VulnHub

The FBI has arrested a Florida man suspected of distributing malware targeting users of the gaming platform Steam. This malware allegedly stole around $220,000 in cryptocurrency, with a significant portion taken from a terminally ill cancer patient who lost $32,000. The case underscores the dangers of online gaming and cryptocurrency, where malicious actors exploit vulnerabilities to enrich themselves at the expense of others. This incident raises awareness about the need for gamers to be vigilant and for platforms like Steam to enhance their security measures to protect users from such threats.

7-Zip has addressed a significant vulnerability that could allow attackers to execute harmful code by tricking users into opening specially crafted XZ-compressed files. The flaw was identified by researcher Landon Peng and affects versions prior to 26.02. If a user opens a malicious archive, it could lead to remote code execution, posing a risk to their system. Users of 7-Zip should update to version 26.02 immediately to protect themselves from potential exploitation. This incident is a reminder of the importance of keeping software up to date to safeguard against emerging threats.

F5 has patched a serious vulnerability in NGINX, identified as CVE-2026-42533, which has a CVSS score of 9.2, indicating it is highly critical. This flaw allows unauthenticated attackers to exploit a heap buffer overflow by sending specially crafted HTTP requests, potentially leading to server crashes or remote code execution. This vulnerability affects NGINX servers widely used for hosting websites and applications, making it a significant concern for organizations relying on this technology. F5's quick response to release patches is crucial to mitigate the risks associated with this vulnerability, as it could lead to severe disruptions or data breaches if left unaddressed.

Two police chiefs in the UK are calling for the introduction of Cybercrime Risk Orders following a recent prosecution involving Transport for London (TfL). They argue that the TfL case illustrates the growing risks associated with cybercrime and the need for stronger legal tools to combat it. The proposed orders would allow authorities to impose restrictions on individuals deemed to pose a cyber risk, potentially preventing future attacks. This initiative aims to enhance public safety and protect critical infrastructure from cyber threats, highlighting the urgent need for proactive measures in cybersecurity. The push for these orders comes as cyber incidents continue to rise, affecting various sectors across the UK.

A serious vulnerability (CVE-2026-6875) in the ServiceNow AI Platform is currently being exploited by attackers, according to threat intelligence firm Defused. This flaw allows unauthorized code execution, which can lead to significant security breaches for organizations using the platform. Companies that rely on ServiceNow for their IT service management need to be particularly vigilant, as the exploitation of this vulnerability could compromise sensitive data and disrupt services. The urgency of the situation is heightened by the fact that attackers are already taking advantage of this weakness, making it essential for affected organizations to act quickly to protect their systems.

A Russian-speaking hacker, operating under the name 'bandcampro', has taken control of a botnet consisting of eight computers from dental clinics. This individual utilized Google's open-source Gemini CLI AI to assist in various malicious activities, including cracking passwords and managing the botnet. The analysis of 200 session logs from Gemini CLI between March and April 2026 reveals how the hacker integrated AI into their operations. This incident raises concerns about the increasing use of AI tools by cybercriminals, which can enhance their capabilities and make detection more challenging. Dental clinics, which may have less robust cybersecurity measures, are particularly vulnerable to such targeted attacks.

Volexity has reported that unknown hackers exploited two zero-day vulnerabilities in SonicWall SMA 1000 series VPN appliances, gaining root access to these devices before any patches became available. This attack began on June 22, 2026, targeting organizations using the affected SonicWall devices. The incident was part of a broader campaign that allowed the attackers to infiltrate networks, raising significant security concerns for businesses relying on these VPN appliances for secure remote access. The discovery emphasizes the need for companies to stay vigilant and ensure their systems are updated to protect against such unforeseen exploits.

Thom Langford, CTO of Rapid7, discusses how an overload of security alerts can hinder a Security Operations Center's (SOC) response time. He emphasizes that modern attackers often use stolen credentials and familiar tools, such as PowerShell, rather than custom malware, making it harder for SOC teams to distinguish genuine threats from noise. In one alarming case, attackers were able to call a help desk, reset a privileged cloud account, and expose thousands of passwords in just three minutes. This rapid access underscores the urgency of improving response strategies, as ransomware groups can deploy their payloads in under three hours. Langford advocates for an outcome-based SOC approach to streamline alerts and enhance overall security effectiveness.