Checkmarx has confirmed that attackers known as TeamPCP compromised the Jenkins AST plugin, altering its version before it was published to the Jenkins Marketplace. Users of the Checkmarx Jenkins AST plugin are advised to ensure they are using version 2.0.13-829.vc72453fa_1c16 or an earlier version released on December 17, 2025. This incident follows a previous supply chain attack involving KICS, raising concerns about the security of plugins within the Jenkins ecosystem. Organizations using this plugin should take immediate action to verify their version to prevent potential exploitation. The situation underscores the ongoing risks associated with third-party software components in development environments.
A serious security vulnerability in cPanel, identified as CVE-2026-41940, is currently being exploited by a threat actor known as Mr_Rot13. This flaw allows attackers to bypass authentication and gain elevated control over cPanel and WebHost Manager (WHM) environments. The exploitation of this vulnerability has led to the deployment of a backdoor named Filemanager on compromised systems. This incident is particularly concerning because it puts web hosting environments at risk, potentially allowing unauthorized access to sensitive data and control over web applications. Users and administrators of affected cPanel and WHM versions need to be vigilant and take immediate action to secure their systems.
In the article, Dustin Sachs discusses the risks associated with Managed Security Service Providers (MSSPs) and the concept of blind trust in cybersecurity practices. The piece emphasizes that companies often rely heavily on MSSPs for security without fully understanding their practices or the potential vulnerabilities involved. This can lead to significant security gaps and increase the risk of breaches. Organizations are urged to conduct thorough due diligence on MSSPs, examining their security protocols and incident response capabilities. The article serves as a reminder that trusting third-party providers without scrutiny can expose businesses to serious threats.
Instructure, the company behind the Canvas learning management system, has acknowledged that a security flaw was exploited by hackers to alter Canvas login portals. This breach allowed the attackers to leave an extortion message, raising serious concerns about the security of educational platforms used by schools and students. The incident underscores the vulnerability of widely used technologies in the education sector, as they can be targeted for malicious purposes. Users of Canvas, including students and educators, may face disruptions or potential data risks due to this security lapse. It's crucial for institutions to evaluate their security measures and ensure that similar vulnerabilities are patched to prevent future incidents.
South Staffordshire Water's parent company has been fined nearly £1 million by the UK's Information Commissioner’s Office (ICO) due to a severe security breach that lasted for almost two years. The incident began in September 2020 when an employee fell for a phishing email and opened an infected attachment, allowing hackers to install malicious software on the company’s network. This intrusion went unnoticed for 20 months, during which the personal data of 633,887 individuals was compromised. This case underscores the importance of robust cybersecurity measures, especially for organizations handling sensitive customer information. The long duration of the breach raises concerns about the effectiveness of the company's security protocols and employee training regarding potential cyber threats.
Researchers at ThreatFabric have identified a new variant of the TrickMo Android banking trojan, which is now routing its command and control (C2) traffic through The Open Network (TON). This change in infrastructure allows the malware to operate more stealthily, making it harder for security measures to detect and block its activities. The TrickMo trojan primarily targets Android devices, aiming to steal sensitive banking information from users. This development is concerning because it indicates that attackers are adapting their strategies to evade detection, which could lead to increased financial fraud. Users of Android devices, particularly those who engage in online banking, need to be vigilant and take precautions to protect their information.
A new vulnerability known as Dirty Frag has been discovered in the Linux kernel, raising alarms among security professionals. This bug could allow attackers to exploit systems running affected versions of the kernel, potentially leading to unauthorized access or control. Users and organizations that rely on Linux-based systems, particularly those using versions released in recent years, need to take immediate action to mitigate risks. As of now, there is no straightforward fix available, which adds to the urgency of the situation. It's crucial for system administrators to monitor updates from their Linux distributions and apply any available security patches as soon as they are released to protect their systems from potential exploitation.
