Security · Top stories
New TELESHIM Malware Uses Telegram for C2 in Attacks Against Middle East Governments
Cybersecurity researchers at Zscaler ThreatLabz identified a new cyber campaign by an East Asian threat actor targeting Middle Eastern government entities. This campaign deploys previously undocumented malware families, including TELESHIM, which abuses the Telegram API for command-and-control communications. The use of Telegram for C2 allows the malware to blend with legitimate network traffic, posing a challenge for detection and defense.
Vatican's 'Click to Pray' app exposed user data for over six months due to security flaws
The official Vatican 'Click to Pray' app had critical security vulnerabilities that exposed personal data of over 700,000 users for more than six months. A security researcher discovered that user IDs could be used to access names, email addresses, and birthdates, and the issues were only fixed after public disclosure.
ShinyHunters data leaks exploited in $2,000 Bitcoin sextortion email scam
Threat actors are using email addresses exposed in data breaches leaked by the ShinyHunters group to send sextortion emails demanding $2,000 in Bitcoin. These emails falsely claim to be from ShinyHunters and allege device compromise, leveraging previously leaked data to appear legitimate.
Pro-Ukraine Group Claims Cyberattack Led to Russian Su-57 Fighter Jet Crash
A pro-Ukraine group, InformNapalm, claims a cyberattack on a Russian BARS drone defense system near Moscow caused a Russian Su-57 stealth fighter jet to be shot down in a friendly fire incident. Russia attributes the crash to a "technical malfunction" during a routine training mission. This claim, if substantiated, indicates a successful sabotage operation against a high-value Russian military asset.
DevMan RaaS Operates Centralized Portal for Payload Builds and Victim Management
The DevMan ransomware-as-a-service (RaaS) scheme utilizes a dedicated web portal for affiliates to build payloads, manage victims, and handle payouts. This centralized platform, tracked by PRODAFT as Funky Mantis, integrates various functions from build generation to victim chat and financial management, indicating a structured and sophisticated operation.
Rockwell Patches Code Execution Flaws in Arena Simulation Software
Rockwell Automation has released a patch for four high-severity vulnerabilities in its Arena Simulation software that could allow arbitrary code execution. These memory corruption flaws, present in versions up to 17.00.00, require user interaction to exploit but are significant due to the software's broad use in critical sectors.
Magnet Forensics Sues Paradigm Shift Over Alleged Theft of Exploit Trade Secrets
Magnet Forensics has filed a lawsuit against Paradigm Shift Technology, alleging that the usbliter8 exploit, which affects Apple A12 and A13 SoCs, was developed using trade secrets stolen by a former Magnet engineer. This legal action raises questions about intellectual property in cybersecurity research and the origins of publicly disclosed vulnerabilities.
OnTrac notifies customers of data breach after network hack
OnTrac, a parcel delivery company, experienced a data breach between March 20 and 22, 2024, where hackers accessed its corporate network and potentially customer personal details. The company is offering 12 months of free credit monitoring and identity protection to affected customers.
Y Combinator Startup School application system vulnerable to score manipulation
A founder discovered and exploited a vulnerability in Paxel, the system Y Combinator uses to score Startup School applicants, allowing manipulation of application scores. Y Combinator patched the vulnerability and invited the founder to attend Startup School after public disclosure. This highlights a security flaw in a widely used application process for a prominent startup accelerator.
UK Prime Minister Reappoints Cybersecurity Minister Despite Department Abolition
UK Prime Minister Andy Burnham reappointed Liz Lloyd as cybersecurity minister, maintaining policy continuity despite abolishing the department that previously housed the role. This decision ensures the progression of the Cyber Security and Resilience Bill through Parliament, which updates cyber regulations and expands their scope to more organizations.
CertiK Reports 33% Increase in 'Wrench' Attacks Against Crypto Holders in H1 2026
CertiK reported a 33% year-over-year increase in "wrench" attacks, physical coercion incidents targeting cryptocurrency holders, during the first half of 2026. These attacks, which involve violence or intimidation to force asset transfers, highlight a growing trend of real-world threats impacting digital asset security.
Europol Flags 4,340 URLs for Removal in Crackdown on 'The Com' Extremist Network
Europol identified 4,340 URLs for removal during a multi-week operation in June and July 2026, targeting online content from "The Com," a network of nihilistic violent extremist groups. This action aims to disrupt the online ecosystem of these groups and limit the spread of content promoting self-harm, child sexual exploitation, and violence.
Bing Image Flaws Allowed Remote Code Execution on Microsoft Servers via Crafted SVGs
Security researchers at XBOW discovered two critical vulnerabilities in Bing's image processing service that allowed remote code execution as SYSTEM on Microsoft's production servers. Microsoft has since patched these server-side flaws, identified as CVE-2026-32194 and CVE-2026-32191, before public disclosure, requiring no user action.
