60
Week in review: High-severity LPE vulnerability in the Linux kernel, cPanel 0-day exploited for months
60
60
Risky Bulletin: Two TeamPCP members arrested in Australia
Australian Federal Police arrested two alleged TeamPCP members behind supply-chain worm attacks that stole over 500,000 credentials from compromised open-source libraries.
The AFP arrested alleged TeamPCP leader Ruben Thomson, 21, and Louis Gaebler, 23, near Perth; both were charged and remain in custody. The group inserted a self-spreading credential-stealing worm into open-source projects including Trivy, KICS, LiteLLM, and Telnyx, harvesting more than 500,000 credentials used for network access, ransomware, extortion, and sales. About 78,000 tokens and secrets from nearly 2,200 organizations leaked online last month, and the FBI supported the investigation that began in April.
74
60
60
60
60
60
60
60
60
60
Week in review: Axios npm supply chain compromise, critical FortiClient EMS bugs exploited
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
Srsly Risky Biz: Trump's Private Hacker Memo Is the Right Idea
A Trump presidential memo directs DHS to authorize vetted private-sector hackers to conduct cyber operations against foreign cybercriminal groups (CE-TCOs).
A presidential memorandum directs the Department of Homeland Security to establish a program authorizing private companies to conduct cyber surveillance and cyber effects operations against Cyber-Enabled Transnational Crime Organisations (CE-TCOs). Participating companies must pass vetting, obtain government approval before operations, and post a USD $1 million bond. The accompanying fact sheet cites more than USD $20.8 billion in US losses to cyber-enabled crime in 2025. Critics worry about accidental escalation if operations touch foreign government systems.
78
60
60
60
60
60
60
60
60