Ransomware Activity
17 victims across 7 groups in the past 48 hours. Healthcare and CNI flagged below.
Booba Project — 6 victims
⚠️ Pearland Pediatrics (US, Healthcare), ⚠️ Chicago Vein Institute (US, Healthcare), ⚠️ Coastal Carolina Neuropsychiatric Center (US, Healthcare), ⚠️ City Hall – Everett MA (US, Government), ⚠️ City of Mt. Angel OR (US, Government), Research Foundation of CUNY (US, Education).
SilentRansomGroup — 3 victims
Three redacted identities — consistent with active negotiations.
Dark Project — 2 victims
⚠️ Asensus Surgical (US, Surgical Robotics / Healthcare), The Excalibur Group (US).
N0n — 2 victims
51Ridge (US, IT Hosting — Newark NJ), Company #98 (Ethiopia).
Mimori — 2 victims
OpenText (Canada, Enterprise Software), ⚠️ Aveva 🇬🇧 (UK, Industrial Software — SCADA/HMI for CNI sectors globally).
Global Secret Group — 1 victim
Graves Fireplaces, Inc. (US, Manufacturing).
INC Ransom — 1 victim
centralrogers.com (US).
Security News
PHP — two critical emergency patches imminent
Maintainers warn vulnerability details have leaked early, accelerating the release. All PHP administrators should patch immediately on release.
AOMEI Backupper supply chain attack — ShinyRoad backdoor
Update servers compromised April–July 2026 to serve the ShinyRoad modular backdoor in short burst windows. Company has not yet notified customers. (The Record)
eMudhra CA keys compromised — one was the number 4
Indian CA with 60M+ issued certs had trivially simple private keys stolen. All eMudhra certificates must now be treated as untrusted. Major clean-up required. (The Register)
OVHcloud CLI backdoored on GitHub
Attackers compromised OVHcloud's open-source CLI tool releases to distribute info-stealing malware targeting developer secrets. (BleepingComputer)
UpdraftCentral keys stolen — WordPress sites at risk
TeamUpdraft website breached; stolen connection keys allow attackers to send arbitrary commands to connected WordPress sites. Rotate keys immediately. (BleepingComputer)
SafePay ransomware — CISA/FBI/NCSC/BSI joint advisory, 600+ victims
Among the most active ransomware groups since August 2024. Gains access via password spraying, vuln exploitation, and phishing. See CISA advisory AA26-293A for TTPs and IOCs. (The Record)
Lazarus Group — Operation FlashHole targets South Korea
Updated malware chain combining legacy and new tooling. Follows Operation SyncHole (2025). (Securelist / Kaspersky)
APT28 compromises NATO defence contractors
Russia's Fancy Bear used a newly documented backdoor to achieve persistent access in defence and law enforcement networks across two NATO members. (The Record)
Cairn AI pen-test platform abused — 100+ organisations breached
At least three threat actors weaponised the Cairn AI penetration testing tool against John Deere, SharkNinja, Cummins, and 100+ others. (Dark Reading / SecurityWeek)
Ahold Delhaize — restoring services
European sites largely restored. US brands (Stop & Shop, Giant Food, Food Lion) expected online within days. (SecurityWeek)
UK-Relevant
⚠️ Aveva 🇬🇧 — Mimori ransomware victim
Aveva (Cambridge, UK) — industrial software developer for SCADA, HMI, and process simulation used in CNI globally — appears on Mimori's victim list. Asset owners relying on Aveva platforms should review vendor communications and monitor for supply-chain indicators.
FCA extends incident reporting to AI failures
The UK Financial Conduct Authority now requires firms to report significant AI failures and near-misses, recognising autonomous AI as a new category of operational risk.
NCSC — new AI chapter in research problem book
New blog post from NCSC identifies open research challenges at the intersection of AI and cyber defence.
Breaches
No new entries to HaveIBeenPwned in the past 48 hours.
CISA
New advisory: #StopRansomware: SafePay Ransomware (AA26-293A) — joint advisory from CISA, FBI, NCSC, and BSI. 600+ victims since August 2024. Covers TTPs, indicators of compromise, and mitigations.
No new additions to the Known Exploited Vulnerabilities catalogue in the past 48 hours.