Cybersecurity

Centcom: US war zone troops were targeted through commercial location data

Canada signals flexibility as tech giants fight surveillance bill, Canadian lands 30 years for child sextortion scheme, Romanian sentenced to 56 months for Oregon gov't, other hacks, Germany and France fight EC's ban of Huawei on cyber grounds, much more

U.S. forces patrol the Arabian Sea near M/V Touska, April 20, 2026, after the Iranian-flagged vessel attempted to violate the U.S. naval blockade. Source: US Marine Corps

Metacurity is the only daily cybersecurity briefing built for clarity, not agendas—no vendor spin, no echo chamber, just sharp, original aggregation and analysis of what actually matters to security leaders.

Each day, Metacurity is read by thousands of cyber leaders, including some of the industry's top CISOs, security architects, practitioners, vendors, analysts, and journalists.

If you rely on Metacurity to cut through the noise on policy, industry shifts, and security research, consider supporting us with a paid subscription. Independent coverage like this only exists because readers decide it’s worth it.

Upgrade my subscription

US forces deployed to war zones have been targeted using commercially available location data, according to reports fielded by military officials, an illustration of how the global surveillance ‌economy is shaping the battlefield.

In a letter to US Senator Ron Wyden (D-OR), US Central Command said it had “received multiple threat reports concerning adversary exploitation of commercial location data to target or surveil U.S. personnel in theater." The message, sent on April 14, offered no further specifics, but Centcom's area of responsibility includes the Gulf, where US forces are facing off against the Iranian military over the Strait of Hormuz.

The disclosure was the first official confirmation that US forces had been targeted in an active war zone, Wyden and a bipartisan group of legislators said in a letter sent ⁠to the Pentagon. (Raphael Satter / Reuters)

Canada said it is willing to address worries raised by some of the world’s biggest technology companies about proposed legislation, Bill C-22, that would give police access to information stored on digital devices.

Senior executives from Apple and Google told Canadian lawmakers this week that the bill making its way through the parliament puts citizens’ privacy and digital security in jeopardy because it might compel companies to change their products to allow invasive surveillance capabilities. US lawmakers, civil-liberties groups, and privacy-law experts have also criticized the legislation.

“We look forward to working in a collaborative manner to ensure that we listen and respond to some of the concerns that have been expressed,” said Gary Anandasangaree, Canada’s Public Safety Minister. “We will respond in kind and ensure the bill … will go forward in a manner that protects” Canadians’ rights.

Speaking to reporters, Anandasangaree dismissed the warnings from Apple and Google that the bill would create so-called back doors to access encrypted data. “I believe there’s a number of areas of misinformation,” he said, adding the bill was “never meant to breach encryption … We will clarify it in the bill.” (Paul Vieira / Wall Street Journal)

Canadian man Ramanan Pathmanathan was sentenced in the United States to more than 30 years in prison for what American officials described as a widespread, years-long sextortion scheme targeting more than 100 children across the country.

He was sentenced in the US District Court to 33 years behind bars after pleading guilty to two separate charges earlier this year.

"This defendant spent years methodically hunting children online. He targeted more than 145 victims, some as young as six, and subjected them to horrors no child should ever experience," US Attorney Jeanine Ferris Pirro wrote in the statement.

Investigators said Pathmanathan, who is from Toronto, primarily used Instagram and Facebook accounts to contact young girls and boys online. He pretended to be a teenage boy from New Jersey online for seven years, the statement said.

Pathmanathan was previously sentenced to 12 years in prison after pleading guilty to similar crimes in Canada in 2022. The new sentence from the US will be served consecutively, meaning the 33-year term will begin after the previous 12 years are up. (CBC News)

Romanian national Catalin Dragomir, who had been found guilty of hacking into an Oregon state government office and other cyberattacks, was sentenced on Tuesday to 56 months in prison.

He pleaded guilty to one count of aggravated identity theft and one count of obtaining information from a protected computer in February.

Dragomir was arrested in Romania in November 2024 and brought to the U.S. last year to face charges for hacking into the network belonging to Oregon’s Office of Emergency Management. He had faced up to seven years in prison.

Using the name “inthematrixl” online, Dragomir typically relied on the dark web to peddle access to networks and services, prosecutors said.

In June 2021, he allegedly placed an ad on a cybercriminal platform for administrative credentials hackers could use to break into the emergency management office.

Dragomir succeeded in selling the credentials after breaching the network on several occasions, sending sample screenshots of the system and sharing login credentials belonging to an employee in the office. (Suzanne Smalley / The Record)

Sources say Germany and Spain are leading opposition to European Commission plans to ban Chinese technology suppliers from telecom networks as part of new cybersecurity rules.

