The Los Angeles County Museum of Art (LACMA) has announced that a breach last year exposed customer and employee information. The museum says that on July 11, 2025, it detected suspicious activity on its systems that had started four days earlier. A month later, the investigation confirmed that the network was compromised. At the time, the type of exposed data could not be determined, and the first results of the investigation became available in late February 2026. More than a year after the discovery of the data breach incident, the museum identified that the following information may have been accessed by the attacker: LACMA says it has notified law enforcement authorities about the incident and sent personalized data breach notifications to impacted individuals. Recipients are recommended to monitor their bank accounts for suspicious activity, consider placing a security freeze or fraud alert on their credit file, and report identity theft attempts to their financial institutions and law enforcement.
Threat actors are abusing npm and its mirrors to host malicious HTML pages that impersonate Cloudflare CAPTCHAs to redirect visitors to attacker-controlled websites. The technique was previously spotted in July by security researcher inf0stache, who found a 'china_airlines' npm package that used a fake Cloudflare verification page to redirect visitors to a malicious domain, and was also reported by IntelFusions. In a later report, OX Security discovered 24 npm packages containing the same malicious HTML page hosted on npm and various mirrors. However, unlike the typical npm supply-chain attacks we've seen lately, installing the packages does not infect a developer's computer with malware or infostealers. Instead, attackers use the npm registry as free storage for malicious HTML pages, which are then copied by mirroring platforms like UNPKG and npmmirror.
A newly uncovered phishing-as-a-service (PhaaS) platform called AnonyMousKIT automates the retrieval of codes used to unlock stolen Apple devices and disable the Activation Lock feature. The illegal service has been active since early 2024 and is powering a structured ecosystem that sells stolen iPhones, harvests Apple IDs, accesses iCloud backups, and Keychain credentials. Researchers at threat intelligence platform SOCRadar took advantage of the platform operator's use of bare relative paths to gather information on how the service works, its operators, and infrastructure. SOCRadar found that AnonyMousKIT is connected to 506 domains and is fueling a sprawling business with 168 storefront brands acting as resellers. The researchers recovered records of 200 calls made to victims between August 2025 and May 2026, using 55 distinct interaction transcripts handled by a voice AI agent operating under five personas.
Norway ’s shared government infrastructure suffered a third DDoS attack, disrupting digital services but showing no signs of data compromise. Norway ‘s shared digital government infrastructure has been hit by another distributed denial-of-service (DDoS) attack that disrupted services used by citizens, businesses and public agencies. The incident began at 03:38 CEST on Monday, August 24, and targeted infrastructure operated by the Norwegian Digitalisation Agency, Digdir, together with its service provider Vivicta. The timing matters because this isn’t an isolated event. Digdir says it’s the third DDoS attack against its services in a short period, following incidents in June and on August 3. “The Norwegian Directorate for Digitalisation (Digdir) has been subjected to a denial of service attack (DDoS attack) that has been ongoing since 03:38 on the night of Monday, August 24.” reads the statement published by Digdir Agency. “This is the third time in a short time that this type of attack has been directed at Digdir’s solutions. Digdir is working closely with our subcontractor Vivicta. NSM and the Norwegian Data Protection Authority have also been notified of the case.” That status update refers to the test environment, but the underlying attack also affected production services. Digdir reported that several shared services became completely unavailable for short periods, while others remained accessible but suffered connection failures, slow responses and longer-than-usual login times. Digdir operates several pieces of Norway’s shared public-sector infrastructure. Among them are ID-porten, MinID, Maskinporten, eFormidling, eInnsyn, the Contact and Reservation Register, Ansattporten and other services used by government agencies and external applications. That makes an attack on Digdir more significant than an ordinary website outage. When a shared authentication service goes down, the disruption can propagate to services that aren’t themselves under attack. That’s exactly what happened. Altinn, Norway’s central platform for communication between citizens, businesses and government, was also affected, while other public services relying on ID-porten experienced login problems. Earlier attacks this summer produced similar effects, including disruption to access to Helsenorge, NAV and Skatteetaten. The technical distinction is important: the attackers didn’t need to break into every downstream service. They could create disruption simply by overwhelming a shared dependency. And that’s often the uncomfortable reality of modern public infrastructure. The weakest point isn’t necessarily the service citizens see on their screens. It can be the common authentication, messaging or data-exchange layer underneath it. Digdir has stressed that the incident is about availability, not evidence of a successful intrusion. The agency also says it has found no indication that personal data was exposed. Digdir has notified Norway’s National Security Authority, NSM, and the Data Protection Authority, Datatilsynet, as