The ShinyHunters extortion gang exploited a critical zero-day vulnerability in Oracle's PeopleSoft software between May 27 and June 9, 2026, compromising more than 300 instances. The flaw, CVE-2026-35273 (CVSS 9.8), allowed unauthenticated remote code execution through PeopleSoft's Environment Management Hub service.
Mandiant and Google Threat Intelligence Group spotted the campaign and contacted more than 100 at-risk organisations, about 68% of them higher education institutions and most in the US. The University of Nottingham confirmed a breach, with ShinyHunters claiming more than 40 GB of sensitive data taken from its student records.
Oracle pushed an out-of-band patch on June 10, the day after being alerted. Organisations should disable the EMHub service or block external access to it immediately — researchers note doing so doesn't break PeopleSoft's core functionality.
Source: Dark Reading
The ShinyHunters extortion gang exploited a critical zero-day vulnerability in Oracle's PeopleSoft software between May 27 and June 9, 2026, compromising more than 300 instances. The flaw, CVE-2026-35273 (CVSS 9.8), allowed unauthenticated remote code execution through PeopleSoft's Environment Management Hub service.
Mandiant and Google Threat Intelligence Group spotted the campaign and contacted more than 100 at-risk organisations, about 68% of them higher education institutions and most in the US. The University of Nottingham confirmed a breach, with ShinyHunters claiming more than 40 GB of sensitive data taken from its student records.
Oracle pushed an out-of-band patch on June 10, the day after being alerted. Organisations should disable the EMHub service or block external access to it immediately — researchers note doing so doesn't break PeopleSoft's core functionality.
Source: Dark Reading
GitHub is overhauling npm with version 12, flipping three long-standing permissive defaults to fight software supply chain attacks. Starting July 2026, npm will block install scripts, Git dependencies and remote URL packages by default — all requiring explicit developer opt-in. Upgrade to npm 11.16.0 now to preview, then run the new npm approve-scripts command to see which of your dependencies will break and build an allowlist before the deadline.
Security experts are cautiously supportive. Semgrep's Isaac Evans praised the structural approach but warned attackers will pivot to the next trusted layer, naming Artifactory and Nexus. Researcher Paul McCarty welcomed closing the defaults but fears developers will "simply blind-approve blocked scripts" to get builds working, since "this builds" always wins — which would leave the security benefit on paper only.
Source: Infosecurity Magazine
GitHub is overhauling npm with version 12, flipping three long-standing permissive defaults to fight software supply chain attacks. Starting July 2026, npm will block install scripts, Git dependencies and remote URL packages by default — all requiring explicit developer opt-in. Upgrade to npm 11.16.0 now to preview, then run the new npm approve-scripts command to see which of your dependencies will break and build an allowlist before the deadline.
Security experts are cautiously supportive. Semgrep's Isaac Evans praised the structural approach but warned attackers will pivot to the next trusted layer, naming Artifactory and Nexus. Researcher Paul McCarty welcomed closing the defaults but fears developers will "simply blind-approve blocked scripts" to get builds working, since "this builds" always wins — which would leave the security benefit on paper only.
Source: Infosecurity Magazine
South Korea has hit e-commerce giant Coupang with fines totalling more than $400 million over a 2025 data breach that exposed personal information belonging to roughly 37.5 million users — more than half the country's population. Seoul's Personal Information Protection Commission issued 423.6bn won over the breach itself, plus a further 201bn won for collecting data without user consent, after finding the company failed to properly manage authentication signing keys and access controls.
Exposed data included names, contact and delivery details, and order histories. Coupang was alerted to a breach involving 4,500 accounts in November 2025 and reported it immediately; its own later checks put the figure at nearly 34 million South Korean accounts, and it believes the intrusion began as early as June 2025 through a server based abroad.
CEO Park Dae-jun resigned after the incident, with chief administrative officer Harold Rogers stepping in as interim. Coupang says its explanations "were not sufficiently reflected" in the ruling and plans to fight it in court.
Source: BBC News
South Korea has hit e-commerce giant Coupang with fines totalling more than $400 million over a 2025 data breach that exposed personal information belonging to roughly 37.5 million users — more than half the country's population. Seoul's Personal Information Protection Commission issued 423.6bn won over the breach itself, plus a further 201bn won for collecting data without user consent, after finding the company failed to properly manage authentication signing keys and access controls.