Officials from the countries want to keep state-level control, and have expressed concerns that banning products from Huawei Technologies Co. and other Chinese suppliers at the EU level risks retaliation from Beijing, the people said. The states also warned that a ban risks making the bloc’s plans to build out artificial intelligence infrastructure more expensive, they said.

The commission has labeled Huawei and compatriot ZTE Corp. “high-risk suppliers” for telecom networks, and Brussels has urged member states to exclude the two companies from connectivity infrastructure. (Rodrigo Orihuela, Gian Volpicelli, and Michael Nienaber / Bloomberg)

Korea's Financial Services Commission (FSC), the country's top financial regulator, is stepping up its fight against financial scams by allowing banks to swiftly freeze accounts tied not only to voice phishing, but also to newer forms of fraud, such as romance and investment scams that had previously fallen into regulatory gray areas.

The FSC said it will introduce new guidelines in June that enable closer cooperation between financial firms and law enforcement agencies to quickly suspend accounts suspected of involvement in emerging scam schemes.

The measures were discussed at a meeting chaired by FSC Vice Chairman Kwon Dae-young and attended by officials from the Korean National Police Agency, Korea Financial Intelligence Unit, Financial Supervisory Service, industry associations, and major commercial banks.

The move aims to allow authorities to apply existing laws more proactively to protect potential victims and block the movement of illicit funds. (Park Han-sol / The Korea Times)

Researchers at Secwest and X41 D-Sec report that millions of AI agents and tools around the world have been imperiled by a critical vulnerability that can allow hackers to breach the servers running them and make off with sensitive data and credentials to third-party accounts.

The vulnerability, tracked as CVE-2026-48710 and under the name BadHost, is present in Starlette, an open source framework that its developer says receives 325 million downloads per week. Thousands of other open source projects are also vulnerable because they require Starlette to work. The framework is an implementation of the ASGI (asynchronous server gateway interface), which allows large numbers of requests to be efficiently processed simultaneously. Starlette is the base of FastAPI and other widely used frameworks for building services in Python apps, as well as many others.

ASGI, and by extension Starlette, have access to servers running the MCP (model context protocol), which allows AI agents from major providers to access external sources, including user databases, email and calendar accounts, and all manner of other resources. To connect with these external systems, MCP servers store credentials for each one, making them especially valuable storehouses for attackers to breach.

The vulnerability is trivial to exploit and works against most systems that aren’t behind a properly configured firewall. Besides FastAPI, other widely used packages—including vLLM, and LiteLLM—are also affected. BadHost affects Starlette versions prior to 1.0.1, which was released Friday. (Dan Goodin / Ars Technica)

OpenAI is announcing new partnerships to combat misinformation, offering its cybersecurity products to state officials and backing legislation ahead of elections in the US and globally.

The company is offering its cybersecurity products — Codex Security and its Trusted Access for Cyber program — to registered voting system manufacturers in the US.

OpenAI will provide live vote counts from The Associated Press beginning this fall in the US and Brazil, and is partnering with Democracy Works to display reliable information about voting and registration processes. (Maria Curi / Axios)

Cruise operator Carnival said it had detected a cybersecurity incident involving a compromised account of an employee in April, ‌leading to the leak of certain personal information of individuals, including names, addresses, and government-issued identification numbers.

The company said it quickly blocked the unauthorized activity, which used social engineering to deceive an ⁠employee and gain access to the data. Carnival added that it had hired third-party security experts to conduct a thorough investigation.

Carnival is notifying the affected individuals by email where possible and offering U.S. customers two years of free credit monitoring through TransUnion, with notifications beginning on May 27, Carnival said in the statement. (Anuja Bharat Mistry / Reuters)

Related: Benzinga, Aktien, Bleeping Computer

Everyone is racing to adopt AI. But if your security foundation is weak, AI won’t save you — it will amplify the risk.

That’s the core message behind my just-published new book, The NIST 2.0 Cybersecurity Framework: Practical Risk Management Using Real-World Incidents. Rather than treating cybersecurity as a compliance exercise, the book shows how organizations can build resilient security programs grounded in real operational failures and lessons learned.

Wiley is currently offering Metacurity readers a 20% discount with code ENG20. Don't wait! Order your copy today! Email me to find out about bulk purchases for your organization or special customized print runs for your team.

Order your copy and save 20%

Researchers at Cisco Systems found that none of the closed flagship large language models they tested can be considered safe once an attacker is allowed to push past a single prompt, as adversarial success rates climb sharply across every model in the cohort.

The Cisco AI Threat Research team measured 15 proprietary models from OpenAI Group PBC, Anthropic PBC, Google LLC, Amazon.com Inc., and xAI Corp., putting multi-turn attack success rates between 7.9% and 88.3% across the cohort, against single-turn rates of 2.2% to 64.9% on the same models.

