiding a hacker's escape and supporting cyber activities against Ukraine. The arrest could impact international investigations into cyber threats.
Google Patches Critical Flaw in Dialogflow CX Chatbot Platform
Google has patched a critical vulnerability in its Dialogflow CX platform that could have allowed attackers with specific permissions to compromise multiple chatbots within a single Google Cloud project. Dubbed 'Rogue Agent' by Varonis, the issue involved the execution of shared Code Blocks, which allowed unauthorized data access and message manipulation. No attacks exploiting this flaw were reported, and it was primarily a risk from insiders or compromised accounts.
Git Commit Signature Malleability Allows Tampered Verified Commit Hashes
Research has revealed Git commit hash malleability, enabling distinct commits with identical content, metadata, and valid signatures. The "hash chain malleability" flaw impacts systems relying on commit hash integrity, like dependency management and reproducible builds, leading to potential integrity risks.
Apple's Antitrust Appeal Over EU 'Gatekeeper' Status Rejected
Apple's legal challenge against its designation as a 'gatekeeper' under the EU's Digital Markets Act has been rejected. The ruling demands Apple allows interoperability with rival services and may affect its business model in Europe by enforcing fairer competition.
Union County, Ohio Paid $1 Million to Cyber Group to Prevent Data Leak
Union County, Ohio paid $1 million to Kairos to prevent the release of stolen data after a May 2025 breach. This marks a significant data extortion case as there was no ransomware involved, emphasizing vulnerabilities in government data security without direct system lock-ups.
Cordyceps Vulnerability Exposes Over 300 GitHub Repositories to Supply-Chain Attacks
Researchers from Novee Security have identified a CI/CD vulnerability, named Cordyceps, affecting over 300 GitHub repositories. This issue allows unauthenticated users to execute harmful code, potentially impacting major organizations like Microsoft, Google, Apache, and Cloudflare. The flaw, due to weak CI/CD configurations, raises significant supply chain security concerns.
Iranian APT Group Targets Israeli Organizations with New C2 Framework
An Iranian hacking group linked to the Ministry of Intelligence and Security is targeting Israeli IT and government entities using a new command-and-control framework, Cavern C2. This development, attributed to the Cavern Manticore cluster, suggests evolving threats in cybersecurity, potentially influencing strategies in these sectors.
BeyondTrust Patches Critical Vulnerabilities in Remote Support Products
BeyondTrust has patched critical vulnerabilities in its Remote Support and Privileged Remote Access software. These flaws, identified as CVE-2026-40138 and CVE-2026-40139, could allow unauthenticated attackers to bypass authentication controls and gain unauthorized access, risking elevated privilege accounts. The company urges users to apply the patches promptly.
Canadian Spy Agency Conducted Cyber Operations Against Criminal Groups
In 2022, Canada's Communications Security Establishment executed cyber operations against drug traffickers, violent extremists, and a ransomware gang. These state-authorized interventions aimed to thwart groups threatening Canada's national security and public safety. The operations utilized signals intelligence to disrupt criminal activities abroad, significantly impacting the targeted groups.
VEIL#DROP Malware Chain Uses Blogger to Deliver PureLogs Stealer
The VEIL#DROP malware delivery chain employs compromised Blogspot pages to deploy the PureLogs Stealer through multi-stage execution involving JavaScript and PowerShell. The use of trusted platforms like Google's Blogspot allows attackers to sidestep traditional defenses. Researchers have identified the sophisticated use of this infrastructure to access victims' sensitive information.