Security Affairs newsletter Round 602 by Pierluigi Paganini – INTERNATIONAL EDITION

A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box.

Enjoy a new round of the weekly SecurityAffairs newsletter, including international press.

U.S. CISA adds Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalogAttackers Exploit Critical Drupal Commerce Core Vulnerability CVE-2026-118539Yoba Malware Hides a Crypto Miner Behind Legitimate OpenAI and Anthropic BinariesU.S. CISA adds GitLab and Cisco flaws to its Known Exploited Vulnerabilities catalog$6.3 Billion Stolen from Binance in Attack Attributed to North KoreaHow to prioritize remediation after a pentest: a practitioner workflowHacker leaks data on more than 40,000 Homeland Security employeesBinance Investigates Suspicious Crypto Transfers Worth Up to $5.8 BillionUS Probes Suspected Hack Behind Military Base Freezer Failures484,142 Exposed Cloud Buckets Contain 18 Billion FilesU.S. CISA adds Linux Kernel and Broadcom VMWare ESX  flaws to its Known Exploited Vulnerabilities catalogVolt Typhoon Used Silent Train to Hide Zero-Day AttacksElection Website Security: 42% of US County Sites Still Lack .gov DomainsENGIE Data Breach Exposes Customer Details and Energy ContractsVirtualine Domain Seized, but Allegedly Abusive Website Remains OnlineHive and Nefilim Ransomware Affiliate Gets 70 Months In JailAds or Surveillance? Researchers Flag Suspicious Targeting of Starlink UsersCVE-2026-97631: 16-Year-Old UEFI Flaw Threatens ServersU.S. CISA adds Google Brotli and Adobe Commerce and Magento flaws to its Known Exploited Vulnerabilities catalogThree Japan-Focused Cyberattacks Show How Hackers Use AIItaly ’s Parliament Under Cyber Pressure: Why the Attack on the Chamber MattersAustralia’s Cyber Spy Chief: Expect More Disruption as AI Accelerates HackingU.S. CISA adds PHP flaws PHP2Shell to its Known Exploited Vulnerabilities catalogAttackers Take Control of Dahua Cameras and Video Recorders Via Easy4IPCohere Finds Qwen AI Model Contacting a Server in ChinaMagento Campaign Infects 953 Online Stores Across Five DomainsAI-Generated Fake Bank Calls and NFC App Enabled €380,000 Fraud, Dutch Police SayResearchers Uncover Rentable Android Spyware uCreater Targeting WeChat and TelegramPHP2Shell: Suspected North Korean campaign targets 216 vulnerable PHP hostsAnthropic reveals how Claude Mythos 5 crossed security testing boundariesOpenAI Paused Frontier AI Training After a Security Incident

International Press – Newsletter

Cybercrime

Binance Says User Funds Are ‘Completely Safe’ After $3.5 Billion Drains From Its Hot Wallets

Police arrest two suspects in AI-powered bank fraud that cost victims €380,000

M365 Token Spray and Replay Campaign Compromises Business Email Accounts

Chinese National Extradited for Alleged Role in Multimillion-Dollar Cryptocurrency Scam Targeting U.S. Citizens

Ukrainian National Sentenced to 70 Months in Prison for Multi-Million Dollar Ransomware Conspiracies

Hacker stole personnel data about thousands of Homeland Security employees, including CBP and ICE agents

deepveindrilling.com: Magento CMS block loader hits 953 stores

“Bulletproof” website domain seized in international law enforcement operation

Trezor warns of suspected crypto-theft implant in hardware wallet

Polymarket halts trading after crypto-draining script breach, $2.5M traced

Malware

uCreator: virtualization-based Android spyware platform targeting WeChat, Telegram and other messaging apps

CLAUDE CODE FOUND SPYWARE ON MY FAMILY’S PHONES AND A BACKDOOR ON MY MAC

Security notice — malicious version of Anthropic.claude-code (2.1.313) identified in the Cursor Extension Marketplace

Tricks from the Past deployed via signed ChatGPT and Claude binaries

Hacking

PHP2Shell exploitation observed: packet-to-process RCE evidence

CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure

Beyond the Inbox: How Threat Actors Abuse Microsoft Teams External Chat for Initial Access

Not Only ARTEX: The Different Levels AI is Used in Attacks Targeting Japan

Broccoli2shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerability

Discovering and exploiting vulnerabilities in critical, real-world software with Claude

Putting Claude Code in a box: a sandboxed dev container for Zed

Hackers Target Critical Oracle E-Business Suite RCE Flaw Days After Security Patch

The Last Proof of Human Craft: Forging a Microsoft Edge Full Chain with Logic Bugs Only!

Pentagon treating military base freezer malfunctions as suspected cyberattack, officials say

GitLab security incident: attempted exploitation of CVE-2026-97229

Intelligence and Information Warfare

Alibaba’s Qwen AI caught trying to contact server in China

Hackers can gain control of cameras and DVRs through cloud access

Disruptions ‘inevitable’ as AI-powered cyber threats grow, Australian Signals Directorate says

Operation FlashHole: Lazarus breaks security, defies control

Hackers Sympathetic to Russia Are Hitting Utilities and Factories

Alleged Israeli spy company heavily targeted Starlink users, sources say

Silent Train: uncovering Volt Typhoon’s operational framework for zero-day exploitation and strategic access

North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History

Mapping the Political Influencer Industry and the Problems it Causes for Democracy

Cybersecurity

NIS 2 Italy: Key Deadlines, Board Duties and What ACN Expects From Companies

The Two Things CISOs Should Be Thinking About In The Wake Of The PHP Nightmare

Code-execution flaw in UEFI firmware affects most servers on planet Earth

2026 County Election Website Security Census: Key Findings

Cloud Exposure Index 2026: 484,142 open buckets mapped

ENGIE: Data leak via a tool belonging to its business partners

Beyond Framework Signatures: Understanding AI-Driven Intrusions

I Think The Military Commissary’s Freezers Were Hacked

Manifestos, Fear, and ‘Loser Thinking’: Inside Proton’s AI Reckoning

Passkeys Are Better Than Passwords. But They Are Not Enough

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, newsletter)