US Coast Guard is probing a cyberattack that disrupted North Carolina ports

Metacurity is the cybersecurity news you'd need hours to assemble yourself.

Every weekday, we read the releases, filings, court documents, and reports that vendors and PR teams often don't want summarized — then tell you what actually changed and why it matters. Minimum vendor marketing, no outrage bait, no SEO filler.

Metacurity delivers

• Full archive access — every newsletter and AI Watch roundup, searchable and browsable.
• Our weekly curated long-reads roundup — the best cybersecurity writing from across the industry, filtered and vetted so you're not sorting through it yourself,
• Periodic specialized reports and analyses — deep dives that go beyond our daily coverage
• Support for independent, no-spin cybersecurity journalism — funded by readers, not vendors or investors.

Reader support is what keeps Metacurity independent. It allows us to focus on serving the cybersecurity community—not advertisers, vendors, or investors—and to continue delivering the thoughtful analysis you've come to rely on every weekday.

Please consider supporting us. And thank you!

The US Coast Guard's cyber division is leading the federal response to a cyberattack that disrupted information technology systems at the North Carolina State Ports Authority this week, according to a source knowledgeable about port operations, as investigators work to determine whether the intrusion was the work of ransomware operators or a nation-state actor.

The source said the Coast Guard is "running point" on the investigation. While emphasizing that no attribution has been made, the source said early speculation within the maritime community likely focuses on either a ransomware attack or activity linked to Chinese threat actors.

North Carolina Ports confirmed that it had experienced a cybersecurity incident affecting its information technology systems serving the Port of Wilmington, the Port of Morehead City and the Charlotte Inland Terminal. The authority said cargo operations continue but warned customers to expect delays while contingency procedures remain in place.

The ports authority said it detected unauthorized activity on its network, isolated affected systems and launched an investigation with outside cybersecurity specialists and law enforcement. Public statements have not identified the type of malware involved or named a suspected threat actor.

If confirmed, the incident would represent the latest cyber disruption affecting critical US transportation infrastructure and comes as federal officials have spent years warning that American ports are increasingly attractive targets for both financially motivated cybercriminals and foreign intelligence services.

The Coast Guard has assumed an increasingly prominent role in maritime cybersecurity in recent years. In 2025, it issued updated guidance requiring the reporting of cyber incidents affecting the Marine Transportation System, while broader federal efforts have expanded the Coast Guard's responsibilities for overseeing cyber risk at ports and maritime facilities.

Chinese concerns add context

The attack also revives longstanding concerns about China's potential access to US port infrastructure.

In 2023, I broke the news that senior US maritime officials were studying cybersecurity risks associated with Chinese-manufactured ship-to-shore cranes after intelligence and security officials raised concerns that the equipment could provide opportunities for espionage or disruption. The reporting highlighted growing unease inside the federal government over China's dominant position in the global crane market.

Those concerns later became a central element of the Biden administration's maritime cybersecurity strategy. In early 2024, the administration announced a series of actions designed to strengthen port cybersecurity, including a Coast Guard maritime cybersecurity directive, investment in domestically manufactured cargo cranes and additional scrutiny of Chinese-made port equipment.

Although there is no evidence linking the North Carolina incident to Chinese-manufactured cranes or to Chinese government actors, the attack underscores why US officials have spent years attempting to reduce cyber risks across the nation's maritime transportation infrastructure.

North Carolina Ports has not disclosed how the attackers gained access, whether data was stolen or encrypted, or when it expects all systems to be fully restored.

The US Coast Guard hasn't yet responded to my request for comment. (Cynthia Brumfield / Metacurity)

Related: Port Technology, Queen City News, Index Box, WXII, WCNC, WECT, Splash 247

Meta announced a new coding agent, called Muse Code, that it is pitching as a cheaper alternative to competitors.

“We think that for a lot of workflows and a lot of use cases, this can be an incredibly good option, especially from a cost perspective,” Alexandr Wang, Meta’s AI chief, said in an interview. He said some Meta employees are already using it internally and that he expects internal usage to ramp up.