The two regimes did not produce the same model ordering and models that looked strong on the single-turn benchmarks used in model cards and procurement reviews did not necessarily hold up when an attacker could keep talking.

The work is a follow-up to “Death by a Thousand Prompts,” Cisco’s earlier assessment of eight open-weight models, which found multi-turn success rates two to 10 times higher than single-turn baselines and topped out at 92.78% against Mistral AI SAS’ Mistral Large-2. The new study extends the same pattern into the closed, proprietary frontier.

The widest gaps came from xAI’s Grok 4.1 Fast in its non-reasoning configuration, which moved from 34.2% single-turn to 88.3% multi-turn and Google’s Gemini 3 Pro, which rose from 18.1% to 73.4%. OpenAI’s GPT-5.4 climbed from 2.7% to 24.7%, a roughly nine-times increase. Anthropic’s Claude family showed the narrowest gaps, with Claude Opus 4.5 moving from 2.19% to 11.2% and Claude Opus 4.6 from 3.6% to 16.2%.

Amazon’s Nova 2 Lite produced the cleanest inversion in the cohort with a relatively high single-turn rate of 34.1% but the lowest multi-turn rate at 7.9%. The Cisco researchers noted that the result illustrates why single-turn scores alone cannot be treated as a proxy for adversarial robustness. (Duncan Riley / Silicon Angle)

Single-turn versus multi-turn ASR by model, with approximate 95% confidence half-widths on single-turn (upper bar) and multi-turn (lower bar) estimates. Source: Cisco.

A 39-year-old Albanian national known online as “Venom” was extradited to France in mid-May after his arrest last November at his apartment in the Nikaia district of Athens.

The suspect, who described himself as a construction worker and self-taught computer enthusiast, was tracked across three continents before Greek cybercrime officers – accompanied by FBI representatives and French judicial police – raided his home on November 3, 2025.

Australian authorities first mapped his digital footprint in 2022 while targeting developers of Remote Access Trojan (RAT) malware, software that enables remote computer access and data theft. They identified his social media accounts and two Greek mobile numbers before alerting Greek authorities. In June 2023, FBI agents in Los Angeles purchased a monthly subscription to his malware, dubbed VenomRAT, to analyze it. (ekathimerini.com)

Related: Databreaches.net

An unprecedented network attack at Australian hosting giant VentraIP has raised alarms after cybercriminals reportedly usurped Australian home devices to flood the vendor with traffic.

On Saturday morning, the country’s largest privately owned web hosting provider and domain registrar told customers it had identified an ongoing distributed denial-of-service (DDoS) attack against its services.

From approximately 10.30 am to 2.30 pm, VentraIP’s team worked to restore a “partial or complete loss” of service that hindered the availability of several customer websites.

By roughly 5.40 pm, the company confirmed it had tentatively mitigated the attack – but questions remained about how a threat actor managed to send out enough traffic to topple a major vendor.

In a post-incident response on Sunday, VentraIP told customers the attack was largely driven by compromised devices on Australian home internet connections. (Leonard Bernardone / Information Age)

Related: IDM.net.au

The US Cybersecurity and Infrastructure Security Agency (CISA) said this week it will hold a series of virtual town hall meetings June 15-18 to gather stakeholder input on implementation of the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) of 2022.

The agency is working to finalize the rulemaking process for CIRCIA to carry out the law’s mandates.

The town hall meetings, which were delayed earlier this year due to the government shutdown, are intended to give critical infrastructure operators, industry groups, and other stakeholders an additional opportunity to weigh in on the proposed cyber incident reporting requirements before the final rule is issued. (John Curran / Meritalk)

CISA said the meetings will help refine the scope and burden of the proposed regulations while strengthening the nation’s cybersecurity posture.

Related: CISA, Federal Register, Industrial Cyber

Best Thing of the Day: Let's Protect UK Windmills From the Idiots Who Hate Them

The UK government has unveiled a new Energy Sector Cyber Security Strategy to strengthen the protection of Britain’s clean energy infrastructure.

Worst Thing of the Day: Get Ready for Baroque AI Attacks

63% of Dow-30 members are not protected from an attack that uses Claude to create a Claude Team that can end in attackers running arbitrary code on the target’s machine.

Centcom: US war zone troops were targeted through commercial location data

US forces deployed to war zones have been targeted using commercially available location data, according to reports fielded by military officials, an illustration of how the global surveillance ‌economy is shaping the battlefield.

Canada said it is willing to address worries raised by some of the world’s biggest technology companies about proposed legislation, Bill C-22, that would give police access to information stored on digital devices.

Canadian man Ramanan Pathmanathan was sentenced in the United States to more than 30 years in prison for what American officials described as a widespread, years-long sextortion scheme targeting more than 100 children across the country.

Romanian national Catalin Dragomir, who had been found guilty of hacking into an Oregon state government office and other cyberattacks, was sentenced on Tuesday to 56 months in prison.

