VulnHub

The U.S. House Committee on Homeland Security has called for testimony from executives at Instructure regarding two significant cyberattacks on its Canvas platform, executed by the ShinyHunters extortion group. These attacks compromised sensitive student data and caused disruptions in schools, particularly during critical final exam periods. The incidents raised alarms about the security measures in place to protect educational institutions, as they directly affect students' academic performance and privacy. The committee's inquiry highlights the growing concern over cyber threats targeting educational technology, emphasizing the need for stronger safeguards against such breaches. As schools increasingly rely on digital platforms, the implications of these attacks could lead to calls for more stringent regulations and practices to protect student information.

A new malware known as 'Mini Shai-Hulud' has compromised hundreds of open-source packages in a significant supply-chain attack. This malware has targeted major registries, disguising itself behind legitimate release signatures, which allows it to infiltrate software updates unnoticed. As a result, developers and organizations relying on these open-source packages may unknowingly integrate malicious code into their applications. This incident emphasizes the vulnerabilities present in the software update process and raises concerns about the security of open-source software. Researchers are urging developers to be vigilant and to verify the integrity of their dependencies before use.

A recent wave of attacks, referred to as 'Mini' Shai-Hulud, has compromised hundreds of packages from popular repositories like npm and PyPI. Attackers are exploiting trusted OpenID Connect (OIDC) tokens to bypass integrity checks, allowing them to distribute malicious code disguised as legitimate packages. This situation puts developers and organizations at risk, as they may unknowingly incorporate these tainted packages into their projects. The incident serves as a reminder for users to scrutinize package sources and implement additional security measures when managing dependencies. Ongoing vigilance is crucial to mitigate the potential fallout from these compromised packages.

Fortinet has issued urgent security patches to address two serious vulnerabilities in its FortiSandbox and FortiAuthenticator products. These flaws could allow attackers to execute commands or arbitrary code, posing a significant risk to organizations using these systems. The vulnerabilities affect both security and authentication processes, making them critical to address promptly. Users and administrators are advised to apply the patches immediately to protect their environments from potential exploitation. This situation underscores the need for ongoing vigilance in managing software security and ensuring systems are updated.

Researchers at Ontinue have identified a malware campaign that is specifically targeting developers. The campaign uses fake installers for a software called Claude Code to trick users into downloading malware that steals browser credentials, including passwords and cookies. This is particularly concerning for developers as they often store sensitive information in their browsers. The use of fake installers raises alarms about the increasing sophistication of cyber attacks aimed at software developers, who may be more vulnerable due to their technical backgrounds and reliance on various tools. Users are advised to be cautious when downloading software and to verify sources before installation.

Sasha Levin, a co-maintainer of the Linux kernel, has introduced a proposal for a runtime killswitch designed to disable vulnerable kernel functions temporarily. This mechanism would be accessible through securityfs, allowing system administrators to quickly mitigate risks associated with known vulnerabilities. The proposal aims to provide a practical solution for managing vulnerabilities in the Linux kernel, which is critical given the widespread use of Linux in servers and devices. By enabling a quick response to potential exploits, this initiative could help enhance the security posture of systems utilizing the Linux kernel. The implementation of such a killswitch is especially relevant as cyber threats continue to evolve, targeting vulnerabilities in operating systems.

A newly discovered vulnerability, identified as CVE-2026-41940, is affecting cPanel and WebHost Manager, allowing attackers to exploit it shortly after it was made public. The threat actor known as Mr_Rot13 has been observed using this flaw to deploy a backdoor known as Filemanager, which can grant unauthorized access to compromised systems. This situation poses serious risks to web hosting providers and their customers, as it could lead to data breaches and unauthorized control over hosted websites. Companies using affected versions of cPanel and WebHost Manager need to take immediate action to secure their systems and protect sensitive data from being exploited. The urgency of addressing this vulnerability cannot be overstated, given the potential for widespread impact on affected users.

West Pharmaceutical Services recently fell victim to a ransomware attack that forced the company to take its systems offline worldwide. Hackers not only encrypted files but also exfiltrated sensitive data, raising concerns about the potential impact on the company's operations and the confidentiality of customer information. This incident highlights the growing threat of ransomware attacks in the healthcare sector, where the implications can be particularly severe given the sensitive nature of the data involved. Companies in similar industries should take this event as a wake-up call to bolster their cybersecurity measures and prepare for potential attacks. The full extent of the damage and the specific data compromised is still under investigation.