Recent vulnerabilities in Linux, including Copy Fail and Dirty Frag, are raising alarms within the open-source community. These issues highlight the growing complexity and scale of Linux systems, which are increasingly targeted due to their widespread use in servers and cloud environments. The Linux development community is actively addressing these vulnerabilities, implementing patches and updates to strengthen security. While some experts express concern, others believe the community's proactive approach will mitigate risks. This situation serves as a reminder for organizations relying on Linux to stay vigilant and apply updates promptly to protect their systems.
German law enforcement has successfully shut down the relaunched Crimenetwork marketplace, a platform known for facilitating the trade of illegal goods and services. The original version of Crimenetwork was dismantled in December 2024, but it resurfaced recently, prompting authorities to take action again. The operator of the site was arrested during the operation. This incident highlights the ongoing battle against online criminal marketplaces, which continue to evolve despite law enforcement efforts. The closure of Crimenetwork is significant as it disrupts the supply chain for illicit goods, affecting both users and vendors involved in these illegal activities.
A recent survey conducted by Cybernews found that just 18% of American smartphone users invest in third-party antivirus software. The majority rely on the built-in security features offered by their device manufacturers, such as Microsoft and Apple. This trend raises concerns about the level of protection users are receiving, especially as cyber threats continue to evolve. Many users may believe that the default security measures are sufficient, but this can leave them vulnerable to malware and other attacks. As cybercriminals become more sophisticated, it's crucial for users to understand the risks and consider additional security measures beyond the basics.
Researchers have identified two serious vulnerabilities in the Linux kernel, collectively referred to as 'Dirty Frag'. These vulnerabilities can impact a wide range of Linux distributions, making it a significant concern for users and organizations relying on Linux systems. The flaws could allow attackers to exploit the kernel, potentially leading to unauthorized access or system control. As a result, developers are rushing to release patches to mitigate these risks. Users should ensure they update their systems promptly to protect against potential exploitation.
Sohaib Akhter, a Virginia man, was found guilty of intentionally destroying databases belonging to his former employer after he was fired. The company, which provided services to over 45 federal agencies, was significantly impacted by the loss of data on February 18, 2025. Akhter's actions resulted in the deletion of crucial information, raising concerns about the security of sensitive government data. His twin brother, Muneeb Akhter, was also implicated in the incident. This case underscores the potential risks posed by disgruntled employees who may resort to sabotage, highlighting the importance of implementing robust data security measures and employee monitoring in organizations that handle sensitive information.
A new approach called Build Application Firewalls aims to enhance security during the software development process by monitoring the runtime behavior of applications within the build pipeline. Traditional methods typically focus on scanning code for vulnerabilities, but this new strategy seeks to address the growing concern of supply chain attacks, which have become more prevalent and damaging in recent years. By inspecting how software operates in real-time, these firewalls can potentially catch malicious activities that static scans might miss. This innovation is crucial as it helps protect developers and organizations from sophisticated threats that target software supply chains. As more companies adopt these firewalls, the hope is to create a more secure environment for software development and deployment.
Researchers at Ontinue have discovered a fake installer for Claude Code, a coding tool, that is actually distributing a PowerShell stealer. This malicious software takes advantage of a feature in Chrome known as IElevator2, which could allow attackers to execute scripts with elevated permissions. Developers who download this counterfeit installer could unknowingly compromise their systems, leading to potential data theft and security breaches. This incident emphasizes the ongoing risks associated with downloading software from unverified sources, particularly for developers who often use third-party tools. It's crucial for users to ensure they are obtaining software from legitimate channels to avoid falling victim to such attacks.
Resetting passwords in Active Directory doesn't guarantee that attackers are removed from the system. Research by Specops Software reveals that attackers can maintain access through cached credentials and Kerberos tickets even after a password change. This means that organizations could mistakenly believe they have secured their systems simply by updating passwords, leaving them vulnerable to ongoing breaches. Understanding these methods of persistence is crucial for IT departments, as it emphasizes the need for more comprehensive security measures beyond just password management. This issue highlights a significant gap in many organizations' cybersecurity strategies, potentially exposing sensitive data and leading to further exploitation.