Investors have pressed Meta to show returns from its lavish spending on AI talent and computing power. Shares in the company fell 10% last week following a quarterly earnings call in which Chief Executive Mark Zuckerberg declined to provide new details about the company’s discussions around establishing a cloud-computing service.

Coding agents allow AI users to develop projects and complete software engineering work without having to write code themselves. Anthropic’s Claude Code took off in December, powering the company to a leading position in the AI race, and OpenAI released its own offering, called Codex.

Meta’s Muse Code agent has two price tiers: one that’s the same as its general Muse Spark model and another that is less than one-10th the cost. To access the less-expensive tier, which costs 20 cents per million output tokens, users must agree to provide feedback to help improve the agent. Tokens are the basic unit of artificial-intelligence computing.

Claude Code and Codex come bundled in pricing plans that cost roughly $20 a month, with more expensive plans for increased usage. Exceeding the usage cap switches the user to pay-as-you-go rates. Rates per million output tokens range from $12 for GPT-5.6 Terra and $30 for Sol, with Claude Sonnet 5 at $10 and Opus 5 at $25.

Meta’s new coding agent is priced roughly on par with models from China, such as DeepSeek, that cost as little as 18 cents per million output tokens. OpenAI has also slashed prices on older models, such as GPT-5.6 Luna, which dropped from $6 to $1.20 per million tokens.

Meta overhauled its AI efforts last summer and created a new division called Meta Superintelligence Labs. Wang, the co-founder of ScaleAI, was put in charge of it. (Meghan Bobrowsky and Tina Li / Wall Street Journal)

Related: Gizmodo, CNN, The Hans India, Reuters, Livemint, BBC, Reuters, Benzinga, Business Insider, Business Standard, Cointelegraph, CBS News, RuntimeWire, Bloomberg Law, Al Jazeera, Decrypt, The Information, The Economic Times, The Neuron, Forbes, Simon Willison's Weblog, The Guardian

Meta said one of its AI models hacked another company ​during cybersecurity testing, fanning concerns about how developers can contain increasingly capable AI systems after similar incidents ‌at rivals Anthropic and OpenAI.

The incidents at Meta and Anthropic stemmed from configuration errors that inadvertently gave Anthropic's models access to the open internet. In OpenAI's case, an AI agent independently exploited a previously unknown vulnerability to reach the internet during cybersecurity testing.

The breaches ​highlight growing concerns that advanced AI systems could pose new cybersecurity risks and will likely intensify US government efforts to ​improve AI safety as companies race to develop more capable models. Some prominent AI leaders have argued ⁠that development should slow until stronger safeguards are in place.

Meta said it was investigating an incident in ​which a misconfiguration by Irregular, an independent company that conducts cybersecurity evaluations for Meta, inadvertently gave one of its models internet ​access during a testing.

The model "exploited a security vulnerability in a third-party service, in a manner similar to previously reported instances with other companies," Meta said in a statement.

The Information, citing sources, reported that the model involved was Meta's Muse Spark ​1.1, which the company has touted as its most capable model for real-world coding and agentic tasks. The ​report said the model breached an unidentified company's systems and altered its internal environment.

A spokesperson for Irregular told Reuters the ‌incident ⁠was the "exact same evaluation-environment issue that was already disclosed by Anthropic last week" and did not involve a "sandbox escape or a sophisticated cyber action".

"There are no current open issues. Irregular is developing a white paper to share best practices for containment and securely running cyber evaluations," Irregular said. (Rajveer Pardesi and Mrinmay Dey / Reuters)

Related: Gizmodo, The Information, The Guardian, r/technology, CNN, Simon Willison's Weblog

OpenAI revealed at Black Hat that its autonomous AI hacking agents didn't simply coordinate through direct prompts—they independently discovered and began using an internal message board in the company's Artifactory package repository to communicate, divide work, and improve their attacks without OpenAI initially noticing.

Over days and weeks, the agents exchanged hundreds of thousands of messages, delegated tasks, shared exploitation techniques, warned one another about failed approaches, and even proposed cryptographic signatures to authenticate messages and prevent impersonation.