Sources say Germany and Spain are leading opposition to European Commission plans to ban Chinese technology suppliers from telecom networks as part of new cybersecurity rules.

Researchers at Secwest and X41 D-Sec report that millions of AI agents and tools around the world have been imperiled by a critical vulnerability that can allow hackers to breach the servers running them and make off with sensitive data and credentials to third-party accounts.

OpenAI is announcing new partnerships to combat misinformation, offering its cybersecurity products to state officials and backing legislation ahead of elections in the US and globally.

Cruise operator Carnival said it had detected a cybersecurity incident involving a compromised account of an employee in April, ‌leading to the leak of certain personal information of individuals, including names, addresses, and government-issued identification numbers.

Researchers at Cisco Systems found that none of the closed flagship large language models they tested can be considered safe once an attacker is allowed to push past a single prompt, as adversarial success rates climb sharply across every model in the cohort.

A 39-year-old Albanian national known online as “Venom” was extradited to France in mid-May after his arrest last November at his apartment in the Nikaia district of Athens.

An unprecedented network attack at Australian hosting giant VentraIP has raised alarms after cybercriminals reportedly usurped Australian home devices to flood the vendor with traffic.

The US Cybersecurity and Infrastructure Security Agency (CISA) said this week it will hold a series of virtual town hall meetings June 15-18 to gather stakeholder input on implementation of the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) of 2022.

Best Thing of the Day: Let's Protect UK Windmills From the Idiots Who Hate Them

Worst Thing of the Day: Get Ready for Baroque AI Attacks

Closing Thoughts

Read more

UK spy chief warns of escalating Russian cyber aggression

White House seeks $9 billion AI chip surge for US spy agencies to tap AI models

Losing control of the systems meant to secure society - Best infosec long reads 5/23/26

Trump AI order dramatically collapses after Sacks-led revolt over cyber oversight

US forces deployed to war zones have ​been targeted using commercially available location data, according to reports fielded by military officials, an illustration of how the global surveillance ‌economy is shaping the battlefield.

Canada said it is willing to address worries raised by some of the world’s biggest technology companies about proposed legislation, Bill C-22, that would give police access to information stored on digital devices.

Canadian man Ramanan Pathmanathan was sentenced in the United States to more than 30 years in prison for what American officials described as a widespread, years-long sextortion scheme targeting more than 100 children across the country.

Romanian national Catalin Dragomir, who had been found guilty of hacking into an Oregon state government office and other cyberattacks, was sentenced on Tuesday to 56 months in prison.

Sources say Germany and Spain are leading opposition to European Commission plans to ban Chinese technology suppliers from telecom networks as part of new cybersecurity rules.

Researchers at Secwest and X41 D-Sec report that millions of AI agents and tools around the world have been imperiled by a critical vulnerability that can allow hackers to breach the servers running them and make off with sensitive data and credentials to third-party accounts.

OpenAI is announcing new partnerships to combat misinformation, offering its cybersecurity products to state officials and backing legislation ahead of elections in the US and globally.

Cruise operator Carnival said it had detected a cybersecurity incident involving ​a compromised account of an employee in April, ‌leading to the leak of certain personal information of individuals, including names, addresses, and government-issued identification numbers.

Researchers at Cisco Systems found that none of the closed flagship large language models they tested can be considered safe once an attacker is allowed to push past a single prompt, as adversarial success rates climb sharply across every model in the cohort.

A 39-year-old Albanian national known online as “Venom” was extradited to France in mid-May after his arrest last November at his apartment in the Nikaia district of Athens.

An unprecedented network attack at Australian hosting giant VentraIP has raised alarms after cybercriminals reportedly usurped Australian home devices to flood the vendor with traffic.

The US Cybersecurity and Infrastructure Security Agency (CISA) said this week it will hold a series of virtual town hall meetings June 15-18 to gather stakeholder input on implementation of the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) of 2022.

Best Thing of the Day: Let's Protect UK Windmills From the Idiots Who Hate Them

Worst Thing of the Day: Get Ready for Baroque AI Attacks

Closing Thoughts

Read more

UK spy chief warns of escalating Russian cyber aggression

White House seeks $9 billion AI chip surge for US spy agencies to tap AI models

Losing control of the systems meant to secure society - Best infosec long reads 5/23/26

Trump AI order dramatically collapses after Sacks-led revolt over cyber oversight

US forces deployed to war zones have been targeted using commercially available location data, according to reports fielded by military officials, an illustration of how the global surveillance ‌economy is shaping the battlefield.

Cruise operator Carnival said it had detected a cybersecurity incident involving a compromised account of an employee in April, ‌leading to the leak of certain personal information of individuals, including names, addresses, and government-issued identification numbers.