Berlin's state government has confirmed that it is the target of an extortion attempt following the August compromise of the city's state administrative network, and said it will not meet the extortionists' demands. The same statement disclosed that forensic work had found further data outflows in the portfolio of the Senate Department for Mobility, Transport, Climate Protection and Environment
Malicious actors are exploiting a newly patched security flaw in PaperCut NG and MF to execute arbitrary code on susceptible instances, as the company released a fresh emergency fix with additional hardening. "This vulnerability gives an unauthenticated attacker remote control over PaperCut's trusted configuration, which could be used to execute arbitrary Java code inside the application's
Google on Thursday announced new network security protections in Android 17 to bolster connection privacy, address cellular vulnerabilities, and safeguard the privacy of users' home networks. Topping the list is support for Encrypted Client Hello (ECH), a privacy standard that prevents networks from eavesdropping on which websites a user is visiting. "This new privacy standard works in tandem
Security researcher Olivier Laflamme has disclosed two independent root remote code execution (RCE) chains affecting the Unitree G1 EDU, including a Bluetooth Low Energy (BLE) path that can reach root on the robot's Locomotion PC. The flaws are tracked as CVE-2026-76639 and CVE-2026-76640, with the first involving a network-adjacent path through chat_go and bashrunner and the
Google is introducing new network security protections in Android 17 to strengthen connection privacy, address cellular vulnerabilities, and protect the privacy of users’ home networks. Android 17 adds support for Encrypted Client Hello (ECH), a new privacy standard that operates in conjunction with private DNS to hide profiling metadata, including visited domain names. ECH acts as a privacy extension for TLS, the protocol that secures HTTPS connections, encrypting the opening part of the TLS handshake that reveals the contacted hostname via the Server Name Indication (SNI). Even if the connection to a website or service is secure, internet service providers (ISPs) and Wi-Fi operators can still see the destination, which can be collected for commercial profiling purposes. Android users benefit from ECH when browsing with Chrome 117 and later or Firefox 119 and later, but Android 17 incorporates the protection at the platform level.
Australian authorities have arrested and charged two young men accused of being part of the TeamPCP hacking group linked to a string of far-reaching developer supply chain attacks. TeamPCP is a hacking group known for widespread supply-chain attacks over the past year that targeted open-source software and developer platforms to steal credentials, authentication secrets, and source code. High-profile attacks attributed to TeamPCP have impacted Trivy, LiteLLM, Telnyx, SAP, and TanStack packages, while the group has also breached the European Commission, Mistral AI, OpenAI, and GitHub. To carry out their attacks, the threat actors injected malicious code into software hosted on open-source repositories, which developers then unknowingly incorporated into their own applications on systems used by government, academic, and private-sector organizations.
The ShinyHunters extortion group has published sensitive data from nearly 13 million accounts stolen from clothing retailer giant Carhartt earlier this month, according to data breach notification service Have I Been Pwned. Founded in 1889, Carhartt is an American apparel company with workwear and streetwear manufacturing facilities in Kentucky and Tennessee and more than 3,000 employees in the United States and Europe. While Carhartt has yet to confirm the extortion group's claims or issue a statement about the breach, ShinyHunters claimed the attack on August 13 and said they allegedly stole more than 50GB of documents containing a wide range of customer, employee, and corporate data. "Millions of records of customer data and vast amount of sensitive information and PII containing employee, customer, customer metadata (royalty info), and other internal corporate data was compromised," the cybercrime gang said.