Exposed data included names, contact and delivery details, and order histories. Coupang was alerted to a breach involving 4,500 accounts in November 2025 and reported it immediately; its own later checks put the figure at nearly 34 million South Korean accounts, and it believes the intrusion began as early as June 2025 through a server based abroad.
CEO Park Dae-jun resigned after the incident, with chief administrative officer Harold Rogers stepping in as interim. Coupang says its explanations "were not sufficiently reflected" in the ruling and plans to fight it in court.
Source: BBC News
A researcher known as Nightmare-Eclipse has released yet another Microsoft zero-day exploit — this one called RoguePlanet — timed to drop right after Microsoft's June Patch Tuesday, which addressed a record 206 CVEs.
The new exploit abuses a race condition in Windows Defender's signature update workflow and, when it lands, spawns a shell with full SYSTEM privileges on Windows 10 and 11. It's unreliable by the researcher's own account — hit or miss — and doesn't work on Windows Server, though he claims a redesigned version would.
It's the latest salvo in a months-long feud that began in April with BlueHammer (CVE-2026-33825). Microsoft patched that one within the month and attackers exploited it anyway; there's no sign yet of RoguePlanet being used in the wild.
The researcher claims to have more vulnerabilities in Defender and other Windows components ready to go.
Updated 12 Aug 2026: RoguePlanet was assigned CVE-2026-50656 and patched by Microsoft in July, 29 days after the public exploit appeared.
Source: Dark Reading
A researcher known as Nightmare-Eclipse has released yet another Microsoft zero-day exploit — this one called RoguePlanet — timed to drop right after Microsoft's June Patch Tuesday, which addressed a record 206 CVEs.
The new exploit abuses a race condition in Windows Defender's signature update workflow and, when it lands, spawns a shell with full SYSTEM privileges on Windows 10 and 11. It's unreliable by the researcher's own account — hit or miss — and doesn't work on Windows Server, though he claims a redesigned version would.
It's the latest salvo in a months-long feud that began in April with BlueHammer (CVE-2026-33825). Microsoft patched that one within the month and attackers exploited it anyway; there's no sign yet of RoguePlanet being used in the wild.
The researcher claims to have more vulnerabilities in Defender and other Windows components ready to go.
Updated 12 Aug 2026: RoguePlanet was assigned CVE-2026-50656 and patched by Microsoft in July, 29 days after the public exploit appeared.
Source: Dark Reading
A malware incident on the ICT network at Great Marlow School in Buckinghamshire led staff to shut down parts of the system as a precaution, closing the school to most pupils on Wednesday 10 June. The school can't contact parents and carers through its usual email system, teachers can't set work, and internal exams for Years 10 and 12 have been postponed. Only Year 11 and 13 students are in, for external exams.
The school says it is working with cybersecurity professionals to restore normal operations, following guidance from the Department for Education and the National Cyber Security Centre. Headteacher Guy Pendlebury said the safety and wellbeing of students, staff and the wider school community "remain our highest priority at all times." The school, famously attended by Olympic rower Steve Redgrave, also cancelled a Year 7 rowing lesson.
Source: BBC News
A malware incident on the ICT network at Great Marlow School in Buckinghamshire led staff to shut down parts of the system as a precaution, closing the school to most pupils on Wednesday 10 June. The school can't contact parents and carers through its usual email system, teachers can't set work, and internal exams for Years 10 and 12 have been postponed. Only Year 11 and 13 students are in, for external exams.
The school says it is working with cybersecurity professionals to restore normal operations, following guidance from the Department for Education and the National Cyber Security Centre. Headteacher Guy Pendlebury said the safety and wellbeing of students, staff and the wider school community "remain our highest priority at all times." The school, famously attended by Olympic rower Steve Redgrave, also cancelled a Year 7 rowing lesson.
Source: BBC News
Two Russia-linked hacker groups — Gamaredon and Shadow-Earth-066 — are actively exploiting a WinRAR vulnerability (CVE-2025-8088) that WinRAR patched in version 7.13 back in July 2025, targeting Ukrainian military and government organizations through weaponized phishing emails. Trend Micro, which tracks the campaigns, notes Sandworm, Turla and Void Rabisu have weaponized the same flaw.
