Download MP3 · 7:14 · 6.6 MB
Security News
Binance Replenishes 90% of Stolen Funds — Pledges Full Coverage
Binance co-CEO Richard Teng confirmed the exchange has replaced 90% of the stolen $6.3 billion using its SAFU protection fund and emergency industry reserves. Withdrawals to resume Sunday. No users will bear losses. The recovery speed is unprecedented — the endpoint security gap that enabled it remains unresolved. (Slashdot)
Critical Linux TCP Use-After-Free — CVE-2026-98432 (CVSS 9.8)
A use-after-free vulnerability in the Linux IPv4 TCP stack allows potential remote code execution. Second critical Linux kernel CVE this week after the MPTCP flaw. Prioritise patching for internet-exposed Linux systems. (atlasum.net)
VOLTA Infostealer Uses LLM to Rank Victims by Value
Cisco Talos analysis reveals VOLTA sends stolen credential bundles to an LLM and prompts it to rank victim assets by monetisation value. If the first model refuses, it retries with another. AI-powered victim triage embedded in a live malware implant. (Cisco Talos)
Android SMS of Death — CVE-2026-58882 PoC Released
Proof-of-concept exploit published for an Android vulnerability that crashes or disrupts cellular service via a crafted SMS, requiring zero user interaction. Exploitation in the wild expected imminently. Apply latest Android security updates now. (BleepingComputer)
Northflank Breach — AI API Keys Abused 🇬🇧
UK cloud hosting platform Northflank confirmed a breach after a customer reported unauthorised use of their AI service API keys. All stored credentials and secrets should be treated as compromised and rotated immediately. (BleepingComputer)
Chainalysis Breach — Offensive Agentic Techniques Used
Blockchain analytics firm Chainalysis suffered unauthorised access via agentic attack methods. Customer names, emails, user IDs, and organisation roles exposed. No investigation content or wallet data accessed. (BleepingComputer)
AI Startup Accesses Anthropic Employee Data
An AI startup reportedly gained unauthorised access to Anthropic employee details and internal messages during a 12-hour window. Anthropic is investigating scope separately from the Cursor extension incident. (India Today)
Molly Signal Fork — Unpatched Vulnerabilities, 3 Months Without Update
The hardened Signal fork Molly has not received a security update in over three months and contains unpatched upstream vulnerabilities. Switch to standard Signal until the project catches up. (PieFed)
Ransomware Activity
40 new victims · 16 groups · 48 hours
Emperador
- Holcim 🇨🇭 Manufacturing — Global construction materials giant (70+ countries, ~$29B revenue). Significant if confirmed.
- Punta Shopping 🇧🇷 Retail
- Studio Stelitano e Associati 🇮🇹 Professional Services
Safepay (9 victims — most active)
- Rood Trucking 🇺🇸 Transportation ⚠️
- Jumonji University (jumonji-u.ac.jp) 🇯🇵 Education ⚠️
- UAA (uaa.mx) 🇲🇽 Education ⚠️
- goldencrops.com.tw 🇹🇼 Agriculture · mars-semi.com.tw 🇹🇼 Manufacturing · layam.com 🇮🇱
- quevedo-ponce.com 🇪🇨 · grifosespinoza.com 🇵🇪 · everon.com.ar 🇦🇷
SilentRansomGroup (5 victims) — Legal Sector Campaign
- ArentFox Schiff LLP 🇺🇸 Legal (major national firm — 3rd major US law firm this week)
- Moritt Hock & Hamroff LLP 🇺🇸 Legal
- 3 redacted victims (countdown timers active)
Payload (Germany focus)
- SALEG (Sachsen-Anhalt State Development Co.) 🇩🇪 Government ⚠️ — 147GB claimed
- Kraft Lernen 🇩🇪 Education ⚠️ — 67GB claimed
- Stanze Garden Center 🇩🇪
Rhysida
- Phoenix Charter Academy 🇺🇸 Education ⚠️ — 50GB, student data
- Cipsa Industrias 🇲🇽 Manufacturing
Wallstreet
- Suburban Orthopaedics 🇺🇸 Healthcare ⚠️
AuditTeam (4 masked victims)
4 redacted entries, undisclosed sectors.
Other Groups
- Whitearmor: KTU Shipyard 🇵🇭 Maritime ⚠️, Gamdom V2
- TheGentlemen: Bi Link 🇺🇸, NOVADATA 🇦🇷, CommTank 🇺🇸
- Vexy Ransomware: JHAMF Group 🇧🇩, System Soft 🇧🇬
- Incransom: Staver Accident Injury Lawyers 🇺🇸 Legal
- Sarcoma: Ivan Smith Furniture 🇵🇭
- N0n: Digital Triumph 🇲🇾
- Everstake: sp*****g.com (masked)
- Doommageddon: A***** T****** (deadline approaching)
- Nightspire: **F*A *.A (masked)
From Threat Feed
- Interlock: Meadows Valley School 🇺🇸 Education ⚠️ (50GB), Ridgway School District 🇺🇸 Education ⚠️ (150GB)
- Qilin: Danser Inc. 🇺🇸 Machinery, Community Medical Center 🇺🇸 Healthcare ⚠️
- Barracuda: Evinoks 🇹🇷 Furniture (1.56TB)
Threat Feed Highlights
Apollo.io — 249M Records Claimed
B2B sales intelligence platform Apollo.io has a claimed leak of 249 million records covering professional contacts, company firmographics, and account data. Unverified, but if accurate would represent a major resource for spear-phishing and business email compromise operations globally.
Zone de Secours Hainaut-Est — Belgian Emergency Services Breach
Emergency services zone in Belgium reportedly suffered a data breach. Emergency services personnel data carries elevated risk of targeted harassment or physical harm.
AnyDesk Infrastructure Access for Sale
Threat actors advertising live remote access sessions into AnyDesk Software's own infrastructure in Germany. AnyDesk is widely used for IT support; compromise of its infrastructure creates downstream risk for customers.
France OT/ICS Exposures
Claims of unauthorised access to a live manufacturing telemetry dashboard (automated beer bottling line) and a WATER02 smart irrigation control system in France. ICS and OT exposure via public internet continues to appear regularly in the threat feed.
Moldova Social Insurance House — Cyberattack, Services Disrupted
National Social Insurance House of Moldova reports services partially unavailable following a cyberattack. Follows last week's Electronic Governance Agency breach exposing 750K national IDs.
Poland Ministry of Justice — Database for Sale
Threat actor claiming to sell a database from Poland's Ministry of Justice.
Telegram 1B+ Records Claim
Threat actor claiming a database from Telegram Messenger containing billions of records. Treat as unverified — Telegram data leaks of this scale are routinely overstated but should be monitored for credential exposure.
CISA KEV
No new Known Exploited Vulnerabilities added in the last 48 hours.
NCSC
No new NCSC advisories published in the last 48 hours.