An Identity Fabric knits fragmented identity systems into a coherent layer that observes how identities behave across applications, APIs, and infrastructure. As enterprise access spans more cloud services and automated workloads, identity security depends less on static configuration and more on runtime visibility. This article covers the architecture, the risks of unmanaged identities, and
ServiceNow has released patches for four security flaws impacting the ServiceNow AI Platform, three of them rated 10.0 on the CVSS scoring system and exploitable, in certain circumstances, by an unauthenticated attacker. The company said it deployed a security update to hosted instances and provided the update to its partners and self-hosted customers, which leaves organizations that run their
VulnCheck has disclosed two previously undocumented factory implants in firmware for routers built by Shenzhen Zhibotong Electronics (ZBT), each of which gives an unauthenticated remote attacker the ability to run commands as root on affected devices. The implants, named SPEAKINGSTONE and DARKLANTERN by the company's zero-day research team, are tracked as CVE-2026-74232 and CVE-2026-74233.
cPanel has released patches for a security flaw affecting domain parking and addon domain functionality in cPanel and WebHost Manager (WHM), which could allow code execution as the root user. The vulnerability, assigned the CVE identifier CVE-2026-65643, impacts all supported versions of cPanel & WHM. cPanel described the issue as a critical security vulnerability and said that an
PaperCut has alerted customers that bad actors are actively exploiting a vulnerability impacting all versions of its PaperCut NG and PaperCut MF print management software in zero-day attacks. The company has released an emergency patch for v25 and v26 to address the issue. It said it's "aware of confirmed customer incidents and is treating this matter with the highest priority." An
Cybersecurity researchers have flagged a fresh set of campaigns targeting government and diplomatic organizations in Romania, Spain, and Türkiye between late September 2025 and early April 2026. These campaigns, per Recorded Future Insikt Group, have led to the deployment of a previously undocumented backdoor dubbed HOOKEDGE, a lightweight Windows batch script that's distributed via
New details about the July attack on Hugging Face reveal that hundreds of AI agents driven by OpenAI’s internal IM1 model coordinated the compromise through an unauthorized message board. Last month, Hugging Face disclosed that autonomous AI agents exploited two vulnerabilities in its dataset-processing pipeline to execute code, steal cloud and cluster credentials, and move laterally across its production infrastructure. OpenAI later confirmed that its models escaped an ExploitGym evaluation environment through a zero-day vulnerability in a locally hosted instance of JFrog's Artifactory package manager that was connected to the internet. The agents searched online for benchmark solutions and breached the Hugging Face platform using exposed credentials and additional vulnerabilities. OpenAI's investigation, validated by CrowdStrike and an independent assessment by METR and Redwood Research, found that rogue activity started in May.
Dark Caracal targets Venezuela with GoCaracal, an upgraded Bandook toolkit and an Ethereum fallback for resilient C2 communications. Dark Caracal is back with new malware and the same hunting grounds. Arctic Wolf Labs researchers link a June 2026 intrusion against a communications organisation in Venezuela to the Lebanon‑linked espionage group, and says it deployed a previously undocumented Go‑based framework called GoCaracal alongside an updated Bandook backdoor. Dark Caracal is an APT group associated with the Lebanese General Directorate of General. In past campaigns, it targeted entities in Singapore, Cyprus, Chile, Italy, the USA, Turkey, Switzerland, Indonesia, and Germany. “In June 2026, Arctic Wolf Labs investigated a targeted intrusion affecting a communications organization in Venezuela. We assess with medium confidence that this activity is linked to Dark Caracal, a cyberespionage group associated with Lebanon’s General Directorate of General Security (GDGS) that has historically targeted governments, businesses, journalists, and activists.” reads the report published by Arctic Wolf. “GoCaracal supports separate lightweight and extended build profiles derived from a shared architecture. Both were observed in the same intrusion.” The delivery method will feel familiar to anyone who has followed the group’s recent campaigns. Phishing emails with financial or tax lures drop weaponised SVG attachments, which redirect victims through URL shorteners to attacker‑controlled sites that serve the real payload. When a recipient opens one of these SVG files, the embedded content directs the browser to a shortened URL that resolves through a redirector to getpdfdigital[.]cloud, a known attacker site used to stage malicious payloads. The site then delivers a 7‑Zip archive containing a lightweight Go implant that Arctic Wolf identifies as part of the GoCaracal framework. “While Arctic Wolf did not recover the original phishing email or SVG attachment associated with the intrusion, the artifact’s financial and tax-themed filename, the campaign’s established delivery pattern, and more than 100 related SVG files found communicating with the same malicious hosting site support our assessment that the file was delivered through