The attacks differ in execution but share the same goal. Shadow-Earth-066 deploys the GiftedCrook stealer to harvest credentials, browser cookies and documents, while Gamaredon spear-phishes from compromised government accounts to plant espionage malware via malicious HTA files. Both abuse the path traversal flaw to write payloads into Windows Startup folders using NTFS alternate data streams.
The flaw stays dangerous because WinRAR doesn't auto-update, doesn't support Group Policy, and falls outside tools like WSUS and SCCM — leaving millions of endpoints exposed. Version 7.13 or later fixes it.
Source: Dark Reading
Two Russia-linked hacker groups — Gamaredon and Shadow-Earth-066 — are actively exploiting a WinRAR vulnerability (CVE-2025-8088) that WinRAR patched in version 7.13 back in July 2025, targeting Ukrainian military and government organizations through weaponized phishing emails. Trend Micro, which tracks the campaigns, notes Sandworm, Turla and Void Rabisu have weaponized the same flaw.
The attacks differ in execution but share the same goal. Shadow-Earth-066 deploys the GiftedCrook stealer to harvest credentials, browser cookies and documents, while Gamaredon spear-phishes from compromised government accounts to plant espionage malware via malicious HTA files. Both abuse the path traversal flaw to write payloads into Windows Startup folders using NTFS alternate data streams.
The flaw stays dangerous because WinRAR doesn't auto-update, doesn't support Group Policy, and falls outside tools like WSUS and SCCM — leaving millions of endpoints exposed. Version 7.13 or later fixes it.
Source: Dark Reading
A phishing email in September 2020 gave attackers a foothold in South Staffordshire Water that went undetected for 20 months. Between August and November 2022, more than 4.1 terabytes of data belonging to 633,887 people appeared on the dark web — customers' bank details and staff National Insurance numbers among it.
Chris Durham, 53, from Halesowen, had two phone contracts taken out in his name, including an expensive iPhone shipped to north-east London. His £14-a-month PAYG account started being debited £60, and it took months to get the money back. "I was frustrated, stressed and violated. I was robbed," he said. Nigel Calladine, 75, changed his email address and bank accounts entirely after six months of phishing.
The ICO fined South Staffordshire £963,900 under a voluntary settlement, reduced by 40% after the company admitted liability early and agreed not to appeal. The firm says it placed dedicated advisors during the incident, offered free credit monitoring, and has since invested significantly in its cyber resilience. Calladine isn't convinced: "The people who pay the fine are the people who were hacked, so the customer loses out twice."
Source: BBC News
A phishing email in September 2020 gave attackers a foothold in South Staffordshire Water that went undetected for 20 months. Between August and November 2022, more than 4.1 terabytes of data belonging to 633,887 people appeared on the dark web — customers' bank details and staff National Insurance numbers among it.
Chris Durham, 53, from Halesowen, had two phone contracts taken out in his name, including an expensive iPhone shipped to north-east London. His £14-a-month PAYG account started being debited £60, and it took months to get the money back. "I was frustrated, stressed and violated. I was robbed," he said. Nigel Calladine, 75, changed his email address and bank accounts entirely after six months of phishing.
The ICO fined South Staffordshire £963,900 under a voluntary settlement, reduced by 40% after the company admitted liability early and agreed not to appeal. The firm says it placed dedicated advisors during the incident, offered free credit monitoring, and has since invested significantly in its cyber resilience. Calladine isn't convinced: "The people who pay the fine are the people who were hacked, so the customer loses out twice."
Source: BBC News
A self-replicating worm called Shai-Hulud has infected over 100 packages across NPM and PyPI since September 2025, with attacks sharply escalating in recent weeks. After hacking group TeamPCP released the worm's source code in mid-May, clones emerged fast — Socket, Snyk, Sonatype, Ox Security and others have been tracking the fallout since.
The latest variants — Miasma and Hades — harvest credentials, API keys and tokens, then spread by infecting packages the victim can access. Miasma drops via weaponized binding.gyp files during npm install; Hades uses -setup.pth files to run at Python startup, pulling in the Bun runtime to execute. Red Hat's Hybrid Cloud Console lost 32 JavaScript packages, alongside the Vapi server SDK and wrangler-deploy, with Hades leaning on bioinformatics, graph ML and MCP-themed packages.
