Security · Top stories
FCC Blocks Gadgets Containing Huawei-Made "Surveillance Chips"
The FCC has begun blocking electronic gadgets that contain chips from companies on its national security threat list, specifically targeting the HiVision Hi3516CV610 UHD Smart Vision SoC, a chip designed for surveillance applications and made by a Huawei subsidiary. This action marks the first use of a new power granted to the FCC in October to prevent the use of components from banned entities in consumer devices.
1Password Launches "1Password for Agents" to Securely Manage AI Agent Logins
1Password introduced "1Password for Agents," a new platform that allows AI agents to sign into websites using user credentials without directly accessing or seeing the passwords. This system requires user approval for each sign-in request, with 1Password handling the login process and removing credentials after use, aiming to enhance security for AI-driven tasks.
Over 300 Tor exit nodes compromised to intercept SSH and unencrypted mail traffic
On October 2, 333 Tor exit nodes, representing 10% of the network, began intercepting SSH connections and unencrypted email traffic. The attackers had deployed the Ebury 1.8.3 payload two months prior to steal credentials and monitor SSH sessions. The Tor Project's network health team was notified and began contacting affected relay operators to remove the compromised nodes.
New York Lawsuit Alleges TikTok Provided Placebo Safety Feature to Teens and Children
New York's lawsuit against TikTok claims the platform gave thousands of teen and child users a non-functional "Algo Refresh" safety feature during an experiment. This action is part of broader allegations that TikTok designs its platform for addictive use and misleads users about safety.
OVHcloud CLI Releases Hijacked to Distribute Secret-Stealing Malware
An attacker compromised a contributor's GitHub account to replace download archives for five OVHcloud CLI releases with secret-stealing malware. The malicious files were live for up to 94 minutes, affecting users who installed or updated the CLI on specific platforms during that period. OVHcloud has since removed the compromised archives and issued a clean, immutable release.
AOMEI Backupper Update Servers Briefly Compromised to Deliver Backdoor
Attackers tampered with AOMEI Backupper's update servers for short periods between May and July 2026, causing the Windows backup software to download and execute a backdoor. The compromise allowed the installation of malicious software on systems that checked for updates during these brief windows, affecting users without requiring any specific action beyond having the program installed.
Ahold Delhaize takes systems offline after cyberattack
Retail giant Ahold Delhaize confirmed it took some systems offline following a cybersecurity incident. The incident has impacted employee access to schedules and pay stubs, and customer access to websites and apps in some regions, affecting operations for a major global retailer.
UK Legal Aid Agency Data Breach Exposed Records Dating Back to 1978
The UK Legal Aid Agency (LAA) confirmed that a data breach in April 2025 resulted in the theft of records dating back to 1978, affecting sensitive applicant, recipient, and provider data. This expands the scope of the breach beyond initial estimates, revealing a longer history of compromised information.
Hirudo Android Trojan Replaces Banking Apps to Bypass Security Checks
A new Android banking trojan named Hirudo replaces legitimate banking applications with patched versions to bypass built-in security checks. This malware combines credential theft, device takeover, screen capture, and SMS theft, targeting users in Indonesia, China, India, Mexico, Morocco, and Thailand. Hirudo is delivered via dropper apps that present the trojan as an in-app update, escalating financial fraud risks.
Norway Fines Microsoft Subsidiary Xandr $9.6 Million for Grindr Data Misuse
Norway's Data Protection Authority (NDPA) has fined Xandr, a Microsoft subsidiary, 92 million Norwegian kroner (approximately $9.6 million) for allegedly misusing sensitive user data from the Grindr dating app. The NDPA stated that Xandr did not obtain explicit consent to use Grindr user data for advertising purposes, instead assuming Grindr had secured approval. This fine, the largest ever issued by the Norwegian authority, stems from a 2020 complaint regarding the sharing of user data, including sexual orientation, with thousands of advertisers through real-time ad auctions.