CISA urges water utilities to find and secure internet-exposed PLCs after July attacks showed how easily exposed industrial systems can be compromised. Over 100 internet-exposed systems in the US water and wastewater sector got hit by cyberattacks in July 2026, and CISA’s response wasn’t just an incident report, it was a how-to guide for making sure it doesn’t happen to you next. The agency’s exposure reduction guidance, published August 21, walks through exactly how organizations can find their own internet-facing weak points before an attacker does. The pattern behind the July attacks was surprisingly simple. Most of the affected systems were programmable logic controllers (PLCs), small industrial computers that control pumps and valves. Many connected directly to cellular modems and had no firewall or gateway between them and the internet. CISA warns that this type of setup can expose PLCs to serious security risks. “Directly connecting PLCs to the internet through cellular modems can create significant security risks. However, internet exposure reduction does not mean disabling necessary remote access; organizations should remove remote access when it is unnecessary and secure it when it is necessary.” states CISA. Hackers remotely accessed exposed PLCs, changed device IP addresses and passwords, and in some cases disabled shutdown processes and alarms, creating what CISA called unsafe conditions without notifying the operators running the actual equipment. Iran is the suspected actor behind much of this activity, likely tied to the ongoing war involving the US and Israel, though officials have stopped short of a formal attribution. CISA presents reconnaissance as an ongoing process. Organizations need to know which systems they expose to the internet and can use tools such as Shodan, Censys, or CISA’s Cyber Hygiene Vulnerability Scanning service to check their own IP ranges from the outside. The review should also cover ports used by industrial systems. Besides SSH, RDP, and HTTP, CISA highlights protocols such as Modbus, EtherNet/IP, DNP3, BACnet, and OPC UA. Finding one of these ports open does not automatically mean the system has been compromised, but it does indicate an exposure that needs to be investigated and addressed quickly. Where remote access is genuinely necessary, CISA’s advice is to route everything through a secure, centrally managed gateway rather than connecting straight to a PLC, HMI, or remote terminal unit. Pair that with phishing-resistant multi-factor authentication, unique credentials instead of shared defaults, and active monitoring of traffic in and out, and you’ve closed most of the gap that let this particular wave of attacks succeed in the first place. None of this is exotic security engineering; it’s the same basic hygiene that’s been recommended for years, just finally getting attention because attackers are actually using the gap. This isn’t an isolated incident CISA is responding to reactively, either. The water sector attacks sit inside a much larger pattern of nation-state interest in US and allied critical infrastructure, from China’s Volt Typhoon reportedly pre-positioning malware inside American infrastructure as a potential wartime disruption tool, to Russian-linked campaigns testing water and energy systems across Europe as part of broader pressure on NATO. If a foreign government is willing to spend years quietly waiting inside a power grid, an exposed PLC with a factory-default password isn’t a minor oversight, it’s an open invitation. “CISA urges all critical infrastructure organizations to route all necessary remote access through a secure gateway, firewall, VPN, or other centrally managed access solution, rather than connecting directly to a PLC, human-machine interface (HMI), or remote terminal unit (RTU).” concludes CISA. “The July 2026 malicious cyber activity targeting WWS Sector entities demonstrates the consequences of directly exposing PLCs to the internet. Threat actors remotely accessed internet-exposed PLCs, changed device IP addresses and passwords, and caused loss of monitoring and control functionality and, in some cases, operational disruptions.” If you run anything with the letters PLC, SCADA, ICS, or HMI in its job description, this guidance isn’t optional reading for next quarter. Go run the scan today, because the alternative is finding out the hard way that someone else already ran it for you. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Water Utilities)
OpenAI banned Russian ChatGPT accounts backing a fake think tank, IBI, that used AI posts and a fake “sovereignty” index to push pro‑Russia narratives. OpenAI says it has banned a cluster of ChatGPT accounts that likely originated in Russia and were used to support a covert influence operation. The campaign promoted an organisation called the International Burke Institute, or IBI, a supposed expert community that claimed to be based in Israel. The operation did not rely on dramatic deepfakes or a viral bot army. It used a more familiar method: build something that looks credible, fill it with enough content to seem legitimate, then use social media to push people toward it. Credibility is often cheaper to fake than to earn. OpenAI says the operators prompted ChatGPT in Russian to generate comments and posts, mostly in English, for X, Facebook, LinkedIn, Telegram and Substack. They specifically asked the model to avoid linguistic signals that might reveal a Russian origin, and used VPNs to bypass OpenAI’s restriction on access from Russia. “We banned a cluster of ChatGPT accounts that very likely originated in Russia. The operators prompted in Russian to generate social media comments that were posted on Substack, Telegram, X, Facebook and LinkedIn.” reads the report published by OpenAI, “Most of the comments they generated were in English, and the operators instructe. ChatGPT to hide any linguistic clues that they were Russian. As we do not allow access to our models from Russia, they used VPNs to access our platform.” The social media content promoted IBI articles or urged readers