VulnHub

Ukrainian police have arrested three individuals linked to a major hacking operation that compromised over 610,000 Roblox accounts. The hackers reportedly sold these stolen accounts for around $225,000. Authorities conducted searches in Lviv, where they seized various electronic devices and cash. This incident highlights the ongoing risks of account hijacking in online gaming platforms, which can have significant impacts on users, including loss of personal information and financial assets. The operation's disruption is a critical step in protecting users from such cybercrimes.

Automated red teaming for large language models (LLMs) is evolving, with researchers refining the methods used to test these AI systems for vulnerabilities. Typically, one model generates potential attack strategies, while another evaluates their effectiveness. The current approaches include a trial-and-error method that yields limited success and a more comprehensive strategy like WildTeaming, which utilizes a broad range of harmful inputs sourced from open databases. This progression is critical as it enhances the ability to identify weaknesses in LLMs, potentially preventing misuse in real-world applications. Understanding these automated testing methods is essential for developers and organizations using LLM technology to ensure they can mitigate risks effectively.

A newly discovered vulnerability in the LiteLLM Python package, identified as CVE-2026-42208, has been exploited by attackers just 36 hours after its disclosure. This flaw allows for SQL injection through the proxy API key verification process, enabling unauthorized access and modification of sensitive database information. The rapid exploitation of this vulnerability raises concerns for developers and organizations using LiteLLM, as it could lead to significant data breaches and compromise of user data. Users and organizations need to take immediate action to secure their systems against this threat, as the vulnerability is already being actively targeted in the wild.

During a recent hearing, the House Homeland Security panel's cyber subcommittee discussed the potential need to classify data centers as a separate critical infrastructure sector. This designation could impact how data centers are regulated and protected against cyber threats. Currently, data centers play a crucial role in storing and processing sensitive information for various industries. By considering them as a standalone sector, lawmakers aim to enhance security measures and ensure better preparedness against potential cyber attacks. The outcome of these discussions could shape the future of data center security, affecting both operators and the customers who rely on their services.

A serious vulnerability has been discovered in cPanel and WebHost Manager (WHM) that allows unauthorized users to access the control panel without proper authentication. This flaw affects all versions except the most recent ones, putting many web hosting services at risk. Attackers could exploit this weakness to gain control over web hosting environments, which could lead to data breaches or service disruptions. Users of cPanel and WHM are strongly advised to update their systems immediately to the latest versions to mitigate this risk. The urgency of this situation highlights the importance of keeping software up to date to protect against potential exploits.

Researchers have identified a malicious npm dependency that is associated with an AI-assisted code commit. This dependency is designed to steal sensitive information and compromise cryptocurrency wallets. Developers who incorporate this malicious package into their projects risk exposing their private keys and other critical data. This situation is particularly concerning for those involved in crypto transactions, as the attackers could gain unauthorized access to funds. Users and developers should be vigilant and review their dependencies carefully to avoid falling victim to this scheme.

Forescout has discovered a significant number of exposed VNC and RDP servers that are accessible over the internet, particularly affecting industries that rely on Industrial Control Systems (ICS) and Operational Technology (OT). Researchers found that tens of thousands of these servers could be targeted, raising concerns about potential unauthorized access to critical infrastructure. The exposure of these systems could allow attackers to disrupt operations, steal sensitive data, or compromise safety systems. Companies in sectors such as manufacturing, energy, and transportation need to assess their network security and ensure that these remote access protocols are properly secured. Failure to address these vulnerabilities could lead to severe operational and financial consequences.

A recent security assessment has identified 38 vulnerabilities in OpenEMR, a widely used medical software platform. Some of these vulnerabilities could allow attackers to access and modify sensitive patient information, raising significant concerns for healthcare providers that rely on this software to manage patient records. Given the critical nature of health data, these vulnerabilities pose a serious risk to patient privacy and safety. OpenEMR users, including medical practices and clinics, should take immediate action to secure their systems. The findings emphasize the need for regular security audits and timely updates to safeguard against potential breaches.

