A Russian state-linked worm tied to the FSB's Gamaredon group is targeting Ukrainian government, military, and critical infrastructure — and it's remarkably hard to detect. Security firm Sekoia reconstructed the active infection chain behind a dozen detections it logged in January 2026.
It starts with a booby-trapped xHTML file. A malicious RAR archive then exploits a WinRAR path traversal flaw, CVE-2025-8088 (CVSS 8.8 High, 8.4 under v4.0), to drop a hidden HTA file into the Startup folder that runs on next login. WinRAR patched this in 7.13 on July 30, 2025, and CISA flagged it as actively exploited weeks later.
The worm, dubbed GammaWorm, hides its modules in NTFS Alternate Data Streams — a native Windows feature that leaves no visible trace in directory listings. It spreads via USB drives and network shares, pulls C2 addresses from Telegram and Cloudflare, and hands off to GammaSteel, a PowerShell stealer that exfiltrates files from local and network drives.
Sekoia recommends a full system wipe for infected machines: the malware constantly pulls fresh payloads from those dead drops, so cleaning attempts usually end with a fallback restoring it. Update WinRAR for Windows to 7.13 or later — anything up to 7.12 is still exposed.
Source: Infosecurity Magazine
A Russian state-linked worm tied to the FSB's Gamaredon group is targeting Ukrainian government, military, and critical infrastructure — and it's remarkably hard to detect. Security firm Sekoia reconstructed the active infection chain behind a dozen detections it logged in January 2026.
It starts with a booby-trapped xHTML file. A malicious RAR archive then exploits a WinRAR path traversal flaw, CVE-2025-8088 (CVSS 8.8 High, 8.4 under v4.0), to drop a hidden HTA file into the Startup folder that runs on next login. WinRAR patched this in 7.13 on July 30, 2025, and CISA flagged it as actively exploited weeks later.
The worm, dubbed GammaWorm, hides its modules in NTFS Alternate Data Streams — a native Windows feature that leaves no visible trace in directory listings. It spreads via USB drives and network shares, pulls C2 addresses from Telegram and Cloudflare, and hands off to GammaSteel, a PowerShell stealer that exfiltrates files from local and network drives.
Sekoia recommends a full system wipe for infected machines: the malware constantly pulls fresh payloads from those dead drops, so cleaning attempts usually end with a fallback restoring it. Update WinRAR for Windows to 7.13 or later — anything up to 7.12 is still exposed.
Source: Infosecurity Magazine
Belgium's Centre for Cybersecurity says a critical Windows Netlogon flaw (CVE-2026-41089, CVSS 9.8) is being actively exploited in the wild, putting unpatched domain controllers at serious risk. Microsoft says it has found no evidence for the claim and didn't rate the bug likely to be exploited — but it still tells customers to patch.
The flaw is a stack-based buffer overflow. Attackers need only network access to trigger it — no authentication, no user interaction — allowing full SYSTEM-level code execution and potential domain takeover.
Microsoft patched it on May 12, alongside 15 other critical flaws. Every supported Server branch from 2016 to 2025 has a fixed build; Server 2012 and 2012 R2 are affected too and need Extended Security Updates, and Acros Security has micropatches for unsupported systems.
The CCB says patch as quickly as possible. Prioritise domain controllers, tighten network segmentation, and monitor for Netlogon crashes, anomalous authentication and unexpected admin account creation.
Source: Cybersecurity News
Belgium's Centre for Cybersecurity says a critical Windows Netlogon flaw (CVE-2026-41089, CVSS 9.8) is being actively exploited in the wild, putting unpatched domain controllers at serious risk. Microsoft says it has found no evidence for the claim and didn't rate the bug likely to be exploited — but it still tells customers to patch.
The flaw is a stack-based buffer overflow. Attackers need only network access to trigger it — no authentication, no user interaction — allowing full SYSTEM-level code execution and potential domain takeover.
Microsoft patched it on May 12, alongside 15 other critical flaws. Every supported Server branch from 2016 to 2025 has a fixed build; Server 2012 and 2012 R2 are affected too and need Extended Security Updates, and Acros Security has micropatches for unsupported systems.
The CCB says patch as quickly as possible. Prioritise domain controllers, tighten network segmentation, and monitor for Netlogon crashes, anomalous authentication and unexpected admin account creation.
