The PCPJack threat actor compromised approximately 230 cloud servers and repurposed them into a hidden SMTP relay network. The attacker left their deployment toolkit publicly accessible in an unauthenticated open directory, facilitating discovery and analysis. Indicators include a systemd service named xsync disguised as a system sync utility, files under /var/tmp/. xs, and Chisel reverse SOCKS5 tunnels on ports 10000-14999. A public blog post provides detailed MITRE ATT&CK mappings and HuntSQL detection queries. No official patch or remediation guidance is currently available.
CVE-2026-23479 is a critical use-after-free vulnerability in Redis introduced in version 7.2.0 and publicly disclosed in 2026. It allows an authenticated user to execute arbitrary OS commands via a three-stage exploit chain involving Lua scripting and memory manipulation. The vulnerability survived multiple security reviews and affects many Redis deployments, especially those without password protection. Official patches were released on May 5, 2026, across multiple Redis branches. Mitigations include immediate patching, restricting Redis exposure to the public internet, enforcing TLS, tightening ACLs, and disabling Lua scripting if unused. This vulnerability is part of a broader set of Redis RCE flaws disclosed simultaneously.
A malvertising campaign is leveraging ChatGPT and OpenAI branding to deceive users into downloading malware. The campaign was reported via a Reddit post linking to an external analysis by Evalian. There are no specific affected software versions or technical exploit details provided. The campaign is categorized as phishing and malware distribution. No known exploits in the wild or patch information is available. The threat appears to be recent but has minimal discussion and no direct indicators shared.
This report discusses the longstanding and growing security challenges in Operational Technology (OT) environments, particularly in industrial settings where legacy equipment runs continuously and cannot be easily patched or taken offline. The convergence of IT and OT networks driven by Industry 4.0 has exposed OT systems to new cyber risks, while organizational priorities emphasize human safety and production availability over cybersecurity. The traditional air gap model is largely obsolete, and security solutions must be tailored to OT's unique operational constraints. Visibility into actual network communications and deliberate placement of controls, often at IT-OT boundaries, are critical strategies. The article highlights the difficulty in managing OT security due to organizational and technical factors rather than a single vulnerability or exploit.
This content discusses the general cybersecurity consideration that Android devices are often overlooked in enterprise security strategies despite their widespread use for accessing corporate resources. It highlights the role of Android Mobile Device Management (MDM) solutions, such as Scalefusion, which provide centralized control and security features for managing Android devices in corporate environments. The discussion focuses on balancing user convenience with device control and enforcing security policies on Android devices. No specific vulnerability or exploit is described.
A Reddit post on the r/Malware subreddit references a new malware threat described as a VMware antidetect ransomware, spyware, and trojan. The post links to an external site (antidetect.cloud) and includes a warning not to download the software. There is minimal technical detail or discussion available, and no confirmed exploits in the wild have been reported. No affected software versions or patch information is provided. The threat is assessed as medium severity based on the nature of the malware types mentioned.
This discussion concerns the challenges of achieving Cyber Essentials Plus certification in environments with 'legacy' network segments, common in manufacturing. These segments contain outdated or unpatchable systems isolated by internal firewalls and minimal allow-lists. The referenced guidance suggests using 'Scenario 2' de-scoping, where the entire organization remains in scope but internal segmentation is relied upon for control. Internet access from these legacy segments is tightly controlled via proxy with machine-specific whitelisting, limiting exposure. Local assessors consider the risk negligible due to these controls. There is no indication of an active vulnerability or exploit, but rather a compliance and risk management consideration.
The Miasma campaign is a supply chain attack targeting Red Hat npm packages under the @redhat-cloud-services namespace. Attackers used a compromised Red Hat employee's GitHub account to push malicious commits and abused GitHub Actions OIDC workflows to publish packages with valid SLSA provenance, bypassing supply chain verification. This attack highlights a weakness in the trust model of npm publishing workflows, where the build pipeline's trust boundary can be circumvented upstream. The campaign also includes new variants that collect cloud identities from GCP and Azure, escalating the threat beyond credential harvesting to active cloud access enumeration. Attribution remains uncertain, with possible links to the publicly released TeamPCP toolkit. No known exploits in the wild or official patches have been reported yet.
A user reports that passkey registration using WebAuthn works on localhost but breaks when moving to a custom local domain with a self-signed TLS certificate. The error 'NotAllowedError: WebAuthn is not supported on sites with TLS certificate errors' occurs, indicating that the self-signed certificate is untrusted. The user also notes confusion about the relying party ID (rp_id) and origin settings, as including the port in rp_id is likely incorrect but seems to allow registration. This issue appears related to development environment constraints rather than a direct security vulnerability.
A malware-as-a-service campaign named Weedhack targets Minecraft users by distributing malicious Java JAR files via SEO poisoning and YouTube videos. The malware steals credentials, system information, and can remotely control infected systems. It is notable for its ease of access, free tier, and appeal to younger users, with infections primarily in the U. S.and several other countries. Additionally, a large CountLoader campaign spreads cryptocurrency clipper malware via cracked software, and a separate campaign distributes cryptocurrency miners through pirated content sites. These campaigns leverage sophisticated persistence and evasion techniques and have been active since early 2026.
