SecurityWeek’s cybersecurity information weekly roundup affords a concise overview of necessary developments that will not obtain full standalone protection however stay related to the broader risk panorama.
This curated abstract highlights key tales throughout vulnerability disclosures, rising assault strategies, coverage updates, trade experiences, and different noteworthy occasions to assist readers preserve a well-rounded consciousness of the evolving cybersecurity surroundings.
Listed here are this week’s highlights:
Nameless-linked hacker Aubrey Cottle jailed over Texas GOP cyberattack
Aubrey Cottle, a Canadian hacker related to the hacktivist group Nameless, has been sentenced to 18 months in jail for his involvement in a cyberattack on the Texas Republican Get together’s web site in September 2021. Cottle, 39, of Oshawa, Ontario, pleaded responsible to defacing the web site, exfiltrating information from a Texas GOP server, and publishing the information on-line.
14 million impacted by KDDI information breach
Japanese telecoms supplier KDDI has disclosed (PDF) an information breach doubtless impacting the e-mail addresses and passwords of 14,22 million individuals. The incident affected 5 ISP operators, together with BIGLOBE, Chubu Telecommunications C., JCOM Co., NIFTY Company, and STNet.
Push Safety focused in poisoned tenant assault
Three years after detailing the poisoned tenant assault, Push Safety was focused utilizing the method by way of OpenAI’s group invitation function. A number of workers acquired an OpenAI invitation to affix Push Safety Inc. After they might be a part of the tenant, the attacker might spy on their actions or goal them with additional social engineering.
Rust-based PamStealer concentrating on macOS
Jamf has detailed PamStealer, an data stealer concentrating on macOS that validates the harvested credentials by way of Pluggable Authentication Modules (PAM) earlier than utilizing them. The malware is distributed as a compiled AppleScript file impersonating the open supply clipboard supervisor Maccy.
Russian hackers behind the 2025 Jaguar Land Rover hack
The cyberattack that severely disrupted Jaguar Land Rover’s operations in September 2025 was mounted by Russian hackers, The New York Occasions says. Microsoft reportedly notified the automobile producer in regards to the hacking group, with Mandiant, Palo Alto Networks, and US and UK regulation enforcement companies additionally concerned within the investigation.
Pegasus spyware and adware focused a European Parliament member investigating it
Former member of the European Parliament Stelios Kouloglou was hacked with NSO Group’s Pegasus spyware and adware whereas he was investigating Pegasus abuse instances, as a part of the PEGA committee, Citizen Lab found. The concentrating on has not been attributed to a particular authorities, and there’s no proof that the Greek Authorities was concerned.
Researcher drops dozens of zero-days in open supply initiatives
A researcher generally known as Bikini has revealed proof-of-concept (PoC) code concentrating on dozens of zero-day vulnerabilities in a number of open supply initiatives, together with FFmpeg, Gogs, Gitea, Ghidra, 7-Zip, OpenVPN, and VLC. 9 of the safety defects have been assigned a CVE identifier. The problems, the researcher says, have been surfaced by way of LLM fuzzing.
Professional-Russia affect operations are shifting
4 years into Russia’s invasion of Ukraine, pro-Russia affect operations are shifting from their single deal with Ukraine to pre-war targets, Google says. Covert pro-Russia affect operations are concentrating on the US, European Union members, NATO, Russia’s neighbors, the Center East and Africa, and inside entities. They deal with world occasions, elections, the conflict in Ukraine, and rising geopolitical developments and occasions, and are more and more counting on generative AI.
Venezuelans sentenced within the US over ATM jackpotting
Two unlawful aliens from Venezuela, Carlos Javier Padron, 36, and Arnoldo Cabrera Torrealba, 37, have been sentenced to 78 months in jail within the US for his or her involvement in ATM jackpotting actions. As a part of a complicated felony group, they constructed and deployed a variant of the Ploutus malware on ATMs throughout the US and used it to withdraw cash with out authorization. They have been additionally ordered to collectively pay $1.5 million in restitution. 96 different defendants have been charged over their roles within the operation.
Cisco and Synology patches
Cisco has launched fixes for seven ClamAV vulnerabilities impacting Safe Endpoint Connector for Home windows, Linux, and macOS, and Safe Endpoint Personal Cloud, and for one flaw in Catalyst Middle. Synology resolved three safety defects in MailPlus Server, together with two vital bugs that might permit attackers to learn or write arbitrary information and trigger DoS situations.
Be part of the AI Threat Summit | Ritz-Carlton, Half Moon Bay