Source: Cybersecurity News
A cybercriminal group called Silent Ransom Group (SRG), also tracked as Luna Moth, has escalated its attacks on US law firms by impersonating IT staff — both over the phone and in person. It has hit law firms since spring 2023, and insurance, finance and healthcare firms too, using callback scams to trick employees into granting remote desktop access.
In a May 26 FLASH alert, the FBI warns that when remote access fails, SRG sends an actor physically to the victim's office, convincing staff to plug in an external drive under the guise of IT maintenance. Data is then quietly exfiltrated using legitimate tools like WinSCP or Rclone — making traditional antivirus detection unlikely.
SRG then threatens to sell or post the stolen files, and calls the firm's own employees and clients to pressure it into paying.
The FBI recommends verifying visitor credentials and taking copies of their ID, disabling external drive permissions, blocking port 22 where possible, enforcing phishing-resistant MFA, and training staff to authenticate IT requests before granting any access.
Source: Infosecurity Magazine
A cybercriminal group called Silent Ransom Group (SRG), also tracked as Luna Moth, has escalated its attacks on US law firms by impersonating IT staff — both over the phone and in person. It has hit law firms since spring 2023, and insurance, finance and healthcare firms too, using callback scams to trick employees into granting remote desktop access.
In a May 26 FLASH alert, the FBI warns that when remote access fails, SRG sends an actor physically to the victim's office, convincing staff to plug in an external drive under the guise of IT maintenance. Data is then quietly exfiltrated using legitimate tools like WinSCP or Rclone — making traditional antivirus detection unlikely.
SRG then threatens to sell or post the stolen files, and calls the firm's own employees and clients to pressure it into paying.
The FBI recommends verifying visitor credentials and taking copies of their ID, disabling external drive permissions, blocking port 22 where possible, enforcing phishing-resistant MFA, and training staff to authenticate IT requests before granting any access.
Source: Infosecurity Magazine
A maximum-severity vulnerability in Samba's printing subsystem — CVE-2026-4480, CVSS 10.0 — lets unauthenticated attackers run arbitrary commands on affected Linux and Unix systems. The flaw lives in the %J substitution parameter used in print commands, which passes client-controlled input directly into a shell without escaping special characters.
Only print servers whose print command actually references %J are exposed, which is why setups using printing = cups or iprint are unaffected. Samba lists every other version as vulnerable, and print servers allow guest users to print by default — so no credentials are needed. A working proof-of-concept is already public.
Patches are out: Samba 4.22.10, 4.23.8 and 4.24.3 fix the issue, and anything on an older unsupported branch needs to move onto one of them. If patching isn't immediate, Samba's own workaround is to put single quotes directly around %J, which it says makes useful exploitation much less likely. Removing %J from your smb.conf print command is stronger still.
Commands run in the context of the printing service rather than as root, so expect an attacker to chain a local privilege escalation next. Watch for smbd spawning shells and print job names carrying shell metacharacters.
Source: Cybersecurity News
A maximum-severity vulnerability in Samba's printing subsystem — CVE-2026-4480, CVSS 10.0 — lets unauthenticated attackers run arbitrary commands on affected Linux and Unix systems. The flaw lives in the %J substitution parameter used in print commands, which passes client-controlled input directly into a shell without escaping special characters.
Only print servers whose print command actually references %J are exposed, which is why setups using printing = cups or iprint are unaffected. Samba lists every other version as vulnerable, and print servers allow guest users to print by default — so no credentials are needed. A working proof-of-concept is already public.
Patches are out: Samba 4.22.10, 4.23.8 and 4.24.3 fix the issue, and anything on an older unsupported branch needs to move onto one of them. If patching isn't immediate, Samba's own workaround is to put single quotes directly around %J, which it says makes useful exploitation much less likely. Removing %J from your smb.conf print command is stronger still.
Commands run in the context of the printing service rather than as root, so expect an attacker to chain a local privilege escalation next. Watch for smbd spawning shells and print job names carrying shell metacharacters.
Source: Cybersecurity News
A critical SQL injection vulnerability in Ghost CMS (CVE-2026-26980, CVSS 9.4) has been exploited by at least two hacker groups to quietly poison over 700 websites with ClickFix malware. The flaw sits in Ghost's Content API and lets unauthenticated attackers steal Admin API keys, then rewrite article content at scale.
