Cyber Mornings Daily

cPanel weaponized, Weaver RCE exploited, Microsoft phishing surge

cPanel weaponized, SaaS extortion, China-linked espionage

Patch cPanel auth bypass, fix Linux root bug, watch SaaS extortion

Supply-chain credential theft, PyPI package compromise, cross-distro local root exploit

Critical Gemini CLI RCE, SAP npm packages compromised, cPanel zero-day exploited

GitHub critical RCE via single git push, LiteLLM SQL-injection enabling credential theft, and VECT 2.0 ransomware that irreversibly destroys large files.

Supply-chain leaks, GlassWorm extensions, TrueConf exploit chains

Cyber Mornings Daily brings you the latest cybersecurity news, starting with the UK arrests of 'Scattered Spider' teenagers linked to the Transport for London hack and US healthcare attacks, with one suspect facing charges for over 120 global network breaches. We also examine ShinyHunters' claim of 1.5 billion Salesforce records stolen through compromised Salesloft Drift OAuth tokens, along with F...

For today's Cyber Mornings Daily, we're tracking major headlines in digital privacy and online security. French regulators have fined Google $379 million and Chinese e-commerce giant Shein $175 million for violating cookie consent laws, specifically for setting advertising cookies on users' browsers without securing their consent and encouraging choices that favored personalized advertisements. Go...

On today's Cyber Mornings Daily, we discuss Cloudflare's recent mitigation of a record-setting volumetric distributed denial-of-service (DDoS) attack that peaked at 11.5 terabits per second (Tbps), lasting about 35 seconds and primarily originating from Google Cloud. This incident highlights a significant increase in hyper-volumetric DDoS attacks, which rose from 700 in Q1 2025 to 6,500 in Q2 2025...

Welcome to Cyber Mornings Daily! This week, we're covering a range of critical cybersecurity incidents and updates. Jaguar Land Rover recently announced that a cyberattack "severely disrupted" its production and retail operations, forcing the company to proactively shut down certain systems as a mitigation effort. While the automaker stated there is no evidence of customer data theft at this stage...

Recent cybersecurity reports highlight significant vulnerabilities and a proactive defense strategy. One notable incident involved McDonald's McHire job chatbot platform, which exposed chat transcripts and personal data from over 64 million job applications due to a combination of an Insecure Direct Object Reference (IDOR) vulnerability and the use of weak default credentials, "123456" for both lo...

The sources provided discuss two primary topics: recent cybersecurity incidents and advancements in artificial intelligence. One significant cybersecurity event is the ongoing outage at IT giant Ingram Micro, which was caused by a SafePay ransomware attack that led to the shutdown of internal systems. It is believed that the threat actors initially breached Ingram Micro through its GlobalProtect V...

A significant vulnerability found in Google that allowed researchers to brute-force recovery phone numbers for Google accounts, creating a substantial risk for targeted phishing and SIM-swapping incidents. Another key topic is Microsoft Outlook's planned security enhancement to block additional risky attachment types, such as .library-ms and .search-ms files, starting in July 2025, which aims to c...

United Natural Foods (UNFI), a large grocery wholesale distributor, experienced an attack that forced them to take certain systems offline, disrupting customer orders. Kettering Health, a healthcare network, confirmed a breach by the Interlock ransomware group, which stole data, including sensitive patient and personnel information. The Interlock group is noted as a newer ransomware operation that...

The Federal Criminal Police Office of Germany (BKA) has identified Vitaly Nikolaevich Kovalev as the alleged leader of the Trickbot and Conti cybercrime gangs, known for using various malware variants including Ryuk and Diavol, and for infecting hundreds of thousands of systems worldwide to obtain significant funds. This identification follows leaks like TrickLeaks and ContiLeaks which exposed Kov...

These news excerpts focus on recent cybersecurity incidents and legal actions. One article details the FTC's order requiring GoDaddy to improve its security measures following multiple data breaches. Another reports on a system-wide outage at Kettering Health attributed to a likely ransomware attack, forcing canceled procedures. The third piece covers a college student pleading guilty to cyber ext...

One source details a global cyberespionage campaign called 'RoundPress', attributed with medium confidence to the Russian state-sponsored hackers APT28. This campaign targeted government webmail servers in various countries by exploiting XSS vulnerabilities in products like Roundcube, Horde, MDaemon, and Zimbra to steal credentials and email content. Another source describes a new tool named 'Defe...

Android 16 is introducing expanded 'Advanced Protection' with device-level security, strengthening defenses against spyware and consolidating features like verified boot, strong sandboxing, and automatic reboots. The sources also detail a new "Branch Privilege Injection" flaw, tracked as CVE-2024-45332, in modern Intel CPUs that allows sensitive data leakage from privileged memory by exploiting a...

Based on the sources provided, the primary topics covered include a recent data breach affecting over 430,000 patients of the Ascension healthcare system, which was linked to a vulnerability in third-party software used by a former business partner. The sources also detail ongoing cyberattacks targeting SAP NetWeaver servers by Chinese hackers who are exploiting a maximum severity vulnerability th...

Based on the sources, the key topics focus on recent cybersecurity incidents. One significant event detailed is a ransomware attack against Hitachi Vantara, where the company took servers offline to contain the incident attributed to the Akira ransomware operation. Akira has impacted over 300 organizations and collected millions in ransom payments. The sources also describe a Chinese espionage cam...

One major topic is a technical issue at Coinbase where a logging error misidentified failed password attempts as "2FA failures," leading to user concerns about account compromise and potential misuse of these errors in social engineering attacks. Another significant topic is the evolution of the ransomware landscape, specifically the DragonForce group's introduction of a "ransomware cartel" model...

The sources discuss several recent cybersecurity incidents, including how hackers are exploiting Zoom's remote control feature to conduct crypto-theft attacks. This involves social engineering tactics where attackers impersonate legitimate entities to trick users into granting remote access, potentially leading to the theft of sensitive data and cryptocurrency. Additionally, Marks & Spencer confir...

The sources discuss several important cybersecurity topics, including vulnerability management with the active exploitation of a Microsoft NTLM vulnerability (CVE-2025-24054) that could lead to leaked credentials and system compromise. The exploitation requires minimal user interaction and is currently targeting specific organizations, emphasizing the need for immediate patching. Another critical...

One source details a high-severity vulnerability in Cisco Webex that could allow unauthenticated attackers to gain remote code execution through malicious meeting invite links. This article also briefly mentions other security news, including a CISA funding extension for CVE services, Microsoft blue screen issues, and various cyberattacks and vulnerabilities affecting different systems. Another so...