According to OpenAI researchers Eric Wallace and Michael Dalton, this emergent collaboration wasn't explicitly programmed. The agents were rewarded for accomplishing their objectives efficiently, and they spontaneously developed a coordinated workflow that resembled a team of human penetration testers. The behavior only became apparent after investigators performed a forensic review of logs following the broader Hugging Face incident.

The incident has prompted OpenAI to slow some research while it strengthens monitoring, containment, and automated defensive capabilities. The company argues the episode demonstrates that AI labs need much better visibility into what autonomous agents are doing internally, because sophisticated collaboration can emerge in places developers are not actively watching. (Lily Hay Newman / Wired)

Related:  Engadget, The Guardian, The Register, The Sun, Ground Level AI, Digital Trends, Business Standard, Axios, Politico, AfroTech, RuntimeWire

Canadian national Connor Riley Moucka is facing decades in prison for participating in the hacking of data storage platform Snowflake after pleading guilty to computer fraud, wire fraud, aggravated identity theft, and a related conspiracy in a Washington state federal court.

He will be sentenced on October 27 and is facing up to 32 years in prison.
Moucka and others used stolen login credentials to breach Snowflake and steal troves of information from at least 165 companies. 

The hackers stole billions of files from large companies including AT&T, Ticketmaster, Advance Auto Parts, one of the largest school districts in the US, Neiman Marcus, Santander, LendingTree and more.

The AT&T breach involved the logs of calls and texts to more than 100 million customers. The Ticketmaster breach involved about 560 million users. 
Moucka, from Kitchener, Ontario, was eventually arrested in November 2024 and extradited to the US in July 2025. 

Prosecutors said Moucka and his co-conspirators breached Snowflake between February and October 2024 — allowing them to steal banking records, financial information, Drug Enforcement Administration (DEA) registration numbers, driver’s license numbers, passport numbers, Social Security numbers and more. 

The hackers then attempted to extort victim companies with threats of publishing the stolen information online. The crew earned about $2.5 million in ransom payments, and court documents showed Moucka extorted at least one victim a second time. 

“Moucka used the stolen data of a government officer and members of a then-former government officer’s immediate family in this re-extortion attempt,” prosecutors said. 

Moucka earned another $495,000 by advertising some of the stolen data on cybercriminal forums like BreachForums and XSS.is. Court documents said victim companies suffered about $9.5 million in losses related to the breaches. (Jonathan Greig / The Record)

Related: US Department of Justice, Bloomberg Law, Security Affairs, BleepingComputer, CyberScoop, CityNews Toronto, CBC

OpenAI’s Atlas web browser could have security protections bypassed and be tricked into spamming dozens of WhatsApp contacts or making unauthorized purchases on Amazon, according to new research presented at the Black Hat cybersecurity conference in Las Vegas.

The Atlas findings, from researchers at security firm Zenity, are part of a broad series of flaws the company discovered in leading AI-enabled web browsers and browser extensions, including products from Google, Anthropic, Microsoft, and Perplexity. The researchers found around 20 flaws, which allowed them to access local machines, grab files, take over a password manager, and leak someone’s entire browsing history.

“They have nerfed the security control of browsers—we are now back to seeing the kinds of attacks that you saw on browsers 20 years ago,” says Michael Bargury, cofounder and CTO of Zenity, who is presenting the findings at the security conference with Zenity’s Stav Cohen and other colleagues.

So far, AI web browser integrations have largely come in two forms: dedicated browsers with AI assistants included and extensions that add AI products into existing browsers. These bots can navigate websites for you—summarizing entire pages in seconds, for instance—and setups include agents that can take actions on your behalf, often working across multiple different tabs.

Security alarm bells have rung ever since tech companies started racing to introduce agents into web browsing. As the web is made up of all sorts of untrusted data, exposing that to an AI system can lead it to process malicious instructions and prompt-injection attacks. The attacks are, as OpenAI’s security boss said last year, an “unsolved security problem.” And, as security researchers have repeatedly warned while picking holes in the tools, long-standing web security practices, such as same-origin policy that stops websites interacting with each other, can be made “effectively useless.”

Of all the AI browser tools they probed, Bargury says OpenAI’s Atlas—which the company is shutting down next week—had the most protections and security boundaries in place. However, the researchers could still bypass them to manipulate the system. Other browsing tools were much easier to hack, they say.