It was disclosed and patched on February 19, 2026 in Ghost 6.19.1, with versions 3.24.0 through 6.19.0 vulnerable — so the sites hit in May had been exposed for three months. Researchers at Qianxin XLab spotted the campaign on May 7: 156 poisoned domains by May 10, more than 700 by May 17.
Victims span universities, blockchain, AI, fintech and media, including Harvard, Oxford and Auburn. Visitors saw nothing suspicious — malicious JavaScript hid at the bottom of articles, eventually serving a fake Cloudflare verification page that tricked users into running malware themselves.
Ghost CMS admins should patch to 6.19.1 or later and rotate every key and admin password — XLab watched cleaned sites get reinfected where old Admin API keys still worked. Then audit access logs for unusual bulk PUT requests.
Source: Cyber Security News
A critical SQL injection vulnerability in Ghost CMS (CVE-2026-26980, CVSS 9.4) has been exploited by at least two hacker groups to quietly poison over 700 websites with ClickFix malware. The flaw sits in Ghost's Content API and lets unauthenticated attackers steal Admin API keys, then rewrite article content at scale.
It was disclosed and patched on February 19, 2026 in Ghost 6.19.1, with versions 3.24.0 through 6.19.0 vulnerable — so the sites hit in May had been exposed for three months. Researchers at Qianxin XLab spotted the campaign on May 7: 156 poisoned domains by May 10, more than 700 by May 17.
Victims span universities, blockchain, AI, fintech and media, including Harvard, Oxford and Auburn. Visitors saw nothing suspicious — malicious JavaScript hid at the bottom of articles, eventually serving a fake Cloudflare verification page that tricked users into running malware themselves.
Ghost CMS admins should patch to 6.19.1 or later and rotate every key and admin password — XLab watched cleaned sites get reinfected where old Admin API keys still worked. Then audit access logs for unusual bulk PUT requests.
Source: Cyber Security News
Security firm Token Security discovered five chained vulnerabilities in Zapier — a chain it calls Zapocalypse — that together could have let an attacker act as any logged-in user, starting with nothing more than a free account.
The path ran from Code by Zapier's Python sandbox through AWS credentials that had been scrubbed from the environment but left sitting in Lambda's memory, into an Amazon ECR registry holding 1,111 private repositories. One image's build metadata carried an npm publish token — unscoped, write-enabled, and flagged to bypass two-factor authentication.
That token could publish zapier-design-system, which loads in every authenticated session on zapier.com, so a bad actor could have created and rewritten automations as the user across Zapier's 8,000+ integrations. Connected services' OAuth tokens and API keys stay server-side, so those weren't directly exposed.
Yair Balilti of Token Security reported the chain on February 12. Zapier triaged it in four days, revoked the token, confirmed remediation by March 5, and paid its $3,000 maximum bounty — while committing to review that cap. Zapier says it has no evidence of exploitation beyond the research itself.
Source: CyberScoop
Security firm Token Security discovered five chained vulnerabilities in Zapier — a chain it calls Zapocalypse — that together could have let an attacker act as any logged-in user, starting with nothing more than a free account.
The path ran from Code by Zapier's Python sandbox through AWS credentials that had been scrubbed from the environment but left sitting in Lambda's memory, into an Amazon ECR registry holding 1,111 private repositories. One image's build metadata carried an npm publish token — unscoped, write-enabled, and flagged to bypass two-factor authentication.
That token could publish zapier-design-system, which loads in every authenticated session on zapier.com, so a bad actor could have created and rewritten automations as the user across Zapier's 8,000+ integrations. Connected services' OAuth tokens and API keys stay server-side, so those weren't directly exposed.
Yair Balilti of Token Security reported the chain on February 12. Zapier triaged it in four days, revoked the token, confirmed remediation by March 5, and paid its $3,000 maximum bounty — while committing to review that cap. Zapier says it has no evidence of exploitation beyond the research itself.
Source: CyberScoop
Security researchers at Adversa AI have uncovered a novel attack technique called SymJack that weaponizes AI coding agents to silently inject malicious code into software pipelines. It starts with a repository the attacker controls: the agent ingests the project's instruction file, then asks the developer to approve what looks like a routine file copy.
The copy's destination is a symlink pointing into the agent's own config directory, so the kernel writes attacker JSON there instead — quietly registering a rogue MCP server. On the next restart, the attacker's code runs as the user and unsandboxed.