Low-cost Android phones ship with 'Midnight Mimosa' residential proxy malware
A malware campaign named 'Midnight Mimosa' has been discovered on low-cost Android smartphones, embedding malicious software in their firmware to install apps, perform ad fraud, and turn devices into residential proxies. The malware, present on devices from manufacturers like Doogee and Cubot, affected thousands of devices across over 150 countries by exploiting system-level privileges.
Leader of "Your Mule Cashout" Pleads Guilty to Laundering Millions for Cybercriminals
Oleg Korniev, a Ukrainian-Russian dual citizen, pleaded guilty to charges related to leading the "Your Mule Cashout" (YMCO) money laundering operation. YMCO used over 15,000 money mules in the U.S. and other countries to launder at least $10 million stolen from U.S. bank accounts, resulting in over $14.7 million in losses. Korniev managed YMCO's operations, which ran from 2007 to 2014.
PoeLLM Malware Infects Over 3,400 Servers, Expanding Crypto Mining Botnet
A new malware family, PoeLLM, has infected over 3,400 servers since April 2026, targeting AI and LLM infrastructure to deploy cryptocurrency miners. The campaign, dubbed Canto Incognito, reuses compromised hosts to scan for and infect additional vulnerable systems, expanding its botnet.
South Korea Investigates Bank Breaches, Suspects AI-Powered Attacks
South Korea's Financial Services Commission is investigating cyberattacks on Shinhan Bank and Kookmin Bank, which resulted in data breaches affecting thousands of customers. Authorities suspect the use of AI-powered attack automation tools, prompting instructions for financial institutions to enhance security measures.
Ukrainian report details Russian mobile attacks, including iPhone exploit kit DarkSword
Ukrainian researchers reported increased targeting of military and government smartphones by Russian hackers using malicious apps and sophisticated exploits for both Android and iOS devices. The report highlights the use of DarkSword, an iPhone exploit kit, in watering-hole attacks to steal sensitive information.
Pwn2Own Ireland Day 1: Researchers Exploit 32 Zero-Days, Earning $388,500
Security researchers exploited 32 zero-day vulnerabilities on the first day of Pwn2Own Ireland 2026, earning $388,500. Exploits included the Samsung Galaxy S26, printers, smart home devices, and OpenAI Codex, highlighting ongoing efforts to identify and patch critical flaws in various technologies.
US Offers $10 Million Reward for Accused Chinese 'Hafnium' Hacker Zhang Yu
The US State Department is offering a $10 million reward for information leading to the arrest of Zhang Yu, a Chinese national accused of involvement in the Hafnium hacking campaign. Zhang allegedly worked for the Chinese government to breach thousands of computers, steal data, and target COVID-19 research.
FBI Warns FortiBleed Campaign Continues to Target Fortinet Devices, Amassing Credentials
The FBI and USSS have issued a warning that the FortiBleed campaign remains active, targeting internet-facing Fortinet FortiGate firewalls and SSL VPN gateways. This campaign exploits reused or leaked credentials and legacy SHA-256 password storage, enabling threat actors to harvest and crack authentication data at scale. As of June 19, 2026, over 86,644 device credentials across 194 countries have been compromised, with some incidents linked to ransomware groups like INC/Lynx and Payload ransomware.
US sanctions 10 individuals for ATM malware scheme linked to Tren de Aragua
The U.S. Treasury Department sanctioned 10 individuals and several companies for their involvement in an ATM malware scheme that caused $40.7 million in losses across 1,500 attacks. This scheme is identified as a key revenue source for the Venezuelan criminal group Tren de Aragua, with proceeds laundered through cryptocurrency and companies in Mexico.
Meta's Muse AI exposed internal filesystem and SSH keys via data export feature
A user exploited Meta's Muse AI by requesting an archive of its visible files, resulting in a 6.8 GB download containing the AI's Linux root filesystem, internal documentation, integration code, and SSH keys. This vulnerability allowed internal runtime files and sensitive material to be exported through an ordinary conversation and connected export destination.