part of its response. “There are no indications that the attack has led to a security breach or that personal data has been compromised, says Director Frode Danielsen at Digdir.” continues the statement. That distinction deserves attention because cyberattack doesn’t automatically mean “data theft”. In this case, the confirmed impact is service disruption, while there is currently no evidence that attackers compromised Digdir’s systems or accessed personal information. The operational consequences are still serious. Public-sector users may see failed connections, slow responses or authentication problems even though the underlying applications themselves haven’t been compromised. The June incident already demonstrated how much disruption a DDoS attack against Digdir’s infrastructure can cause. That attack targeted ID-porten through Vivicta’s network infrastructure and temporarily affected services including ID-porten, MinID, Maskinporten, eInnsyn and eFormidling. Another attack followed on August 3. Digdir restored normal operations the following day, but the agency said the incident had again affected several shared services and that it would review the event together with Vivicta and other partners. Now there’s a third incident. That repetition is more interesting from a defensive perspective than the raw duration of any single outage. Digdir and Vivicta are clearly able to mitigate the attacks and restore services. The harder question is whether repeated attacks against the same shared infrastructure can keep generating enough operational friction to become a recurring problem for the wider public sector. This is where DDoS stops being just a bandwidth problem. A sufficiently persistent campaign can force defenders to keep changing traffic controls, filtering rules and protection measures, while legitimate users continue to depend on the same infrastructure. Digdir’s own status updates show that dynamic clearly. On August 24, the agency first reported improvement, then said several solutions were completely down, followed by further stabilization efforts. There is currently no official attribution for the attacks. Norwegian media have raised the possibility of Russian involvement, but that remains speculation rather than an established finding. That distinction matters. A DDoS campaign can be politically motivated, financially motivated, conducted for disruption or simply intended to demonstrate capability. Without technical evidence and an official attribution process, assigning responsibility to a particular state or group would be premature. What is established is the target and the effect. The attacks repeatedly hit infrastructure that sits underneath a large number of Norwegian digital public services. That’s enough to make the incidents strategically relevant without adding an attribution story that the evidence doesn’t yet support. The Norwegian case is also a useful reminder that cybersecurity isn’t limited to confidentiality and integrity. Availability is a security property too, particularly when the affected systems provide national digital services. A compromised database is an obvious security incident. An authentication service that repeatedly becomes unavailable can create a different kind of problem: citizens can’t access services, businesses can’t complete procedures and government agencies may struggle to perform routine operations. Digdir says its services have largely stabilized, although some disruptions remain. As of the latest incident updates, ID-porten still had limitations, eSignering remained unavailable because of those ID-porten restrictions, and some users were still reporting connection problems or increased response times with Maskinporten. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, newsletter)
Uber faces an €825M GDPR fine for automatically suspending drivers without human review, highlighting the risks of AI decisions affecting workers. The Dutch Data Protection Authority handed Uber its largest privacy fine yet, and this one isn’t about data transfers or cookie consent. The regulator imposed an 825 million euro penalty, roughly $964 million, over Uber’s use of fully automated software to suspend driver accounts, sometimes permanently, with no human ever reviewing whether the system got it right. The violation is clear under EU law. The GDPR limits fully automated decisions when they can significantly affect a person’s life. An algorithm that can take away someone’s ability to earn a living, without any human review, falls directly into this category. The regulator also found that Uber failed to properly tell drivers when automated systems made these decisions, which the GDPR requires companies to disclose. “The Autoriteit Persoonsgegevens (AP), the Dutch data protection authority, imposes a fine of 824,990,000 euros on Uber. The reason for this is that the AP has ruled that Uber made fully automated decisions about drivers. In case of suspicions of fraud or customer reviews that were too low, drivers’ accounts were automatically temporarily deactivated or, in case of persistent low customer reviews, permanently deactivated. As a result, their income was lost via Uber during the deactivation.” reads the statement published by the Dutch data protection authority. “According to the AP, Uber has violated the prohibition of fully automated decision-making under the General Data Protection Regulation (GDPR). The AP also found that Uber did not sufficiently inform drivers about automatic decision-making. Uber has now stopped the violations.” The fine covers Uber’s practices from 2018 to 2022, so it concerns systems the company has already discontinued. Uber highlighted this point in its response, arguing that the regulator examined old policies rather than practices still in use today. “Uber used software to track