Man sentenced to six years for hacking 750 women's Snapchat accounts and distributing CSAM
An Illinois man received a 76-month prison sentence for hacking over 750 women's Snapchat accounts to steal nude photos, which he then traded or sold online. The investigation also uncovered his distribution of child sexual abuse material (CSAM), leading to charges and a conviction that highlights the severe consequences of cybercrime involving personal data and illicit content.
Golden Chickens Malware-as-a-Service Introduces Four New Malware Families
The Golden Chickens malware-as-a-service (MaaS) ecosystem has released four new malware families: TinyEgg, ChonkyChicken, a modular ChonkyChicken variant, and ChromEggscalator. This development indicates an architectural shift towards modular, operator-driven tooling for defense evasion, impacting organizations targeted by financially motivated threat actors.
NodeBB Patches Eight AI-Found Security Flaws Exposing Admin Access and Private Chats
NodeBB has released version 4.14.2 to patch eight security flaws, rated high severity by Aikido Security, that could expose admin access and private user data. These vulnerabilities, discovered by AI pentest agents, affect all NodeBB versions prior to 4.14.0 and could allow unauthorized access to administrative functions, private messages, and the injection of malicious code.
Redis Patches Zero-Day Vulnerabilities Allowing Remote Code Execution
Redis released seven security updates on July 23 to address authenticated remote code execution (RCE) vulnerabilities in multiple Redis versions. These vulnerabilities, which require the RESTORE command, could allow attackers to execute arbitrary code on affected systems. Users are advised to upgrade to the patched versions or revoke RESTORE permissions from untrusted accounts.
Namecheap Account Compromised After Unverified Third Party Gains Access
A Namecheap customer reported that an unverified third party gained access to their account and changed the password and associated email address. This occurred after the third party, a new club leader, convinced Namecheap support that a domain registered to the customer actually belonged to their club, despite the customer having previously alerted Namecheap to an unauthorized password reset attempt. This incident highlights a significant vulnerability in Namecheap's account verification processes, allowing unauthorized access based on a phone call without proper validation.
State Department Imposes Visa Restrictions on Foreign Cyber Scammers and Their Families
The U.S. State Department announced new visa restrictions targeting individuals involved in foreign cybercrime networks, including cyberscams and sextortion, and their immediate family members. This policy aims to combat industrial-scale scam centers, particularly in Southeast Asia, which are estimated to cost Americans billions annually.
OneCLI Open-Source Credential Gateway Secures AI Agent API Access
OneCLI, an open-source credential gateway, has been released to manage API keys for AI agents. It addresses the security risk of embedding raw credentials directly into AI agents by transparently injecting them into outbound requests.
New Threats Include macOS Infostealer via npm Package and Malicious VS Code Extension
A new macOS infostealer is being distributed through an npm package, and a malicious Visual Studio Code extension impersonates a popular tool to exfiltrate data and open backdoors. These incidents highlight ongoing supply chain and marketplace security risks for developers.
Leaked Document Details ICE's Extensive Surveillance Capabilities
A leaked document, titled "ICE Wide Analytical Tools," reveals the broad range of surveillance and investigative technologies available to Immigration and Customs Enforcement (ICE) officials, including tools for location tracking, facial recognition, and anonymous online operations. This disclosure provides a rare public look into the agency's technological arsenal, which includes access to personal data, social media monitoring, and vehicle tracking. The document highlights the significant data collection and surveillance capabilities ICE possesses, raising questions about privacy and the scope of government monitoring.
China-Nexus JadeProx Group Uses New TriBack Loader in Attacks on Government and Healthcare
Group-IB uncovered a China-nexus operation, JadeProx, that used a new Windows loader called TriBack Loader to target government, healthcare, and education organizations in Asia and Latin America. The discovery was made through an exposed Alibaba Cloud server, revealing active intrusions and spear-phishing campaigns. This new loader employs DLL sideloading and various evasion techniques, posing a threat to targeted sectors.
Attackers Weaponize GitHub Actions Runners to Target cPanel and WHM Servers
A large-scale campaign is using compromised GitHub repositories to create distributed attack infrastructure, targeting cPanel and WebHost Manager (WHM) instances. Malicious GitHub Actions workflows in compromised developer accounts are exploiting CVE-2026-41940 to gain elevated control and harvest credentials from vulnerable servers.
Assaf Keren Appointed Chief Information Security Officer at Meta
Assaf Keren has been appointed as the new Chief Information Security Officer (CISO) for Meta, succeeding Guy Rosen. Keren brings extensive experience from previous CISO roles at PayPal and Qualtrics, and will focus on building trust infrastructure for AI at Meta's global scale.