That means SSH keys, cloud tokens and browser sessions on a developer's machine. On a CI runner it means deploy keys, signing material and registry tokens — which is how a poisoned pull request becomes a supply chain problem.
Adversa confirmed SymJack against six agents — Claude Code, Gemini CLI, Cursor Agent CLI, GitHub Copilot CLI, Grok Build CLI and OpenAI Codex CLI — with Google's Antigravity CLI affected too. Most vendors declined: Google called it a single-user self-attack, OpenAI called it theoretical, Cursor a duplicate. Anthropic rejected the report as out of scope, then quietly hardened Claude Code to resolve symlinks before asking for approval.
Adversa's point is that the agents are only following instructions — but it still lists fixes they could ship, and tells teams to deny shell writes into config directories, turn off project-scoped MCP execution, and scan repos for tracked symlinks aimed at config files.
Source: SecurityWeek
Security researchers at Adversa AI have uncovered a novel attack technique called SymJack that weaponizes AI coding agents to silently inject malicious code into software pipelines. It starts with a repository the attacker controls: the agent ingests the project's instruction file, then asks the developer to approve what looks like a routine file copy.
The copy's destination is a symlink pointing into the agent's own config directory, so the kernel writes attacker JSON there instead — quietly registering a rogue MCP server. On the next restart, the attacker's code runs as the user and unsandboxed.
That means SSH keys, cloud tokens and browser sessions on a developer's machine. On a CI runner it means deploy keys, signing material and registry tokens — which is how a poisoned pull request becomes a supply chain problem.
Adversa confirmed SymJack against six agents — Claude Code, Gemini CLI, Cursor Agent CLI, GitHub Copilot CLI, Grok Build CLI and OpenAI Codex CLI — with Google's Antigravity CLI affected too. Most vendors declined: Google called it a single-user self-attack, OpenAI called it theoretical, Cursor a duplicate. Anthropic rejected the report as out of scope, then quietly hardened Claude Code to resolve symlinks before asking for approval.
Adversa's point is that the agents are only following instructions — but it still lists fixes they could ship, and tells teams to deny shell writes into config directories, turn off project-scoped MCP execution, and scan repos for tracked symlinks aimed at config files.
Source: SecurityWeek
Notepad++ has patched three security vulnerabilities in version v8.9.6.1, released May 26, 2026 — two of them rated High. The worst, CVE-2026-48778 (CVSS 7.8), lets attackers plant a malicious executable path inside Notepad++'s config.xml. When a user opens a folder via File → Open Containing Folder → cmd, Windows runs the attacker's program instead. No validation, no warning.
A second High-severity flaw, CVE-2026-48800, works the same way but targets shortcuts.xml. Neither gets an attacker onto your machine by itself: both need existing write access to your settings files, or a user tricked into loading a poisoned settings folder — through cloud-synced settings, a malicious shortcut, or archive extraction.
Anyone running v8.9.6 or earlier should update immediately from the official releases page.
Updated August 13, 2026: v8.9.6.1 is no longer enough. The CVE-2026-48800 fix was bypassed days later using path traversal and re-patched in v8.9.6.2; a TOCTOU flaw, CVE-2026-52885, followed in v8.9.6.4; and v8.9.7, released July 14, fixes five more, including another shortcuts.xml bypass. Update to v8.9.7 or later.
Source: Cybersecurity News
Notepad++ has patched three security vulnerabilities in version v8.9.6.1, released May 26, 2026 — two of them rated High. The worst, CVE-2026-48778 (CVSS 7.8), lets attackers plant a malicious executable path inside Notepad++'s config.xml. When a user opens a folder via File → Open Containing Folder → cmd, Windows runs the attacker's program instead. No validation, no warning.
A second High-severity flaw, CVE-2026-48800, works the same way but targets shortcuts.xml. Neither gets an attacker onto your machine by itself: both need existing write access to your settings files, or a user tricked into loading a poisoned settings folder — through cloud-synced settings, a malicious shortcut, or archive extraction.
Anyone running v8.9.6 or earlier should update immediately from the official releases page.
Updated August 13, 2026: v8.9.6.1 is no longer enough. The CVE-2026-48800 fix was bypassed days later using path traversal and re-patched in v8.9.6.2; a TOCTOU flaw, CVE-2026-52885, followed in v8.9.6.4; and v8.9.7, released July 14, fixes five more, including another shortcuts.xml bypass. Update to v8.9.7 or later.