In the first proof-of-concept attack, Zenity researchers asked Atlas to sign up to a newsletter link that they posted on X. The malicious webpage containing the sign-up process includes instructions, written in Hebrew, telling the AI to navigate to the user’s signed-in WhatsApp web account and send every contact the same message. The researchers describe it as a “mass phishing campaign.”

The attack—which does not exploit a vulnerability in WhatsApp—works by getting around multiple security mechanisms put in place by OpenAI, Bargury says. A blog post details how the researchers claim to have got past safety measures, including designing a newsletter sign-up page that looked legitimate and not something trying to hack people, writing in Hebrew to dodge English-language security tools, and claiming (falsely) that the system was using a sandboxed version of WhatsApp web with fake people, not the real thing. (Matt Burgess / Wired)

Related: Zenity, Indian Express

Maksim Silnikau, the Belarusian creator and administrator of the Ransom Cartel ransomware, was sentenced to 16 years in prison in the US.

Silnikau built the ransomware operation and recruited other individuals through cybercrime forums, according to documents presented in court.

Silnikau provided Ransom Cartel conspirators with stolen credentials and other information on compromised computers, as well as with tools to encrypt those systems.

Additionally, the court documents show, he maintained a hidden website used to manage and monitor ransomware attacks, communicate with other conspirators and with victims, and manage the distribution of funds between participants.

Between 2021 and 2023, Ransom Cartel targeted at least 18 organizations in the US and abroad, stealing victims’ data and demanding monetary payments in exchange for decryption keys or the promise not to publish the stolen information.

According to the documents presented in court, the Ransom Cartel operation was disrupted when Silnikau was arrested in 2023.

In a separate case, Silnikau was charged with participating in the distribution of Angler (a notorious exploit kit disrupted in 2016 that was widely used for the deployment of malware) and of other malware and online scams. (Ionut Arghire / Security Week)

Related: Justice.gov

Researchers at Arctic Wolf report that a Chinese-built digital spyware tool has evolved into a more all-encompassing surveillance technology that’s in use in more than 13 countries.

Arctic Wolf said that it detected a malicious software platform, called LightSpy, which enables users to pay the company to steal victims’ personal information, including hyper-specific location data, sound recording, chat records, camera and video and screen recording, and more. The technology is also able to completely wipe someone’s personal device, according to Arctic Wolf.

The platform contains pricing tiers, billing infrastructure and branding, according to researchers. The tool also contains a demo environment for prospective buyers, researchers said.

The identity of the LightSpy operators wasn’t clear. Arctic Wolf said the tool was “linked to Chinese nation-state actors.” The company said it was holding discussions with the Department of Homeland Security on the matter and that it would share its findings with the FBI. (Lorelei Smillie / Bloomberg)

Related: UNN

Greece-based cybersecurity researcher Vangelis Stykas, who has spent almost two years inside the systems belonging to a group of those North Korean hackers, is raising the alarm on just how effective and far-reaching the targeting of individual employees and contractors has been in breaching organizations across the globe.

Stykas gained access to North Korean systems 22 months ago; he says he has found evidence that the country’s hacking operations have impacted 1,640 companies across 57 countries. Among these, Stykas will detail at the Black Hat security conference in Las Vegas today, around 700 to 800 of the impacted organizations have had “really damaging” intrusions.

“It’s company access, it’s root access to servers, it’s root access to AWS,” the researcher tells WIRED, referring to Amazon Web Services and the term “root” to mean the highest level of permissions in a computer system. “For crypto companies, it’s keys, it’s blockchain access—it’s ridiculous access.”

Stykas, the CTO at cybersecurity firm Kumio, says he accessed multiple command-and-control servers used by the hackers, though he asked WIRED not to reveal the details of how he gained that access due to the sensitivity of that information. In some cases, he notes, the hackers appeared to have infected themselves with their own malware—which, as a result, gave him access to the hackers’ workstations, too. “I have access to their Slack, I have access to their Discord, I have access to a lot of stuff,” Stykas says, adding he has seen around 5 terabytes of data in total.

