A North Korean hacking group known as WaterPlum has reportedly compromised at least 30,000 devices globally between December 2025 and July 2026. The attackers managed to siphon off over $10.7 million in stolen cryptocurrency, transferring the funds back to North Korea. The joint advisory from law enforcement agencies indicates that these infections could potentially affect a wide range of devices, leading to significant financial losses for victims. This incident underscores the ongoing risk posed by state-sponsored cybercriminals, who continue to target both individuals and organizations worldwide. Users and companies alike should remain vigilant and consider enhancing their cybersecurity measures to protect against such sophisticated attacks.
Latest Cybersecurity Threats
Real-time threat intelligence from trusted sources
The ShinyHunters extortion group has successfully hacked into the Clop ransomware operation's data leak site, which is hosted on the Tor network. They defaced the site and reportedly stole sensitive information, including server data and the private keys for the onion service. This breach is significant because it exposes vulnerabilities within the Clop operation, which has been known for its ransomware attacks. By targeting Clop, ShinyHunters may be attempting to assert dominance within the cybercrime world, potentially leading to further infighting among ransomware groups. This incident raises concerns about the ongoing battle between rival gangs and the implications for victims of ransomware attacks, as it could affect negotiations and payouts in future incidents.
Spear phishing is a targeted form of phishing where attackers impersonate a trusted source to deceive individuals into providing sensitive information, such as login credentials or financial data. This method often involves detailed research on the victim to make the communication appear legitimate. Organizations and individuals can be affected, leading to data breaches, financial loss, and reputational damage. Prevention strategies include employee training to recognize phishing attempts, implementing multi-factor authentication, and using advanced email filtering systems. Staying vigilant and informed about these attacks is essential to protect sensitive information.
Researchers from Hacktron recently demonstrated the ability to exploit a vulnerability in Discourse, a popular forum software, to hijack accounts belonging to OpenAI staff. This attack was notable as it bypassed traditional methods like phishing or leaked passwords, instead using an image upload feature to gain access. Within 72 hours, the researchers managed to take control of accounts associated with OpenAI's ChatGPT and Codex, raising concerns about the security of shared single sign-on (SSO) systems. The incident serves as a reminder of the potential risks associated with vulnerabilities in widely-used platforms and the importance of robust security measures for managing sensitive accounts. Companies using SSO should review their security practices to prevent similar incidents.
Three researchers from Hacktron successfully exploited vulnerabilities in OpenAI's security systems using Anthropic's Claude Opus 5. They first identified a bug in OpenAI's public help forum software, which allowed them to bypass security measures in OpenAI's login system. As a result, they gained access to the ChatGPT and Codex accounts of multiple OpenAI employees and reached an internal code repository. This incident raises concerns about the security of employee accounts and the integrity of internal code, highlighting the importance of addressing software vulnerabilities in major tech companies.
SolarWinds has issued security updates to fix a serious vulnerability in its Access Rights Manager (ARM) software. This flaw, identified as CVE-2026-28326, allows attackers to execute code remotely without authentication, posing a significant risk to users. The vulnerability is rated 8.8 out of 10 on the CVSS scale and affects all versions of ARM up to 2026.2. Users of this software should prioritize applying the latest patches to protect their systems from potential exploitation. Given the nature of the flaw, it is crucial for organizations to act swiftly to secure their environments.
In May 2026, Google's Gemini AI model inadvertently accessed the systems of various companies during a cybersecurity evaluation conducted by the Israeli firm Irregular. This incident, which was first reported by The Wall Street Journal, involved a mix-up with test domains that allowed Gemini to breach security measures at real organizations. The consequences of this oversight could be significant, as it raises concerns about the security protocols surrounding AI technology and its testing processes. Companies involved in the evaluation now face potential data exposure and vulnerabilities due to these unintentional breaches. The situation emphasizes the need for stricter controls and oversight when deploying AI systems in real-world environments.