to follow IBI-linked channels. Some posts came from accounts bearing the institute’s name and logo, while others appeared to come from ordinary users whose main activity was sharing the same material. The website behind the brand was registered in February 2025 and presented itself as an Israel-based community of international experts. It claimed links to well-known names such as Francis Fukuyama and Noam Chomsky, but OpenAI’s review found that 34 of 36 sampled articles published under expert profiles had been copied from elsewhere online. “Some of these articles were years old; others were attributed to the wrong authors. For example, one article on the China-Pakistan Economic Corridor appears to have been copied from a Cambridge University Press original, but incorrectly attributed to a professor at the University of Nottingham whose expertise is in South Asian politics.” continues the report. This was not a case of ChatGPT writing every false article on the site. OpenAI says the website content itself was not generated by its models, and some material appeared to have been written by a Slavic-language speaker and machine-translated. The AI’s role was narrower but still useful: it helped create the promotional layer that sent people toward the site and made the operation appear more active and organic. openai “What began as an investigation into AI-generated social media posts led us to a much broader influence operation, built around a website containing copied and misattributed academic work, a “sovereignty” index that cast Russia in a favourable light, and efforts to disguise the operators’ Russian origins.” states OpenAI. “Although the campaign appears to have reached relatively small audiences, its elaborate construction distinguishes it from other Russia-linked(opens in a new window) influence(opens in a new window) operations(opens in a new window) we have disrupted(opens in a new window) since the start of the war in Ukraine.” The centrepiece was the so-called Sovereignty Index, also called the Burke Index. It ranked countries across political, economic, technological, information, cultural, cognitive and military dimensions, and consistently gave Russia a favourable place while criticising Western states, especially France, Germany, the European Union and the United States. openai A made-up index can be effective because numbers carry authority even when the method is vague, selective or impossible to audit. Add charts, expert profiles, academic-looking articles and a professional website, and a claim can travel much further than a Telegram post from an anonymous account. OpenAI found one Telegram channel, “Lahme Ente,” that published German-language posts attacking Ukraine, the EU and the German government while calling for closer ties with Russia. Another operator used ChatGPT to create logos for channels focused on Germany, France, Poland, Türkiye and the United States, then repeatedly asked for Russian-language summaries of their activity. “As well as generating content about IBI, one of the operators generated German-language posts that were posted on a Telegram channel called “Lahme Ente” (“lame duck”). These posts routinely criticized Ukraine, the EU and the German government, and advocated for better relations with Russia.” continues the report. “A second operator, alongside their IBI-related content, generated logos for a dozen Telegram channels (including Lahme Ente) focused on Germany, the USA, France, Poland and Türkiye. “ One American-facing channel called “American Observer” included awkward English that suggested it was not run by a native speaker. The operators were trying to hide their origin, but language remains a stubborn problem: a VPN can change an IP address, not always a sentence. The campaign’s immediate reach appears limited. OpenAI says most social posts received few views and the official IBI accounts had low subscriber counts, although its Telegram channels reportedly attracted around 10,000 to 20,000 followers each. Using the Brookings Breakout Scale, OpenAI rated the effort at the lower end of Category Three: activity across multiple platforms with some signs of reaching genuine audiences. That does not make it irrelevant. Influence operations are often built for scale, reuse and timing rather than instant virality. A network with a website, a recognisable brand, social accounts, apparent experts and ready-made narratives can remain quiet until a political event, election, protest or crisis gives it an opening. This case also shows what AI changes and what it does not. It does not eliminate the need for operators, infrastructure, stolen material, audience research or political intent. It makes routine tasks cheaper: drafting posts, translating them, changing tone, generating replies, creating branding and monitoring channels at a pace that a small team can sustain. “The significance of the operation lies less in the audience it reached, however, than in the infrastructure it had built. While the actors only used ChatGPT to produce isolated promotional posts, those posts pointed to an otherwise credible-appearing institution, complete with purported experts, republished academic work and a purported proprietary risk index.” concludes the report. “This illustrates how influence actors can use AI as a supporting tool within a broader effort to manufacture authority, obscure the source of favored narratives, and establish assets that could be scaled over time. It also illustrates how their supporting use of AI can lead to the broader operation being exposed.” Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, OpenAI)
Threat actors linked by Arctic Wolf to Dark Caracal with medium confidence deployed a previously undocumented Go-based malware framework, GoCaracal, during a June 2026 intrusion at an unnamed communications organization in Venezuela. GoCaracal provides operators with remote shell access and payload execution, while the extended profile adds browser data theft, keylogging, remote desktop control
Confirm this action.
Leaving now will discard your changes.