As he probed those systems over months, Stykas identified potential victims—by analyzing developer keys, source code, and more—and says he has disclosed the incidents to those impacted. As part of his talk at Black Hat, Stykas is publicly naming around a dozen of the impacted companies—these are, he says, largely the ones that handled the disclosures well and/or fixed possible compromises.

The researcher says these include the Boston Children’s Hospital (which held a vast Covid-19 database of Americans’ personal health data), the large Japanese tech firm AEON Smart Technology, Chinese phone manufacturer Oppo, cryptocurrency firms Coinbase and Uniswap Labs, Italy’s Supreme Judicial Council, a subsidiary of Saudi Arabian bank Al Rajhi Bank, and Digitaal Vlaanderen, part of the Flemish Government in Belgium. (Matt Burgess and Andy Greenberg / Wired)

Related: Android Authority, r/craftofintelligencer, r/pwnhub

Researchers at VulnCheck report that more than 20 models of a Chinese-made router available throughout ‌the world ship with a backdoor that could allow access and potential connections to other devices on the network.

The previously unreported backdoor, dubbed "Endlessdoors" by the researchers ⁠who discovered it, ships in multiple models of routers manufactured and sold by Zbtlink around the world ​under both the Zbtlink and Wiflyer brand names, according to Jacob Baines, the chief technology officer at VulnCheck who ​found the backdoor.

Baines estimates that at least 100,000 such routers are deployed worldwide, although it’s not possible to say exactly where, he said, or how many are active in the US. (AJ Vicens/ Reuters)

Related: VulnCheck, The Register, Organiser, CNET

China launched a formal security review of products sold in the country by US technology firm Palo Alto Networks, ramping up pressure on the company months after accusing it of harboring links to intelligence services.

The Cyberspace Administration of China said that the review was necessary to protect critical infrastructure, citing a pair of national security laws. Shares in Palo Alto Networks fell as much as 4.2% before later paring losses in pre-market trading.

Beijing accused a host of American and Israeli firms, including Palo Alto Networks, earlier this year of being connected to spy agencies, though it didn’t provide evidence of those claims. At the time, a government directive seen by Bloomberg News, which also named Fortinet Inc. and Check Point Software Technologies Ltd., said that Chinese companies’ use of US and Israeli cybersecurity products could result in sensitive data being sent overseas.

Read More: China Bans Cybersecurity Products From Top US, Israeli Firms

The government told Chinese organizations to identify whether they use any cybersecurity products from the designated companies and to replace any of those with domestic technologies by the first half of 2026.

Palo Alto Networks didn’t immediately respond to a request for comment. The company has multiple offices in China, including locations in Beijing, Shenzhen, Shanghai and Guangzhou, according to its website. (Mark Anderson / Bloomberg)

Related: Xinhua

Hackers launched a wave of sophisticated attacks on Wall Street firms in recent days, targeting information systems at major money managers, according to people familiar with the matter.

Point72 Asset Management informed investors that it had been attacked, though the hedge fund’s initial indications were that no client information was stolen, according to one of the people, asking not to be identified discussing non-public information. The firm told investors it was still reviewing the incident, the person said.

Attackers also attempted to infiltrate the information systems at other major hedge funds including Millennium Management, Two Sigma Investments and Citadel as well as several private equity firms as part of the assault, the people said.

The attack featured voice phishing, or vishing, in which cyber criminals use technology to mimic voices in phone calls or messages to trick employees into revealing sensitive information or granting access, the people said, asking not to be identified discussing non-public information.

Two Sigma, which oversees $75 billion of assets, said it thwarted the attempt to access sensitive data. (Hema Parmar, Katherine Burton, and Sridhar Natarajan / Bloomberg)

Related: Reuters, InvestmentNews, Capital Brief, The Economic Times, Financial Times, Insurance Business, Seoul Economic Daily, Crypto Briefing

A suspected Iranian cyber campaign against US water systems is exposing the consequences of years of delayed and defeated efforts to secure one of the country’s most vulnerable critical infrastructure sectors.

At least a dozen states have reported possible attacks to the FBI, and more than 100 municipalities have detected malicious activity involving water systems. The incidents have caused service disruptions, reduced water pressure, manual overrides and precautionary boil-water advisories, although there is no evidence that drinking water has been contaminated.

