VulnHub

A hacker has reportedly used advanced AI tools, Claude Code and GPT-4.1, to steal personal records of hundreds of millions of Mexican citizens from nine different government agencies. This breach raises serious concerns about data security and the potential misuse of sensitive information. The stolen records likely include personal identifiers, which could lead to identity theft or fraud. The incident highlights vulnerabilities in governmental data protection practices and the growing capabilities of cybercriminals using AI for malicious purposes. Authorities will need to investigate the breach thoroughly and implement stronger security measures to protect citizen data in the future.

A serious vulnerability in Marimo software has come to light, allowing attackers to execute remote code without needing authentication. This flaw is currently being exploited to steal user credentials, making it a pressing issue for organizations using this software. The nature of the vulnerability means that it could potentially affect a wide range of users and systems that rely on Marimo. Companies need to act quickly to protect their data and systems from unauthorized access. Immediate action is essential to mitigate the risk posed by this vulnerability as attackers are actively targeting it.

Recent research has identified thirty-six malicious npm packages related to the Strapi framework that have been linked to Redis remote code execution (RCE), database theft, and persistent command and control (C2) capabilities. In addition, malicious LNK files are being used to distribute a Python-based backdoor. The Kimsuky Group has also been noted for changing their distribution techniques to enhance their attacks. These developments pose serious risks to developers and organizations using these tools, as they could lead to unauthorized access and data breaches. It is crucial for users to be vigilant and ensure they are using secure versions of these packages to avoid falling victim to these threats.

Censys researchers have identified 5,219 Rockwell PLCs (Programmable Logic Controllers) that are exposed to potential attacks, with the majority located in the United States. This warning comes after U.S. agencies, including the FBI, CISA, and NSA, reported that Iranian-linked advanced persistent threat groups are actively exploiting these internet-connected devices. The attacks target operational technology across various critical infrastructure sectors, raising concerns about national security. Experts are urging organizations to secure these devices or disconnect them from the internet to prevent potential breaches. The situation underscores the need for better security measures in industrial control systems, especially as cyber threats continue to evolve.

The GlassWorm campaign has evolved significantly since its inception in 2025, now utilizing a Zig-based dropper embedded in a fake Integrated Development Environment (IDE) extension. This method targets developer tools, allowing attackers to compromise systems through malicious software packages. Initially starting with harmful npm packages, the campaign has escalated to large-scale supply chain attacks affecting platforms like GitHub, npm, and Visual Studio Code. Additionally, the attackers have deployed Remote Access Trojans (RATs) via counterfeit browser extensions. This evolution raises concerns for developers and organizations, as it highlights the growing sophistication of supply chain threats in the software development ecosystem.

A serious vulnerability in the open-source Python notebook tool Marimo, identified as CVE-2026-39987, has been exploited within just 10 hours of its disclosure on April 8, 2026. This flaw has a CVSS score of 9.3, indicating its severity and potential impact. Researchers from the Sysdig Threat Research Team reported that attackers began exploiting this vulnerability almost immediately, raising alarms about the security of systems using Marimo. This incident underscores the urgency for users and organizations relying on this tool to take immediate action to protect their systems from potential breaches. Quick exploitation of such vulnerabilities demonstrates the need for timely patching and awareness in the cybersecurity community.

ShinyHunters, a known hacking group, claims to have gained access to data from Rockstar Games' Snowflake platform due to a breach involving Anodot, a data analytics company. They have threatened to leak this data on April 14 unless their ransom demands are met. This incident raises concerns about the security of sensitive information related to Rockstar, a major player in the gaming industry. If the breach is legitimate, it could expose user data and proprietary information, impacting both the company and its customers. The situation is still developing, and Rockstar Games has not yet confirmed the breach or provided details on any potential data compromise.

Cybersecurity teams are facing an increasing number of credential-based attacks, which are becoming more sophisticated and harder to detect. To combat this trend, experts suggest that teams need to shift their detection models to better identify these threats as they evolve. This includes adapting to the changing tactics used by attackers, who often disguise their activities to look like normal business operations. As organizations continue to rely on digital credentials for access, the risk of these types of attacks grows, potentially leading to significant data breaches and financial losses. Companies must stay vigilant and update their security strategies to protect against these emerging threats.

The FBI and NSA have issued a warning about Russian hackers taking advantage of vulnerabilities in routers. These attackers are reportedly exploiting weaknesses to gain unauthorized access to networks, potentially compromising personal and corporate data. This issue affects a wide range of router models, but specific brands and versions have not been disclosed. Users and businesses are encouraged to take proactive measures to secure their routers, as these vulnerabilities could lead to significant security breaches. Ensuring that firmware is updated and default settings are changed are among the recommended steps to mitigate the risk.