phishing.” continues the report. That initial implant is not the endgame. It establishes a foothold and then pulls in a Delphi loader carrying Bandook and a more capable, extended GoCaracal build with broader post‑compromise features. The two profiles split the work. The lightweight build handles host profiling, encrypted C2, remote shell, payload download and execution, and shellcode injection. The extended build adds file management, browser credential and cookie theft, keylogging, targeted file search, WebRTC remote desktop, hidden browser sessions, a SOCKS5 proxy and persistence mechanisms. Arctic Wolf traced 249 related samples from January to July 2026 and sees a clear development arc. GoCaracal started as a focused access implant, then became modular, then gained broad post‑compromise capabilities, and finally added an Ethereum‑based C2 fallback while keeping both profiles in play. “Analysis of 249 related samples revealed two GoCaracal build profiles: a lightweight implant designed to establish access and deliver additional payloads, and an extended build intended for sustained intelligence collection and interactive control.” states the report. “The extended build also supports an Ethereum smart-contract fallback that allows operators to retrieve replacement command-and-control (C2) infrastructure without redeploying the malware.” That fallback is the most interesting twist. The extended GoCaracal configuration can include an Ethereum smart‑contract address alongside the usual HOST and PORT values. If the malware cannot reach its primary C2 after repeated tries, it calls a public Ethereum JSON‑RPC endpoint, reads a stored value from the contract, and updates its in‑memory C2 address before retrying. “An extended GoCaracal variant uses Ethereum smart contracts as a fallback source for replacement C2 addresses.” states Artic Wolf “Blockchain activity indicates that the capability was tested and operationalized rather than merely included as dormant code.” Ethereum does not carry the malware’s entire command channel. Instead, GoCaracal uses it as a backup source for a new C2 address. This lets the attackers change the server the malware contacts without releasing a new version. Arctic Wolf found a custom Solidity contract called BulletproofC2 that stores a changeable C2 address. Only its owner can update it. Transaction records show that the attackers changed the address to a public IP, suggesting they tested and used the system. The same wallet also deployed similar contracts on Ethereum’s Sepolia testnet before moving some to the mainnet. The contracts contained both public and private IP addresses, suggesting the attackers first tested the mechanism before using it operationally. GoCaracal is not replacing Bandook, at least not yet. Arctic Wolf says the two families now run in parallel, with GoCaracal augmenting the group’s existing toolkit and potentially reducing future reliance on Bandook, but current evidence does not show a full swap‑out. The June 2026 Bandook sample shows deliberate anti‑analysis tweaks. Sequential command identifiers like @0001 through @0136 were replaced with randomised strings, and plugin export names were obfuscated with generic labels, preserving functionality while weakening signature‑based detection built on older naming conventions. The wider campaign still looks like Dark Caracal. Arctic Wolf identified seven related Spanish‑language, document‑themed domains used to deliver malicious SVGs and downstream payloads, with two previously linked to the group and a new one registered in July 2026 observed delivering GoCaracal. Infrastructure is compartmentalised. Of 24 unique C2 addresses extracted from GoCaracal samples, 23 sat on AEZA Group‑operated networks, while Bandook C2 addresses were hosted on AlexHost, a provider previously associated with Dark Caracal. That separation likely limits the blast radius if one provider gets hit. Geographically, the focus remains Latin America. Arctic Wolf sees related artifacts and infrastructure tied to Brazil, Ecuador, Chile, Colombia, El Salvador and Uruguay, and assesses broader regional activity with moderate confidence while continuing to map the scope. “Taken together, the findings show Dark Caracal is preserving familiar targeting and delivery practices while modernizing their malware and infrastructure.” concludes the report. “Dark Caracal’s continued use of established tooling such as Bandook, combined with the introduction of GoCaracal and its separate C2 footprint, suggests an expanding and increasingly compartmentalized toolkit rather than a wholesale change in operational strategy.” Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, malware)
PaperCut is warning that hackers are actively exploiting a vulnerability in all versions of its PaperCut NG and PaperCut MF print management software in zero-day attacks. The company says it is aware of confirmed attacks on customers and is urging organizations with Internet-exposed PaperCut Application Servers to immediately restrict access to the web interfaces to trusted IP addresses. "PaperCut Software security response team is investigating active exploitation of a vulnerability affecting PaperCut NG and PaperCut MF," reads an urgent security advisory published Thursday. "We are aware of confirmed customer incidents and are treating this matter with the highest priority." PaperCut says the vulnerability affects all versions of PaperCut NG and MF, but has not shared details about the flaw or how it is being exploited.