The attacks follow repeated warnings that many of the nation’s roughly 150,000 public water systems rely on poorly secured, internet-accessible equipment protected by weak or default passwords. In 2023, the Biden administration’s EPA proposed modest cybersecurity requirements, but withdrew them after Republican-led states and industry groups challenged the agency’s authority and argued that smaller utilities could not afford to comply.

Federal agencies have also repeatedly warned that Iranian hackers were probing water and other critical infrastructure. Yet implementation of a 2022 law requiring major cyber incidents to be reported within 72 hours has been delayed, while CISA has faced staffing cuts and a reduced mission.

The current campaign suggests those warnings were not hypothetical. Officials believe Iranian hackers may have gained access sufficient to cause substantially more damage than has occurred so far, including the ability to disable safety alarms and conceal dangerous conditions from operators.

The broader lesson is that the United States was warned for years that its water systems were exposed, failed to impose basic protections, and is now confronting the consequences. (Dustin Volz / New York Times)

Microsoft has announced that its Defender Security solution can detect and stop ransomware attacks on endpoint devices in as little as 128 seconds, or just over two minutes.

The company says this rapid response capability demonstrates the effectiveness of its AI-powered security platform in protecting organizations from increasingly sophisticated cyber threats.

According to Microsoft, the impressive performance was recently demonstrated during a real-world ransomware incident involving QNET, an international marketing company with operations across multiple countries. In a published case study, Microsoft explained how its security tools successfully identified, analyzed, and contained the attack before it could cause widespread damage across the organization’s network.

The company revealed that cybercriminals attempted to compromise QNET’s systems by disguising malicious software as a legitimate Windows utility. Since the application appeared authentic, it had the potential to deceive users into executing it. Once activated, the malware established remote access, allowing attackers to deploy additional malicious payloads designed to spread throughout the network and ultimately encrypt critical files—a hallmark of ransomware attacks.

However, Microsoft Defender detected suspicious behavior almost immediately. Leveraging artificial intelligence, behavioral analytics, and real-time threat intelligence, the platform identified the malicious activity at an early stage. Within 128 seconds, the security system isolated the threat, disrupted the attackers’ actions, and prevented the ransomware from reaching its final objective of encrypting business data.

Microsoft emphasized that Defender’s advanced capabilities extend beyond traditional antivirus protection. The platform continuously monitors endpoints for unusual behavior, correlates data from multiple sources, and uses cloud-powered intelligence to identify emerging threats in real time. This enables security teams to respond to attacks before they can spread across an organization’s infrastructure. (Naveen Goud / Cybersecurity Insiders)

Related: Microsoft, Cyber Security News, Cyber Press

Security researchers Tommy Mysk and Talal Haj Bakry discovered that a series of issues in Apple’s web browser engine — the tech underlying all browsers on iOS — means that Apple’s iCloud Private Relay tool, which is supposed to hide a user’s IP address, in many cases doesn’t actually work.

Instead, the issues mean a malicious attacker can set up a website to learn a Private Relay user’s real IP address, or that many websites have also already collected this information incidentally. The issues also impact OnionBrowser, an iOS app for browsing the web through the Tor anonymity network, the researchers who discovered the issues say.

The Private Relay leak is the second issue to impact Apple’s paid-for privacy products recently. Last month, 404 Media reported a bug in Apple’s Hide My Email feature was actually revealing people’s real email addresses. Apple knew about that issue for more than a year before fixing it. (Joseph Cox / 404 Media)

Related: TechCrunch

The Department of Homeland Security is seeking neighborhood “rapid response” Signal group chats as it defends itself in a lawsuit accusing it of violating protesters’ First Amendment rights, according to recent court filings.

Attorneys for protesters in the case argue that the move itself is a First Amendment violation.

The case, Hilton v. Noem, was filed in federal court in Maine earlier this year. Plaintiffs in the case accuse DHS of violating their First Amendment rights by surveilling their activities. For example, one of the plaintiffs alleges that DHS agents scanned her face and collected her license plate information while she was observing Immigration and Customs Enforcement activity, telling her they were going to put her in a “nice little database.”