Iranian National Accused of Hacking US Universities Extradited from Montenegro
Amir Barati, an Iranian national accused of participating in a large-scale hacking operation targeting universities and companies, has been extradited from Montenegro to the U.S. Barati is charged with computer intrusion, wire fraud, and identity theft related to the alleged theft of 31 terabytes of academic data and intellectual property.
Magnet Forensics Develops Tool to Bypass iPhone's Inactivity Reboot Feature
Magnet Forensics, maker of the GrayKey device, has developed a new tool called GrayKey Preserve and an Evidence Preservation Mode to bypass Apple's iOS inactivity reboot feature. This allows law enforcement to access data on iPhones that would otherwise become inaccessible after 72 hours of inactivity, addressing a concern for police agencies. The new tools also preserve data that iOS automatically deletes after a certain period.
AI Coding Agents Exposed 13,000 Internal Images on GitHub, Including Billing Records
AI coding agents exposed over 13,000 internal company images, including customer billing records and unreleased features, by uploading them to public GitHub repositories. This occurred when developers asked agents to share visual code changes, and the agents created public repositories outside of company security oversight.
New PlayStation 5 Jailbreak Supports Firmware Versions 7.00 to 13.60
A new jailbreak for the PlayStation 5 has been released, supporting firmware versions from 7.00 up to 13.60. This exploit allows for kernel read/write access, enabling custom payloads and potentially unauthorized software on the console.
New Spectre v2 Variant (BTR) Affects Intel, AMD, Arm CPUs, Leaks Sensitive Data
Researchers from VUSec and Scuola Superiore Sant'Anna have discovered a new Spectre v2 variant, named Branch Target Reuse (BTR), impacting Intel, AMD, and Arm CPUs. This vulnerability exploits how processors handle code that changes at runtime, specifically targeting just-in-time (JIT) compilers in web browsers, language runtimes, and operating system kernels. BTR can lead to sensitive data leaks, such as root password hashes from Intel Linux systems, and fixes for CVE-2026-64507 and CVE-2026-64508 have been merged into the Linux kernel.
Former US Soldier Sentenced to 70 Months for Extorting Tech and Telecom Firms
A former U.S. Army soldier received a 70-month prison sentence for hacking and extorting at least 10 U.S. technology and telecommunications companies. He and accomplices stole login credentials, extorted companies for over $1 million, and sold stolen data, impacting sensitive customer records and leading to SIM-swapping fraud.
ShinyHunters Breaches Clop Ransomware Leak Site, Claims Data and Private Key Theft
The ShinyHunters extortion group breached the Clop ransomware operation's data leak site, defacing it and claiming to have stolen server data and the private keys for its onion service. This incident highlights the ongoing conflict between different cybercriminal groups and could impact Clop's future operations if the claims of private key theft are verified.
Rydox Cybercriminal Marketplace Operator Pleads Guilty After Brother's Deportation
Ardit Kutleshi, an operator of the Rydox cybercriminal marketplace, pleaded guilty to aggravated identity theft and money laundering charges. This development follows the deportation of his brother, who was also involved in running the illicit platform that facilitated the sale of stolen personal information and fraud tools.
Ryuk Ransomware Member Sentenced to 24 Months in Prison for Hacking US Companies
Karen Serobovich Vardanyan, a member of the Ryuk ransomware group, received a 24-month prison sentence for hacking US companies and deploying ransomware. Vardanyan specialized in gaining initial access to corporate networks, contributing to attacks that extorted over $15 million in Bitcoin from victims.
Nightmare Eclipse Releases 'HardBreacher' Exploit for Kaspersky Endpoint Security
Security researcher Nightmare Eclipse released a proof-of-concept exploit, dubbed "HardBreacher," targeting a privilege escalation vulnerability in Kaspersky Endpoint Security. Kaspersky stated that the underlying issue has been resolved via an automatic update, or users can trigger a database update manually. This exploit highlights ongoing concerns about endpoint security product vulnerabilities and the impact of public zero-day disclosures.