Australian police charged two men linked to TeamPCP over malware hidden in open-source code that stole 500,000+ credentials from 1,000+ organizations. Australian police have charged two men from Western Australia over a global cybercrime operation that allegedly hid malicious code in open-source software and used it to steal data from thousands of organisations. “Two West Australian men have been charged following a joint investigation between the AFP and Western Australia Police Force (WAPF), working in parallel with the Federal Bureau of Investigation (FBI), into a sophisticated cybercrime syndicate that allegedly created malicious open-source software to rob thousands of global businesses.” states AFP. “The AFP charged the men yesterday (26 August, 2026) with a combined total of 14 offences after executing search warrants in Perth with WAPF, and the assistance of the FBI.” The Australian Federal Police, the Western Australia Police Force and the FBI executed search warrants in Perth on 26 August 2026 and arrested a 21-year-old from Cottesloe and a 23-year-old from Mandurah. They face a combined total of 14 charges covering unauthorised data modification, possession and supply of data for computer offences, and dealing with proceeds of crime. Police say the pair were principal participants in a syndicate known as TeamPCP, which allegedly inserted malicious code into software hosted on public repositories and then let other developers pull it in without knowing. Infected components ended up in systems across government, academia and the private sector, giving the group a way to steal credentials and other sensitive material at scale. “Parallel investigations started in April, 2026, after the AFP and FBI received information from multiple cyber threat assessment companies regarding a syndicate that allegedly inserted malicious code into software available on an open-source repository, which was then unwittingly used by other developers.” continues AFP. “Police will allege infected software was then distributed into computer systems at other organisations across government, academia and the private sector. The software allegedly enabled the syndicate to infiltrate those organisations to steal or harvest sensitive data, including user credentials and authentication materials.” The numbers are not small. Investigators estimate the malicious code potentially compromised more than 1,000 organisations worldwide, enabling the theft of over 500,000 credentials and the exfiltration of at least 300 gigabytes of data. Remediation costs so far run into the hundreds of millions of dollars. TeamPCP is behind multiple supply chain attacks, in the past, they targeted PyPI packages and NPM repositories, and most recently the “Mini Shai-Hulud” campaign also caught two OpenAI employees. The pattern is consistent: go after the tools developers trust, poison the supply chain, and let the downstream damage multiply. The confirmed list of modified tools includes Trivy, a widely used container vulnerability scanner; KICS, a static analysis tool for infrastructure-as-code; LiteLLM, a popular library for routing requests across AI model APIs; and the Telnyx Python SDK. These aren’t niche utilities. They’re commonly integrated into enterprise CI/CD pipelines, cloud infrastructure workflows, and security scanning processes. Hitting them means hitting a large number of organizations simultaneously through a single poisoned update. The group also deployed four distinct malware families. CanisterWorm harvested cloud access tokens, credentials, and API keys for AWS, GCP, and Azure. SANDCLOCK extracted AWS credentials, Kubernetes ServiceAccount tokens, local environment variables, and cryptocurrency wallet data. Mini Shai-Hulud was a self-replicating worm designed to spread across both npm and PyPI registries. Miasma was a variant of Mini Shai-Hulud that propagated across those same open-source registries while harvesting credentials and poisoning configuration files. The worm component is the part that deserves particular attention. Mini Shai-Hulud and its Miasma variant didn’t just infect the initial target and stop. They spread across open-source package registries autonomously, harvesting credentials and poisoning configuration files as they went. The FBI confirmed two GitHub repository names used for exfiltration: tpcp-docs and docs-tpcp. If either of those repository names appears in your GitHub organization, the worm created it using stolen credentials. TeamPCP’s method was straightforward and effective: inject malicious code into legitimate software packages, push the trojanized versions through normal distribution channels, and wait for CI/CD pipelines to pull them in automatically. The modified tools installed credential-stealing malware and persistent backdoors without any visible sign that anything had changed. “These men are allegedly members of the cybercriminal group TeamPCP, whose malicious code potentially compromised more than a thousand organizations worldwide,” Assistant Director Leatherman said. “We are proud to work with the Australian Federal Police and the Western Australia Police Force to impose cost on criminal actors and combat the growing threat of software supply-chain attacks.” The charges show how serious the alleged operation was. The 21-year-old faces several charges, including changing data without authorization, possessing and supplying data for computer crimes, failing to comply with a production order, and handling at least A$100,000 in criminal proceeds. The 23-year-old faces similar hacking charges, with maximum penalties ranging from three to 20 years. Police seized electronic devices and other items from properties in Cottesloe, Hamilton Hill and Mandurah. Investigators are now examining a large amount of data and have not ruled out further arrests or charges. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, newsletter)
Confirm this action.
Leaving now will discard your changes.