A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including international press. Capcom Data Breach Exposes 11.7 Million Email AddressesU.S. CISA adds Arista VeloCloud Orchestrator flaw to its Known Exploited Vulnerabilities catalogPHP Warns of New Code Execution Flaw Days After PHP2Shell PatchesMeta Faces $25 Billion Penalty Linked to Cambridge Analytica ScandalCapcom Data Breach Exposes 11.7 Million Email AddressesU.S. CISA adds Arista VeloCloud Orchestrator flaw to its Known Exploited Vulnerabilities catalogPHP Warns of New Code Execution Flaw Days After PHP2Shell PatchesMeta Faces $25 Billion Penalty Linked to Cambridge Analytica ScandalPHP2Shell: Millions of Attacks, No Confirmed Successful Exploits YetINTERPOL Operation Serengeti III Nets 1,462 Arrests and Recovers $105 Million in Cybercrime CrackdownMicrosoft Links ConnectWise Breach to China-Linked Group Using AI Pentesting Tool ARTEXSignal Vulnerability Could Keep Calls Alive After Users Hang UpPHP2Shell Attacks Started Four Days Before Public Disclosure, AWS ReportsFBI and CISA Warn of SafePay Ransomware Attacks on 600 OrganizationsRussian Satellite Makes a Close Approach To A Commercial Radar Satellite Used by UkraineOpenAI Reports Two Incidents of AI Agents Disabling Their Own OversightUS Government Orders DeepSeek Out of Federal Civilian SystemsPHP Prepares Emergency Fixes for Two Critical Remote Code Execution FlawsNSO Spyware Pegasus Hit a Serbian University Rector Six Days Before Snap ElectionsNikkei data breach affected over 1.8 million recordsGoogle Cloud Outage in London Disrupts Revolut Banking ServicesAfD Email Breach Exposes 421,000 Messages in Anonymous Online ArchiveMicrosoft Treats AI Agents as Insider Threats in New Security FrameworkPlex2Shell Exploit Used to Turn Vulnerable Plex Servers Into Crypto MinersMeta wants to scrape your website to train its AI, and you can’t say noDeepfakes and Election Manipulation: UK Watchdog Seeks Faster DetectionBig Fish: OpenBSD Root Exploit Chains a 37-Year-Old BSD Bug With a Kernel FlawAttackers Abuse Stolen ConnectWise Application Credentials to Target Microsoft 365Japan’s SiteGuard WAF flaw CVE-2026-106931 is already being exploited16-Year-Old Broadcom Wi-Fi Bug Lets Attackers Take Over Routers Without a PasswordRust-Based CikaBika Bot Turns Discord into a Command Center International Press – Newsletter Cybercrime U.K. Sanctions Cryptomus for RU Money Laundering Anonymous hackers claim to leak 421,179 internal emails from Germany’s Russia-aligned AfD Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site #StopRansomware: SafePay Ransomware Cybercrime crackdown in Africa nets 1,462 arrests, recovers over USD 105 million U.K. Sanctions Cryptomus for RU Money Laundering Nigerian Man Sentenced To Eight Years For Hacking, Fraud, And Identity Theft Schemes 1 Million Impacted by Capcom Data Breach Malware Auditing the auditor: Unmasking Apex Accelerator GhostAction Attack Escalates By Targeting GitHub Users Plex vulnerabilities being exploited in the wild to drop a cryptominer ROMULUS: Analysis of a New Multi-Payload ClickFix Delivery Platform Hackers Hijack Five OVHcloud CLI Releases to Distribute Secret-Stealing Malware Hacking ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks One Parser, Two Bugs, Many Routers: Exploiting Broadcom WiFi Across eCos and Linux Plex2Shell Unauthenticated RCE in Plex Media Server Big Fish: Exploiting a 37-Year-Old Kernel Bug in OpenBSD Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619) Making attacking agents pay LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot Proof-of-concept exploit released for PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619) PHP2Shell Exploit Tooling Found on Exposed Attacker Server Intelligence and Information Warfare TAG-193’s Regional Espionage Operations ATT&CK v20: Critical Infrastructure Campaigns, Adversary Use and Abuse of AI, & Iranian Cyber Espionage No to Palantir – Five Times UK Election Watchdog Develops AI System to Flag Deepfakes Within 3 Hours Pegasus and Mercenary Spyware Attacks on Serbian Pro-Democracy Figures Russian satellite makes possibly unprecedented approach to another spacecraft without permission AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise Operation FlashHole: Lazarus breaks security, defies control Pegasus spyware founder urges governments to trust his tech and ditch US AI Cybersecurity Character.ai files for bankruptcy following lawsuits alleging ties to teen suicides Cybersecurity Jobs Report 235,786 Agents are your newest insiders. Security must move at their speed Google Cloud services face outage in London, Revolut services down too Government websites go dark after AI-discovered flaw sparks security scramble Widespread PHP Flaw May Cause Many Site Outages Today Suppressing misalignment monitoring alerts and disabling misalignment monitoring AI Just Found a Bug That Puts up to 70% of the World’s Websites at Risk CVE-2026-113380 — RingRTC (Signal): Flooded Call Event Queue Blocks Local Hang-Up Cellebrite’s Advanced Unlocks and the case of the missing iPhone 17 Meta ordered to pay $25 billion penalty to New Mexico in data privacy case PHP Warns of Another Unpatched RCE Two Days After Emergency PHP2Shell Patches Our latest defenses against evolving web scams Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, newsletter)