According to the filings, Maine residents began organizing together after immigration enforcement activity ramped up in their neighborhoods. This included starting group chats on Signal to share when and where DHS operations were taking place.

As part of the lawsuit, the government was granted discovery. According to a declaration from Genevieve Nadeau, one of the attorneys representing the protesters and special counsel and program lead for Protect Democracy’s Civil Society Defense, the government sought several things. These included a list of all the protests each of the named defendants attended, any communications—including comments or “likes”—reflecting the named plaintiffs’ “beliefs and opinions regarding law enforcement personnel, operations, tactics, and activity,” and any communications concerning “opportunities to observe and/or record ICE activity in Maine, from January 20, 2025, to the present.”

In June, attorneys for the protesters sent a letter to the Department of Justice, saying that they were intentionally withholding all community group Signal chats that would otherwise be considered responsive to the government’s requests.

The attorneys turned over smaller Signal group chats to the court but said in the letter that they had redacted the contact information of people who weren’t plaintiffs in the case, as well as communications that revealed the priorities of a Signal community group chat or might reveal any tactics or strategies used by one.

Attorneys for the government also deposed plaintiffs and tried asking them numerous questions about the community Signal group chats. According to the letter, some of the questions they asked included whether public officials or unnamed political groups were participating in the chats, whether people from outside of Maine were participants, and who the organizers of the chats were. (Maddy Varner / Wired)

Related: Court Listener, Cambridge Analytica, r/USNewshub

According to researchers at FortiGuard Labs, a long‑running supply chain compromise of the QuickFox VPN accelerator that quietly delivered an FDMTP backdoor to carefully profiled Windows systems, exposing a major blind spot in defenders’ visibility where command‑and‑control (C2) traffic never touches traditional DNS.

A VPN proxy and game accelerator popular with overseas Chinese users was weaponized via a trojanized Windows installer that has been active since at least August 2025.

The framework supports rich remote control capabilities via plugins pushed over the FDMTP channel and stored in HKCU\SOFTWARE\Microsoft\IME{HWID}, with operations such as GetInfo, EnumProcessByJson, IsRegistryPlugin, RegistryPlugin, RunPlugin, and StartProcess.

In observed cases, plugins like Assist.dll deployed additional payloads into %LocalAppData%\Microsoft\WindowsApps, but FortiGuard did not see heavy post‑exploitation beyond detailed host enumeration, aligning with espionage‑style staging.

FortiGuard Labs stops short of formal attribution but notes substantial overlap with Darktrace’s independently reported FDMTP campaign, assessed as linked to the China‑nexus cluster known as Twill Typhoon/Mustang Panda. (Mayura Kathir / GBHackers)

Related: Fortinet, PC Mag, Cyberinsider, SC Media

A cyber incident at one of Dutch online retailer Bol's logistics and warehousing partners may have resulted in customer data being accessed or stolen, which followed Dutch luxury department store chain De Bijenkorf reporting that a cyberattack on its logistics provider had disrupted its online operations.

De Bijenkorf did not name the company in its press release, but it has since become clear that the victim of the cyberattack is logistics service provider CEVA Logistics. Bol’s systems were not affected, the online retailer says. However, customer data may have been viewed or copied. Customers are being notified directly about this.

Payment details or passwords were not compromised, though names, addresses, phone numbers, email addresses, and order information may have been. The product range of Bol and its sales partners located at the affected site has been temporarily taken offline, and some orders have been canceled or may be delayed.

CEVA also processes orders for other retailers; however, it is not yet clear whether their customers have been affected. (Stefan Van Rompaey / Retail Detail)

Related: De Bijenkorf, Overbol.com, Iamexpat, Dutchnews.nl, The Record

Australian telehealth provider Updoc has confirmed the contact information of patients may have been accessed by a third party in a data breach.

Updoc confirmed some information of customers had been exposed after “a brief period of unauthorised access to a third-party system that we use to support our operations."

“The access was isolated and involved contact information, which may have included your name, email and postal address,” Updoc said in an email sent to customers. The company insisted its own systems were not accessed in the breach, and that the health and financial information of customers had not been exposed.

