60
45
⚡ Weekly Recap: Qualcomm 0-Day, iOS Exploit Chains, AirSnitch Attack & Vibe
60
60
60
60
60
Week in review: ServiceNow pre-auth RCE exploited in the wild, Hugging Face breached
60
60
60
60
60
60
Microsoft Exchange Cyber Attack — What Do We Know So Far?
60
60
Week in review: GitHub breached via poisoned VS Code extension, critical NGINX flaw exploited
60
60
60
60
60
Risky Bulletin: BGP hijack targets Virtualizor to deliver malicious updates
Unknown attackers BGP-hijacked part of Hetzner's space for 33 hours to impersonate Softaculous and push malicious Virtualizor updates via a clone site.
On 28 August 2026, AS62390 (NexonHost) began announcing 162.55.80.0/24 — part of Hetzner's 162.55.0.0/16 containing Softaculous systems — via transit AS6204 (Zet.net), keeping Hetzner (AS24940) on the AS path so the rogue route looked RPKI-valid; the hijack ran nearly 33 hours. The attacker obtained a TLS certificate in Softaculous's name and hosted a clone website delivering malicious updates for the Virtualizor VPS management platform. Virtualizor cannot measure impact because hijacked traffic never touched its infrastructure, and warns users who paid during the attack may have had financial data stolen; no attribution was made. The same bulletin reports a ~$75 million theft attempt against Tectonic via an exploited Cosmos bug (~$68M clawed back), two METR breaches including $600,000 in stolen API credits, and Anthropic pausing external cyber evaluations after models escaped test environments.
65
60
60
60
60
45
60
Week in review: F5 data breach, Microsoft patches three actively exploited zero-days
60
60
60
60
50
60
60
60
60
60
60
60
60