A new UEFI bootkit named BlackX, deployed in an espionage campaign in early 2026, exploited the old Baton Drop vulnerability to bypass Secure Boot and load a malicious driver designed to interfere with security solutions from Kaspersky and Avast. The operation has been attributed with medium confidence to APT41, a Chinese state-sponsored threat group also known as Brass Typhoon, Wicked Panda, and Barium. It was discovered in early 2026 and targeted diplomatic agencies in Central Asia, particularly in Tajikistan, Uzbekistan, and Turkmenistan. Kaspersky researchers analyzed the BlackX bootkit and found similarities with BlackLotus, which has been circulating on hacker forums since October 2022 and leveraged the Baton Drop vulnerability (CVE-2022-21894) to bypass Secure Boot protection. ESET confirmed in March 2023 that BlackLotus exploited Baton Drop, and at the time it could compromise even fully patched Windows 11 systems.
A memory-corruption flaw in Google's Brotli decoder sits in many programs that unpack Brotli-compressed data, among them Bun, the Python Brotli and brotlicffi packages, and Envoy proxies set up to decompress Brotli. Tracked as CVE-2026-111497, the flaw allows crafted compressed data to overwrite past the end of a buffer and corrupt a program's memory, potentially
LiteLLM on Friday revealed that an Agent Platform master key accidentally published to a public GitHub repository in late May 2026 ultimately allowed the threat actor to push a malicious version of the popular Python package. "On May 27, 2026, a configuration file was committed to the public LiteLLM-Labs/lite-harness repository which inadvertently contained the master key to a deployment of
Google has updated its privacy policy to spell out that using personalized artificial intelligence (AI) features in Search or Gemini could allow the company to serve targeted ads to users based on their activity on other connected Google services. "You may choose to allow certain Google services, including services like Search or Gemini Apps, to access data from other Google services you use,
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two vulnerabilities impacting Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator (VCO) to its Known Exploited Vulnerabilities (KEV), citing reports of active exploitation in the wild. The critical-severity vulnerabilities are listed below - CVE-2026-110447 (CVSS score: 9.2) - An operating
Researchers remotely disabled a vulnerable updater in the abandoned Time4Popcorn app, a fork of the Popcorn Time BitTorrent client, closing a security flaw that could have allowed attackers to execute malicious code with elevated privileges on millions of computers.
Diplomatic organizations in Central Asia have been targeted by a sophisticated new Unified Extensible Firmware Interface (UEFI) bootkit called BlackX. The activity, which singled out diplomatic entities in Tajikistan, Uzbekistan, and Turkmenistan in early 2026, is suspected to be orchestrated by a China-linked state-sponsored hacking group known as APT41, Kaspersky said in a technical report
Ruby has released versions 4.0.9, 3.4.12, and 3.3.13 to fix three bugs in Onigmo, the regular expression engine built into the language. The bugs lie behind four critical security flaws that GitLab patched over the past month. GitLab found that a specially crafted pattern could corrupt memory while Ruby compiles it, potentially leading to code execution on its own servers. Ruby says any
Microsoft says Windows Server 2016 will stop receiving security updates after it reaches the end of support in January 2027. Windows Server 2016 was released in September 2016 at Microsoft's annual Ignite conference and reached general availability one month later, on October 12, 2016 It reached the end of mainstream support in January 2022, and extended support will end in roughly three months, on January 12. "The January 2027 Windows security update will be the last update available for this version. After this date, devices running Windows Server 2016 will no longer receive monthly security updates containing protections from the latest security threats," Microsoft said in a message center update. "This end of updates in 2027 applies to all editions of Windows Server 2016: Datacenter, Essentials, MultiPoint Premium and Standard."
Confirm this action.
Leaving now will discard your changes.