“We took immediate actions to block the unauthorised access and can confirm there was no evidence of access after the initial event,” Updoc said.

They told customers that they did not need to take any immediate action, and that they had contacted customers “as a precaution." (Patrick Brischetto / 9News)

Related: 7news, newsGP, News.com, NT News, r/australia

A cyberattack on Poland's largest convenience store chain, Żabka, has exposed internal company systems after attackers allegedly stole corporate data through a third-party contractor's account.

The company confirmed that it detected unauthorized access to technical systems used to communicate with its franchise network late last week and immediately blocked the intrusion. According to Żabka's statement, payment systems, transaction data, the Żappka loyalty app, and day-to-day store operations were unaffected.

"We assure you that the security of transaction data and consumer services, the confidentiality of Żappka app data, and our operational activities remain unaffected," the company said. It has more than 12,800 locations in Poland.

The disclosure came after previously unknown hackers advertised what they claimed was stolen Żabka data for sale on a cybercrime forum for €5,000 ($5,800).

According to the company, the attackers gained access by compromising an account belonging to an unspecified external service provider rather than breaching Żabka's own infrastructure directly. (Daryna Antoniuk / The Record)

Related: Zabka

Switzerland’s Federal Office for Information Technology and Communications (BIT) disclosed that hackers had compromised approximately 200 accounts on its on-premises SharePoint servers.

The agency made the announcement a week after security specialists first detected anomalies on the on-premises Microsoft servers. It did not confirm how the hackers got in but acknowledged several vulnerabilities affecting SharePoint had been identified in July’s Patch Tuesday release.

“The cyberattack was carried out by previously unknown actors, presumably by exploiting these vulnerabilities in the SharePoint software,” the Swiss agency said.

Several of the vulnerabilities have been added to the UD Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog, although neither Microsoft nor CISA have publicly attributed the exploitations to any specific threat group.

The Swiss agency said its initial analyses “have shown no indication that any data beyond the compromised login credentials” was accessed, although it cautioned this analysis is ongoing. It added that “no confidential information or particularly sensitive personal data may be stored on the SharePoint platform.” (Alexander Martin / The Record)

Related: Security Affairs

According to the TTP, an independent watchdog group, over the last nine months, Mark Zuckerberg’s Meta has run dozens of paid ads that include explicit AI-generated child sexual abuse material (CSAM) and images of minors alongside sexually suggestive statements.

More than 50 image and video ads containing abusive content were recently discovered in Meta’s ad library by researchers at the Tech Transparency Project (TTP), with the listings showing that some ads linked out to so-called nudify or undressing apps.

Meta’s ad library—a transparency tool that catalogs ads displayed on the company’s platforms—shows the ads running across Facebook, Instagram, Messenger, and/or Threads. The findings are the second time in recent weeks that paid ads linked to child sexual abuse material have been found on Meta’s platforms. (Matt Burgess / Wired)

Related: Engadget, Digital Trends

Best Thing of the Day: Bugtraq is Back Baby!

Bugtraq, once a place for full disclosure - a mailing list where security researchers could publish vulnerabilities openly, without gatekeepers, without politics - is back.

Bonus Best Thing of the Day: Tim Walz Don't Play

"I don't hide my greater anger about this, because Americans' lives and Americans' economy and America's security is being put at risk by the very individual who started this war and then refuses to help the states in defense of that, and that is simply beyond the pale," Minnesota Governor Tim Walz said regarding Donald Trump's dismissal that Iran hacked over 30 water facilities in his state.

Extra Bonus Best Thing of the Day: The Only Solution to the Flock Problem

The Winona Police Department in Minnesota said all eight of its Flock surveillance cameras, which automatically read license plates and capture other vehicle information, have been stolen.

Extra Extra Bonus Best Thing of the Day: No More Pervert Glasses

Restaurants, pubs and theatres are all banning Meta’s ‘spy glasses’ over privacy fears.

Worst Thing of the Day: These Are the Last People TikTok Should Lay Off

TikTok’s US joint venture is shuttering its Nashville office, a space that housed, in part, members of its content moderation team, and will lay off 250 people.

Closing Thought