In total, 471 malicious artifacts have been identified. If you've installed anything from these ecosystems recently, rotate your npm, PyPI and cloud credentials — the worm spreads using what it steals.
Source: SecurityWeek
A self-replicating worm called Shai-Hulud has infected over 100 packages across NPM and PyPI since September 2025, with attacks sharply escalating in recent weeks. After hacking group TeamPCP released the worm's source code in mid-May, clones emerged fast — Socket, Snyk, Sonatype, Ox Security and others have been tracking the fallout since.
The latest variants — Miasma and Hades — harvest credentials, API keys and tokens, then spread by infecting packages the victim can access. Miasma drops via weaponized binding.gyp files during npm install; Hades uses -setup.pth files to run at Python startup, pulling in the Bun runtime to execute. Red Hat's Hybrid Cloud Console lost 32 JavaScript packages, alongside the Vapi server SDK and wrangler-deploy, with Hades leaning on bioinformatics, graph ML and MCP-themed packages.
In total, 471 malicious artifacts have been identified. If you've installed anything from these ecosystems recently, rotate your npm, PyPI and cloud credentials — the worm spreads using what it steals.
Source: SecurityWeek
A threat group called Silent Ransom (also tracked as UNC3753, Luna Moth and Chatty Spider) has been hitting US law, financial and professional services firms with a slick social engineering campaign between January and May 2026, according to Google's Mandiant division.
The attacks start with a clean invoice email — no malicious attachment — followed by a phone call from someone posing as internal IT or security. Victims are talked into a Zoom or Teams screen-share and into installing AnyDesk, Zoho Assist or similar remote access tools. The FBI warned separately in May that group members have also shown up at offices in person, posing as IT staff to reimage machines while plugging in USB drives to take data directly.
Once inside, the group moves fast — sometimes from initial contact to extortion demand in under an hour, with demands arriving within 30 minutes of the data being taken. Ransom notes come with a three-day deadline and threats to notify employees, partners and customers, and to go public.
Mandiant's advice: train staff on vishing, tighten conditional access for remote sessions, and lock down which RMM and screen-sharing tools can run at all.
Source: Dark Reading
A threat group called Silent Ransom (also tracked as UNC3753, Luna Moth and Chatty Spider) has been hitting US law, financial and professional services firms with a slick social engineering campaign between January and May 2026, according to Google's Mandiant division.
The attacks start with a clean invoice email — no malicious attachment — followed by a phone call from someone posing as internal IT or security. Victims are talked into a Zoom or Teams screen-share and into installing AnyDesk, Zoho Assist or similar remote access tools. The FBI warned separately in May that group members have also shown up at offices in person, posing as IT staff to reimage machines while plugging in USB drives to take data directly.
Once inside, the group moves fast — sometimes from initial contact to extortion demand in under an hour, with demands arriving within 30 minutes of the data being taken. Ransom notes come with a three-day deadline and threats to notify employees, partners and customers, and to go public.
Mandiant's advice: train staff on vishing, tighten conditional access for remote sessions, and lock down which RMM and screen-sharing tools can run at all.
Source: Dark Reading
A ransomware attack has forced Evanston Township High School to close its campus, canceling summer school, sports camps and all on-campus activities. The attack, discovered on the night of Sunday 7 June, knocked out phone lines, internet, computers, email and student accounts, and even the school's emergency notification and PA systems.
The FBI is investigating alongside cybersecurity attorneys and forensic experts. No ransom demand has been received. Staff were told to work from home Monday, with the campus shut through Tuesday and due to reopen Wednesday 10 June. Google passwords for employees have already been reset as a precaution.
District leadership says it is still working out what information the attackers may have accessed.
Source: CBS News Chicago
A ransomware attack has forced Evanston Township High School to close its campus, canceling summer school, sports camps and all on-campus activities. The attack, discovered on the night of Sunday 7 June, knocked out phone lines, internet, computers, email and student accounts, and even the school's emergency notification and PA systems.
The FBI is investigating alongside cybersecurity attorneys and forensic experts. No ransom demand has been received. Staff were told to work from home Monday, with the campus shut through Tuesday and due to reopen Wednesday 10 June. Google passwords for employees have already been reset as a precaution.
District leadership says it is still working out what information the attackers may have accessed.
Source: CBS News Chicago