House Passes Defense Bill Extending CISA 2015 Info-Sharing Protections for a Decade
The House passed its version of the annual defense policy bill, which includes a provision to extend the 2015 Cybersecurity and Information Sharing Act (CISA) for another decade. This extension is significant because CISA 2015 provides legal protections for the private sector and federal government to share data on cyber threats, and its brief expiration last year hindered federal officials' visibility into digital threats.
Ubuntu snap-confine Flaw Allows Local Root Privilege Escalation on Desktop Installs
A local privilege escalation vulnerability (CVE-2026-8933) in snap-confine allows unprivileged users to gain root access on default Ubuntu Desktop installations. This flaw, caused by a race condition during sandbox initialization, enables attackers to take full control of affected systems.
Eclypsium launches InfraTrust report for prioritizing infrastructure vulnerabilities
Eclypsium released InfraTrust and its inaugural Pulse report to help organizations prioritize infrastructure vulnerabilities. The report focuses on exploitability and real-world impact rather than just severity scores, highlighting flaws from key vendors that require urgent attention.
Verona, Wisconsin Covers Flock Cameras Amid Removal Dispute
Verona, Wisconsin, has covered its automated license plate cameras with trash bags while awaiting removal by Flock. This decision arose after the city council voted to terminate their contract with Flock but encountered challenges regarding the proper removal and legalities surrounding the cameras.
Security Flaws Found in Vibe-Coded Applications
Xint.io identified 434 exploitable security issues in vibe-coded applications, revealing significant vulnerabilities. This highlights the need for better security practices and oversight in AI-assisted coding efforts as reliance on such technologies increases.
Furtex Toolkit Launches for Post-exploitation Research on Linux
The Furtex toolkit has been released, offering tools for post-exploitation and evasion research on Linux using io_uring and eBPF. It includes 75 EDR evasion tools and various utilities designed for authorized red team operations, emphasizing its use on owned systems only.
OpenAI and Hugging Face Report Security Incident in Model Evaluation
OpenAI and Hugging Face confirmed a security incident during the evaluation of machine learning models. This incident emphasizes the need for robust security measures in AI development environments.
Cisco Introduces Antares AI Models for Code Vulnerability Detection
Cisco Foundation AI has launched Antares, a family of small language models aimed at identifying vulnerabilities within codebases. Antares offers an open-weight approach, balancing cost and accuracy while addressing data sovereignty issues in security research.
AWS Enhances Bot Traffic Security with Web Bot Authentication in WAF Bot Control
AWS WAF Bot Control now includes Web Bot Authentication (WBA), using cryptographic signatures to distinguish legitimate AI bot traffic from malicious activity. This update addresses security challenges in multi-tenant environments such as Amazon Bedrock AgentCore, where traditional IP-based methods fall short. The method leverages two IETF drafts to verify bot identities securely.
Node.js to release security updates for multiple versions on July 27, 2026
The Node.js project plans to release security updates for versions 26.x, 24.x, and 22.x on July 27, 2026. The updates will address high severity security vulnerabilities, emphasizing the need for users to maintain up-to-date software for system security.
SecurityWeek Introduces Critical Impact Awards for Industrial Cybersecurity
SecurityWeek has launched the Critical Impact Awards to recognize achievements in industrial cybersecurity. This awards program aims to honor organizations and individuals based on merit rather than sponsorship, enhancing credibility in the cybersecurity field.
Kenya investigates hack of president's website demanding bitcoin ransom
Kenya is investigating a cyberattack that defaced President William Ruto's official website with a ransom demand of five bitcoins. The attackers claimed this was their third warning to the president, though no sensitive data has been compromised according to government officials.
CISO Andreas Gaetje Discusses Career Path at Körber AG
Andreas Gaetje, CISO at Körber AG, reflects on his unconventional career journey from economics to cybersecurity. He emphasizes the significance of adapting to the evolving role of IT security, which has grown from compliance to a critical business threat.
Meta Awards $78,000 Bug Bounty for Critical Customer Support Data Vulnerability
Meta has awarded a $78,000 bounty to researcher Rony K Roy for discovering a vulnerability in its support data system that could have led to the exposure of sensitive customer information. The issue, initially thought minor, was found to allow unauthorized access to support cases and user communications, demonstrating significant flaws in Meta's security framework.
Clover Health Investments Reports Data Breach Affecting Customer Information
Clover Health Investments disclosed a data breach affecting customers' personal and health information due to a social engineering attack that compromised three employee accounts. The company initiated its response plan and engaged cybersecurity experts to handle the situation, though the full impact of the breach is still being investigated.