In Other News: Ransomware Developer Sentenced, Plugin4Shell AI Attack, Critical SAP Flaw
SecurityWeek roundup: ransomware developer sentenced, critical SAP flaw CVE-2026-44756, PhantomRaven npm info-stealer, WordPress mass exploitation, and AI agent security findings.
SecurityWeek's weekly roundup leads with a Zurich court sentencing a Ukrainian developer to nearly 13 years for Lockergoga, MegaCortex, and Nefilim ransomware linked to roughly $123 million in damages. It also covers OVERPASS (CVE-2026-44756), a maximum-severity pre-auth memory corruption flaw in SAP affecting S/4HANA, NetWeaver, and Business Suite, and 100,000+ exploit attempts against a WooCommerce Wholesale Lead Capture plugin flaw. Other items include CrowdStrike tying the LLM-written PhantomRaven npm info-stealer to a bug bounty hunter, Black Axe extraditions, and NIST/CISA guidance on cloud token theft.
- SAP OVERPASS CVE-2026-44756: pre-auth memory corruption, RCE confirmed in lab, emergency patching urged
- WooCommerce plugin flaw enabled webshell uploads; 100,000+ exploit attempts blocked since February
- PhantomRaven npm stealer, likely LLM-written, harvests CI/CD secrets from GitHub Actions and Jenkins
- Zurich court sentenced Lockergoga/MegaCortex/Nefilim developer to ~13 years over ~$123M damages
- Mandiant report cites autonomous agents running intrusions and a worm spreading across ~100 repositories
- Threat actors
- Black AxePhantomRaven
- Malware
- LockergogaMegaCortexNefilim
- Victims
- Stadler Rail
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-15315 | Authentication Bypass via Challenge Validation Flaw in TP-Link Tapo C120/C200 Cameras | 8.7 | <1% | PoC | |
| CVE-2026-15316 | Unauthenticated Input Validation DoS in TP-Link Tapo C200 v5 Configuration Service | 7.1 | <1% | ||
| CVE-2026-44756 | Unauthenticated buffer overflow in SAP Kernel Extended Passport (EPP) processing | 10.0 | <1% |
From the original article
4 min read at securityweek.com
Noteworthy stories that might have slipped under the radar: Mandiant's 2026 AI risk report, PhantomRaven malware used by bug bounty hunter, WordPress plugin bug exploited. The post In Other News: Ransomware Developer Sentenced, Plugin4Shell AI Attack, Critical SAP Flaw appeared first on SecurityWeek.
By SecurityWeek News · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.