Source: Cybersecurity News
Four widely-used Laravel localization packages were compromised in a supply chain attack on May 22 and 23. Someone with push access to the Laravel-Lang GitHub organization — reportedly through a leaked personal access token — rewrote every Git tag across more than 700 historical versions of laravel-lang/lang, http-statuses, attributes, and actions, pointing them at commits in a malicious fork.
The payload was a file registered in composer.json's autoload list, so it ran the moment any Laravel or Symfony app booted. It called out to flipboxstudio[.]info and pulled down a PHP credential stealer going after AWS, GCP and Azure keys, SSH keys, Kubernetes configs, browser passwords and crypto wallets, across Windows, Linux, and macOS. CI runners were the prize.
Packagist pulled the malicious releases on May 23. Version numbers won't tell you whether you were hit, because the tags themselves were reassigned — a composer.lock pinned to commit hashes before May 22 holds, a version range doesn't. Anything that installed or updated these packages on May 22 or 23 should be treated as compromised: rotate every secret and block the domain.
Source: SecurityWeek
Four widely-used Laravel localization packages were compromised in a supply chain attack on May 22 and 23. Someone with push access to the Laravel-Lang GitHub organization — reportedly through a leaked personal access token — rewrote every Git tag across more than 700 historical versions of laravel-lang/lang, http-statuses, attributes, and actions, pointing them at commits in a malicious fork.
The payload was a file registered in composer.json's autoload list, so it ran the moment any Laravel or Symfony app booted. It called out to flipboxstudio[.]info and pulled down a PHP credential stealer going after AWS, GCP and Azure keys, SSH keys, Kubernetes configs, browser passwords and crypto wallets, across Windows, Linux, and macOS. CI runners were the prize.
Packagist pulled the malicious releases on May 23. Version numbers won't tell you whether you were hit, because the tags themselves were reassigned — a composer.lock pinned to commit hashes before May 22 holds, a version range doesn't. Anything that installed or updated these packages on May 22 or 23 should be treated as compromised: rotate every secret and block the domain.
Source: SecurityWeek
A zero-day flaw in Digital Knowledge's KnowledgeDeliver LMS (CVE-2026-5426, CVSS 9.1 Critical) was exploited in late 2025 to deploy BLUEBEAM — a .NET in-memory web shell also tracked as Godzilla — which runs inside the IIS worker process and leaves few on-disk artifacts. Mandiant, responding to the intrusion, traced it to identical hardcoded ASP.NET machine keys shipped across customer installations.
Anyone holding that key could forge ViewState payloads and run code with no authentication, provided the LMS was reachable from the internet. Once in, the attacker used icacls to grant broad access to the web directory, tampered with legitimate JavaScript to display a fake security alert, and pushed a Cobalt Strike Beacon to users who installed the bogus plugin.
Digital Knowledge changed its deployment procedure on February 24, 2026 so new installations get unique keys — but that does nothing for anything provisioned earlier. If yours predates that date, generate a unique, cryptographically strong machineKey now, restrict access to known IP ranges, and hunt backwards: ASP.NET Event ID 1316, and cmd.exe or powershell.exe spawning from w3wp.exe, are the tells.
Source: Cybersecurity News
A zero-day flaw in Digital Knowledge's KnowledgeDeliver LMS (CVE-2026-5426, CVSS 9.1 Critical) was exploited in late 2025 to deploy BLUEBEAM — a .NET in-memory web shell also tracked as Godzilla — which runs inside the IIS worker process and leaves few on-disk artifacts. Mandiant, responding to the intrusion, traced it to identical hardcoded ASP.NET machine keys shipped across customer installations.
Anyone holding that key could forge ViewState payloads and run code with no authentication, provided the LMS was reachable from the internet. Once in, the attacker used icacls to grant broad access to the web directory, tampered with legitimate JavaScript to display a fake security alert, and pushed a Cobalt Strike Beacon to users who installed the bogus plugin.
Digital Knowledge changed its deployment procedure on February 24, 2026 so new installations get unique keys — but that does nothing for anything provisioned earlier. If yours predates that date, generate a unique, cryptographically strong machineKey now, restrict access to known IP ranges, and hunt backwards: ASP.NET Event ID 1316, and cmd.exe or powershell.exe spawning from w3wp.exe, are the tells.
Source: Cybersecurity News