drivers’ (driving) behaviour and to track customer reviews. If that software detected a suspicion of fraud or customer reviews were too low, the accounts of the drivers concerned were automatically deactivated.” continues the Dutch authority. “There was no human assessment here. This occurred between 2018 and 2022.” Uber also said it takes decisions that affect drivers’ income seriously. The company pointed to human reviews, safeguards and an appeals process for drivers who believe the system made a mistake. The appeal will have to determine whether these protections existed during the period covered by the fine or came later. And Uber is appealing. The company has stated it disagrees with both the decision and the size of the fine, setting up another round in what’s become a recurring pattern between Uber and Dutch regulators specifically. This is the fourth time the Dutch authority has fined Uber, which on its own says something about the relationship here. The previous record holder was a 290 million euro fine in 2024 over transferring European drivers’ personal data to the US without adequate protections, a case Uber also appealed at the time. Four fines from a single regulator isn’t really a pattern of bad luck anymore; it’s a pattern of a company and a privacy regulator that keep disagreeing about the same basic question, how much human judgment has to sit between an algorithm’s decision and a person’s actual income. The case goes beyond Uber. Many gig-economy platforms in Europe use algorithms to manage workers, routes and account status. This ruling shows the cost of relying on automated decisions without human oversight. For companies that use algorithms to make decisions affecting people’s accounts or income, saying “the algorithm decided” is no longer enough. The €825 million fine makes that lesson very clear. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, newsletter)
Two CVSS 9.8 miniOrange SAML WordPress plugin auth bypasses were exploited while paid editions never appeared in any vulnerability database. Manual patch required. Two critical authentication bypass vulnerabilities in the miniOrange SAML 2.0 Single Sign On WordPress plugin, both rated CVSS 9.8, are under active exploitation. Both CVE-2026-61979 and CVE-2026-15981 allow an unauthenticated attacker to forge a SAML authentication response and arrive in /wp-admin as any existing user, including administrators. The bugs are independent and both have been confirmed exploited in the wild. CVE-2026-61979 is an algorithm confusion flaw. The plugin trusts the incoming SAML response to declare its own signature algorithm. An attacker sets that algorithm to HMAC-SHA1, which causes the plugin to use the identity provider’s RSA public key as the HMAC secret. The RSA public key is, by definition, public. That’s the whole attack: fetch the key from the metadata endpoint, sign your own forged assertion with it, and the plugin verifies it as genuine. CVE-2026-15981 is a PHP bug caused by incorrectly handling different types of values. The openssl_verify() function can return three results: 1 when a signature is valid, 0 when it is invalid, and -1 when OpenSSL encounters an error. The plugin treated the result like a simple true-or-false value. In PHP, -1 counts as true. An attacker can send a specially crafted signature that causes an OpenSSL error, making the function return -1. The plugin then treats it as a valid signature and allows the attacker to log in. It is a basic coding mistake, but particularly serious because the plugin handles authentication for WordPress admin accounts. The technical root cause is interesting. What happened around the bugs afterward is more interesting. The miniOrange SAML plugin ships under one WordPress slug, miniorange-saml-20-single-sign-on, but that one listing actually contains seven completely separate product editions, each with its own independent version numbering. Free runs from 3.x to 5.x. Premium runs 11.x to 13.x. Standard runs 15.x to 17.x. VIP editions start at 32.x and 35.x. No two editions share a version range. When the public advisories were written, they covered only the Free edition, which is the one anyone can download from WordPress.org. The fix for the Free edition landed at 5.4.5. “While that record is correct, when you apply it to the slug, every paid install carries a higher version number than 5.4.5, so every paid install reads as already patched.” reads Patchstack analysis. “Therefore, any WordPress site that was running a vulnerable version like 16.1.9 reported it as patched, along with every other (13.x, 20.x, 26.x, 32.x, and 35.x) vulnerable version.” Every database, scanner, and dashboard in the WordPress security ecosystem was telling paid-edition administrators their sites were safe when the exploitable code was still running on their servers. The update prompt problem makes it worse. Sites running a vulnerable Standard edition 16.x see no available updates in their WordPress admin panel because the fix is on the 17.x line, and WordPress’s built-in update mechanism doesn’t offer cross-line jumps automatically. The path from vulnerable to patched requires a manual plugin upload, which site owners can’t do if they don’t know they’re affected, and every system they rely on was telling them they weren’t. “There was no advisory to read and no vulnerability database entry flagged the paid edition for these vulnerabilities. The plugin reported itself as fully up to date. In other words, every signal that normally warns of a problem suggested that everything was fine.” continues the report. “So, how did DigitalOcean catch the exploit? It had nothing to do with plugins or versions. An anomalous WordPress administrator session attempt appeared from outside their trusted network and was blocked. The attacker had already used the