On May 22, CrowdSec reported that an attacker accessed and copied around 170 of its private GitHub repositories. The breach occurred through the account of a former employee whose GitHub access had not been revoked. This incident is linked to a supply chain attack on TanStack, where compromised npm packages were used to steal credentials. CrowdSec's failure to deactivate the employee's access after their departure allowed the attacker to exploit this oversight. This incident raises concerns about employee access management and the potential risks associated with supply chain vulnerabilities in software development.
In response to a troubling trend, U.S. lawmakers are pushing for increased mental health support for personnel at Cyber Command after five members died by suicide. The congressional initiative aims to address the mental health challenges faced by those working in cybersecurity, particularly in high-stress environments. This move comes as a recognition of the unique pressures that military and intelligence personnel encounter, especially in the context of cybersecurity operations. Lawmakers are advocating for more resources and programs to support the mental well-being of these individuals, emphasizing the importance of mental health in maintaining operational effectiveness. The situation raises awareness about the critical need for mental health services in high-stakes fields like cybersecurity.
Ahmed Elbadawy, a member of the cybercrime group known as Scattered Spider, has pleaded guilty to participating in a series of cybercrimes that allowed him to amass significant wealth. Prosecutors have indicated they are pursuing the forfeiture of approximately $17.6 million in virtual currencies, along with luxury vehicles, jewelry, and designer bags linked to his illegal activities. This case exemplifies the ongoing challenges law enforcement faces in tackling organized cybercrime. The financial proceeds from such crimes not only enrich the perpetrators but also fund further illicit activities, making it crucial for authorities to act decisively against such networks. The resolution of this case could have implications for how similar crimes are prosecuted in the future.
darkreading
The article discusses the limitations of Multi-Factor Authentication (MFA) in protecting against OAuth consent abuse. While MFA adds an extra layer of security, it doesn't address the need for proper governance of OAuth protocols, which can lead to unauthorized access when users mistakenly grant permissions. Companies must implement least-privilege scopes and actively monitor consent to ensure that users are not giving away more access than necessary. Additionally, quick revocation of permissions is crucial in mitigating potential breaches. This issue is particularly relevant as OAuth is widely used across various applications, making proper management essential to safeguard user data.
A security researcher has made public exploit code for four vulnerabilities in the Linux kernel that allow local users to gain root access, which is the highest level of control on a computer. These vulnerabilities have been patched in recent updates, meaning that systems with the latest kernel versions are not at risk. However, machines running older versions of the kernel could be vulnerable, putting them at potential risk of exploitation. Users and administrators are strongly advised to update their systems to the latest kernel version to prevent unauthorized access. The release of this exploit code increases the urgency for users to ensure their systems are secure, as it makes it easier for attackers to leverage these flaws if they remain unpatched.
Researchers have identified a significant software decoder flaw that was able to grant attackers remote code execution privileges. This vulnerability, which has since been patched, put user accounts and production environments at risk, affecting major platforms like Meta's product suite and an OpenAI software repository. The ability for attackers to exploit this flaw raises serious concerns about the security of widely used software components. Organizations that rely on these products should ensure they have implemented the necessary patches to protect their systems. This incident serves as a reminder of the ongoing challenges in software security and the need for vigilant monitoring and updates.
Gyazo, a popular image-sharing service, has suffered a significant data breach affecting 23 million user records. The breach was made possible when attackers exploited a vulnerability in the image upload server operated by Helpfeel, a Japanese software company that manages Gyazo's backend. Users are being notified about the breach, which raises serious concerns about the security of personal information, including potentially sensitive data. This incident not only puts Gyazo users at risk of identity theft and phishing attacks but also highlights the ongoing vulnerabilities in third-party services that companies rely on. As the investigation continues, it is crucial for users to monitor their accounts for any suspicious activity and take necessary precautions.
WordPress has patched several vulnerabilities in its core software, including a serious flaw that could let attackers install themes from the official WordPress.org directory without user consent. This vulnerability, dubbed Click2Shell by researchers at pwn.ai, specifically affects logged-in administrators who click on a specially crafted link. While the flaw requires user interaction to exploit, it poses significant risks as it could lead to unauthorized code execution on compromised sites. Website owners using WordPress should ensure they update their installations promptly to protect against potential exploitation. The discovery of this vulnerability emphasizes the ongoing need for vigilance in web application security.