The ShinyHunters threat actor published data belonging to approximately 13 million Spectrum customers after Charter Communications declined to pay a ransom. The breach occurred via a social engineering attack targeting a Charter employee's Microsoft Entra account, allowing attackers to export customer records from Salesforce. Exposed data includes customer names, emails, physical addresses, phone numbers, plan information, and some internal employee directory data. Charter disputes the claim that sensitive Customer Proprietary Network Information (CPNI) was stolen, but independent verification is ongoing. Customers are advised to change passwords, enable two-factor authentication, and be cautious of unsolicited contacts claiming to be from Charter or Spectrum.
This entry describes a ransomware tabletop exercise designed for leadership and cybersecurity teams to engage with ethical dilemmas related to ransomware incidents. It is not a direct security threat or vulnerability but rather an educational tool to improve organizational resilience against ransomware. The exercise involves scenario-based decision-making that highlights the complex trade-offs in ransomware defense and response. No technical exploit or malware sample is provided, and there is no indication of active exploitation or vulnerability. The resource aims to raise awareness and foster cross-functional commitment to ransomware preparedness.
This is an announcement about the CompTIA SecOT+ beta certification exam for operational technology (OT) security professionals. The beta exam is designed to validate knowledge and skills specific to OT security, including safety, risk management, governance, IT vs. OT differences, compliance, and incident response. Qualified candidates who pass the beta exam can earn the certification for free, with a special incentive if passed by June 26, 2026. The beta exam window closes on August 7, 2026, with results expected in December 2026. This announcement does not describe a security vulnerability or threat.
The WaSteal campaign involves a large number of malicious Chrome extensions used for data exfiltration. Recent analysis revealed 57 additional extensions linked to the same operator and backend, bringing the total to 183 active extensions on the Chrome Web Store. These extensions share the same exfiltration behavior and remain live, posing ongoing risk to users who install them. The campaign is actively tracked and reported by threat intelligence sources, but no specific patch or remediation guidance is provided in the available data.
Four coordinated npm supply chain campaigns were active during May and June 2026, targeting the npm ecosystem with various sophisticated techniques including dependency confusion, namespace compromise, scope confusion, and typosquatting. These campaigns employ multi-stage postinstall execution chains that fetch and run platform-specific payloads, aiming to steal environment variables, CI/CD secrets, cloud metadata service tokens, and other sensitive credentials. The campaigns affect multiple platforms (Windows, macOS, Linux) and cloud environments (GCP, Azure). Detection relies on identifying version sentinels, cloud metadata endpoint access patterns, and characteristic postinstall behaviors. An open-source scanner with detection capabilities for these campaigns is available for community use.
UltraViolet is an open-source, self-hosted network discovery and search tool designed to run in Docker on user hardware. It performs TCP/UDP scanning and probes approximately 100 protocols to gather service and infrastructure information, including HTTP bodies, TLS fingerprints, and CVE matching using local NVD, KEV, and EPSS data. It is intended for authorized scanning of owned networks and does not perform exploitation or intrusive vulnerability scanning. The tool supports role-based access control, audit logging, and alerting on saved searches. It is not a cloud service and requires user deployment and management.
HTTP-Basma is a multi-stage HTTP fingerprinting tool that probes servers with crafted HTTP requests to generate detailed behavioral fingerprints. It analyzes server responses such as status lines, headers, allowed methods, and edge-case handling to create unique signatures that identify servers regardless of their Server header claims. This tool is intended for security research, reconnaissance, attack surface mapping, and infrastructure analysis. It is open-source and freely available for use. There is no indication that this tool itself is a vulnerability or exploit, but rather a method for granular server differentiation.
Oracle released its first monthly Critical Security Patch Update (CSPU) in May 2026, addressing 77 vulnerabilities across multiple products including Database Server, REST Data Services, Communications, E-Business Suite, and Hospitality Applications. About a dozen of these vulnerabilities are rated critical, with several exploitable remotely without authentication. Oracle's move to monthly patching aims to reduce the window of exposure caused by delayed patch application. The May CSPU is currently available, with subsequent monthly updates planned. Oracle emphasizes that many breaches stem from unpatched known vulnerabilities rather than zero-days. Organizations using Oracle products should prioritize patching especially for Database Server and REST Data Services due to their higher attack surface and remote exploitability.
This entry describes a hands-on cybersecurity educational course offered by Futures Academy, featuring a curriculum that covers cryptography, network security, software security, microarchitecture security, operating systems, hardware security, and human security. The course is taught by recognized experts in the field and aims to provide practical skills and theoretical knowledge in cybersecurity. There is no indication of a security vulnerability or threat associated with this course offering.
JSMonoGlyphRAT is a persistent backdoor malware actively targeting US enterprises, primarily delivered via phishing emails disguised as purchase orders, quotes, and business proposals. It has been confirmed to affect organizations in technology, telecom, education, and MSSP sectors. The malware is notable for evading most antivirus detection tools. Once installed, it enables attackers to deploy ransomware, steal data, and disrupt business operations. There is no information on available patches or official remediation. The threat is currently assessed as medium severity based on its impact and targeting profile.