bypass to obtain a WordPress admin session cookie, but was stalled because the admin panel operations themselves sat restricted behind the trusted network. “ DigitalOcean, the team that found all of this, caught the exploit not through any of those systems but through a network anomaly: an authenticated WordPress administrator session arriving from outside their trusted network perimeter. The attacker had already used one of the auth bypasses to generate a valid admin session cookie. The cookie worked. The session was blocked because the admin panel itself was restricted to trusted network ranges. Defense in depth, doing exactly what it exists to do, on a system where every other detection layer had already failed. DigitalOcean then traced both bugs to specific lines of code in the plugin and its bundled XML security library, confirmed the affected version ranges across all seven paid editions (which miniOrange had not published anywhere), wrote two narrowly scoped hotfixes to buy time, and handed the full analysis to Patchstack for publication. Patchstack worked with miniOrange to get the complete edition and version matrix, then updated its database with all seven affected ranges, the first time any public database held that information. Attackers are actively scanning miniOrange SSO endpoints from six IP addresses in Belgium, Nigeria, the U.S. and Germany. The activity appears opportunistic, with attackers checking websites that use the plugin without first identifying the specific version or edition. That makes the silent patch especially concerning. Attackers can probe systems without knowing what version they run, while website owners may not realize whether their plugin has received the fix. “Vulnerability databases are only as good as the version data vendors publish publicly. When a vendor runs seven independently numbered editions under one slug and patches six of them without a public advisory, the entire ecosystem downstream of them goes blind at once: databases, scanners, dashboards, and the site admins relying on all three.” concludes the report. For anyone running this plugin, the full version table per edition is in the Patchstack article. The short version: find your edition, compare your version against the patched column, and expect to do the upgrade as a manual upload rather than through the WordPress dashboard. If you can’t update immediately, two narrowly scoped hotfixes covering both CVEs are published there alongside the IPs to check in your logs for prior exploitation attempts. Check the passkey and admin account list while you’re in there. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, miniOrange SAML WordPress Plugin)
A large distributed denial-of-service (DDoS) attack has disrupted Norway’s shared government digital infrastructure since Monday, affecting services used by the public sector. The attack started at 03.38 CEST on Monday and has targeted the infrastructure supporting services operated by the Norwegian Digitalization Agency, Digitaliseringsdirektoratet (Digdir), and its operations provider, Vivicta. Digdir operates Norway’s shared digital government infrastructure, including public-service logins, electronic IDs and signatures, secure digital mail, government forms, public-record access, and data exchange between agencies. In an announcement published earlier today, the organization states that several services were completely unavailable for short periods. The agency says many affected systems have now been stabilized, although some services, like ID-porten and eSignering, remain partially inaccessible.
Healthcare and services provider Nutex is investigating a data breach incident where an unauthorized third party exfiltrated information from company servers. The organization has disclosed the cyberattack in a filing with the U.S. Securities and Exchange Commission (SEC), noting that the stolen data includes details that may be private or confidential. “Based on preliminary findings from the Company’s ongoing investigation, the Company believes that certain information maintained on the Company’s servers was accessed and exfiltrated by an unauthorized third party, including some information that may be private and/or confidential,” Nutex says. Nutex Health is a for-profit healthcare company that operates 28 facilities across 12 states, including the Bayou City ER & Hospital in Texas and Green Bay ER & Hospital in Wisconsin.
Attackers are increasingly targeting the processes used to establish or recover identity rather than attacking the login itself. Specops explains how stronger identity verification can help organizations prevent fake workers and social engineering attacks from gaining legitimate access.
Threat actors have already compromised over 270 Zimbra instances in remote code execution attacks targeting a high-severity Zimbra Collaboration Suite (ZCS) vulnerability. The ZCS email and collaboration suite is used by hundreds of millions of people and organizations, including thousands of businesses and hundreds of government agencies worldwide. Synacor patched the security flaw (tracked as CVE-2026-73570), which allows unauthenticated attackers to gain code execution remotely by exploiting a command injection weakness in the SNMP monitoring component when SNMP notifications are enabled, with the release of ZCS version 10.1.20 on July 20. CERT Polska, the Polish Computer Emergency Response Team (CERT), first flagged the vulnerability as targeted in the wild last Monday, when it also warned security teams to check their logs for suspicious activity, including the Zimbra service restarting unexpectedly, and for files created in the /opt/zimbra/jetty/webapps/, /opt/zimbra/jetty_base/webapps/, and /tmp/ folders by user zimbra over the last 30 days.
Confirm this action.
Leaving now will discard your changes.