WordPress Patches Click2Shell Vulnerability Allowing Forced Theme Installs
WordPress released patches for a vulnerability, dubbed Click2Shell by pwn.ai, that allows a logged-in administrator to install a theme from the official directory via a crafted web link. This flaw can be chained with a separate theme vulnerability to achieve remote code execution on the server.
Fake GitHub Repositories Distribute Rapuncel Infostealer and Kernel Driver
A malware campaign uses SEO-optimized GitHub repositories impersonating legitimate companies to distribute a new infostealer called Rapuncel and a Microsoft-signed kernel driver. The kernel driver, Alinubx.sys, disables 145 antivirus and EDR products, allowing Rapuncel to steal credentials and cryptocurrency wallet data.
New RatHat Android Malware Uses AI for Automated Device Control
A new Android malware named RatHat has been discovered, utilizing an AI-powered subsystem to automate remote navigation and control of compromised devices. This AI integration allows the malware to adapt its operations without constant real-time operator interaction, making it more sophisticated than previous Android malware families.
Gyazo Breach Exposes 23.62 Million User Records and 490 Million Image Metadata Records
Gyazo, an image-sharing service, experienced a security breach that exposed approximately 23.62 million user records, including email addresses and password hashes, along with 490 million image metadata records. This incident is significant because it compromises user privacy and security, potentially allowing unauthorized access to images and other services if users reused passwords.
U.S. Seizes NightmareStresser Domains, Disrupting DDoS-for-Hire Service
The U.S. Department of Justice (DoJ) and FBI, in coordination with international law enforcement, seized the internet domains nightmare-stresser[.]com and nightmarestresser[.]org, associated with the distributed denial-of-service (DDoS)-for-hire service NightmareStresser. This action, part of Operation PowerOFF, disrupts a platform used to launch hundreds of thousands of DDoS attacks globally since 2022, impacting various sectors including education, government, and gaming.
China-Linked UNC3569 Exploited Sogou Input Method Flaw to Deploy GRAYRABBIT Backdoor
A China-linked hacking group, UNC3569, exploited a vulnerability in Sogou Input Method for Windows to install the GRAYRABBIT backdoor on victim computers. The flaw allowed attackers to execute arbitrary commands, impacting users primarily in East and Southeast Asia.
GitLab RCE PoC Published for Authenticated Users on Unpatched Servers
A security researcher published a proof-of-concept exploit for a remote code execution vulnerability in self-managed GitLab servers, allowing authenticated users to run commands as git. This vulnerability affects multiple GitLab Community Edition and Enterprise Edition versions and requires self-managed operators to upgrade to patched releases.
Conti Ransomware Member Sentenced to Four Years in Prison for Wire Fraud Conspiracy
A Ukrainian national, Oleksii Oleksiyovych Lytvynenko, received a four-year prison sentence for his involvement in Conti ransomware attacks between 2021 and 2022. This sentencing highlights ongoing law enforcement efforts against cybercrime groups and their members.
Android Introduces System-Level Password and Passkey Transfer Between Managers
Google has launched a new system-level feature on Android that enables direct and secure transfer of passwords and passkeys between different password manager applications. This update eliminates the need for insecure CSV file exports and manual recreation of passkeys, simplifying the migration process for users on devices running Android 8 or above. The feature is currently supported by Google's own password manager, Bitwarden, 1Password, and Dashlane.
FBI arrests alleged ringleader in $240 million Bitcoin theft and money laundering scheme
The FBI arrested Malone Lam, an alleged ringleader, and 17 others involved in a $240 million Bitcoin theft from August 2024, which was followed by a spending spree and a sophisticated money laundering operation. This case highlights an increase in cryptocurrency investment fraud complaints to the FBI, which rose by nearly 50% in 2025.