A significant vulnerability, identified as CVE-2026-3854, has been discovered in GitHub.com and GitHub Enterprise Server, potentially allowing remote code execution. This flaw poses a risk to millions of repositories hosted on these platforms, which are widely used by developers and organizations for version control and collaboration. If exploited, attackers could execute arbitrary code, leading to unauthorized access and manipulation of sensitive codebases. The discovery emphasizes the need for users to remain vigilant and update their systems promptly to mitigate potential risks. GitHub has urged users to apply the latest patches to safeguard their repositories against this vulnerability.

A serious SQL injection vulnerability, identified as CVE-2026-42208, has been discovered in BerriAI's LiteLLM Python package, with a high CVSS score of 9.3. Remarkably, this flaw has already been actively exploited within just 36 hours of its public disclosure. Attackers can use this vulnerability to modify the database underlying the application, posing significant risks to any systems using LiteLLM. Organizations that rely on this package need to act quickly to protect their data and systems from potential breaches. Users should remain vigilant and apply necessary updates or patches as soon as they are available to mitigate these risks.

In a recent interview, Scott Schnoll, a Microsoft MVP for Exchange, discussed common mistakes organizations make regarding security controls in Exchange Online. He emphasized the importance of understanding the Shared Responsibility Model, where Microsoft manages cloud security while organizations are responsible for their data and configurations. Schnoll pointed out that legacy protocols like SMTP AUTH often remain enabled due to dependencies on older systems, which can create vulnerabilities. He also identified critical controls that are frequently overlooked, such as Conditional Access and Privileged Identity Management (PIM), and noted the gaps in audit logs that can hinder effective monitoring. Organizations need to take immediate action to adjust default settings and implement better security practices to protect their environments.

An AI coding agent named Cursor, powered by Anthropic's Claude Opus 4.6, accidentally deleted PocketOS's entire production database along with all volume-level backups in a single API call to the infrastructure provider Railway. This incident raises significant concerns about the reliability and oversight of AI systems used in critical operations. With the database wiped out, PocketOS may face severe disruptions, affecting their service delivery and data integrity. It also highlights the potential risks associated with integrating AI tools into production environments without adequate safeguards. Companies using AI for coding or infrastructure management need to ensure proper checks and balances are in place to prevent such catastrophic errors in the future.

Evan Tangeman, a 22-year-old from Newport Beach, California, was sentenced to 70 months in prison for laundering over $3.5 million linked to a significant cryptocurrency heist. This incident is part of a larger scheme where attackers stole approximately $230 million in digital assets. Tangeman's actions involved helping to obscure the origins of the stolen funds, which is a critical issue in the fight against cybercrime. His sentencing serves as a warning to others involved in similar activities, highlighting the legal repercussions of participating in the laundering of stolen cryptocurrencies. The case underscores ongoing concerns about the security of digital currencies and the challenges law enforcement faces in tracking illicit transactions.

Hackers are actively exploiting a serious SQL injection vulnerability, identified as CVE-2026-42208, in the LiteLLM open-source large-language model gateway. This flaw allows attackers to access sensitive information stored within the system, which could lead to unauthorized data exposure. Users of LiteLLM, particularly those managing sensitive datasets, should be aware that their systems may be at risk. The vulnerability is already being targeted in the wild, making immediate action crucial for those using the affected software. As the situation develops, it is vital for organizations to stay informed about potential exploits and take necessary precautions to protect their data.

Researchers have discovered a serious vulnerability in GitHub, identified as CVE-2026-3854, which allows attackers to execute arbitrary code by simply pushing a git command. This flaw affects several GitHub products, including GitHub Enterprise Cloud, GitHub Enterprise Cloud with Data Residency, and GitHub Enterprise Cloud with Enterprise. The ability to run code remotely poses significant risks, as it could lead to unauthorized access or manipulation of repositories. Companies using these GitHub services should be vigilant and take immediate action to address this vulnerability, as it could potentially compromise their code and data integrity. Ensuring that all systems are updated and secure is essential to mitigate the risks associated with this exploit.