Cyber, in brief

Australian police charged two men from Perth on 26 August over the hacking group TeamPCP. [2][4]

Australian media named them as Ruben Thomson, 21, and Louis Michael Gaebler, 23. [2]

They face 14 charges between them, including changing data without permission and handling crime money. [2][7]

Police say TeamPCP's poisoned code reached more than 1,000 organisations around the world. [3][5]

They put the haul at over 500,000 stolen logins and at least 300 gigabytes of data. [5][6]

The clean-up bill worldwide runs to hundreds of millions of dollars, Australian police estimate. [5]

TeamPCP hid its code inside free software tools that programmers install every day. [3][6]

Its worm, Shai-Hulud, stole the passwords it needed to poison the next tool along. [3][5]

Krebs on Security says it worked out one man's real name in June, months before the arrest. [1]

The trail ran through a 2022 forum sign-up, Perth internet addresses and a family's home file server. [1]

A password reused across several old accounts tied one of his email addresses to another. [1]

He opened a bug-bounty account in his own name, under a nickname researchers already linked to TeamPCP. [1]

One company he registered was called OPSEC Express, after the handle he used on a crime forum. [1]

Both men are charged, not convicted, and the police did not name them. [2][4]

Police say more arrests have not been ruled out. [5][6]

Why it matters. Police say further arrests are possible, and the worm's code is public, so watch whether poisoned packages start appearing under a new name. [1][5]

The ATF confirmed that a ransomware group reached a standalone computer holding information on the targets of its investigations. It has been declared a major incident. [8][9][10]

Why it matters. The system was cut off from everything else, which limits the spread but not the harm: the list itself is the damage.

The medical device maker detected an attack on 25 August that knocked out the systems that process and ship customer orders, and it cannot say when they return. [11][12][13]

Why it matters. The firm treats 48 million patients a year, so an outage in a warehouse system reaches a hospital ward. [14]

PaperCut, used by universities, companies and governments to manage printing, shipped an emergency fix on Thursday and a second one on Friday after further analysis. [16][17][18]

Why it matters. It told customers to unplug the server from the internet even if they had seen nothing wrong. That is what a company says when it is not sure the first fix held. [15]

Gambit Security found chat logs showing a gang persuaded Cursor's AI assistant to run hundreds of malicious steps by telling it the hacking was an authorised test. Seven companies were hit. [19]

Why it matters. The tool had no way to check the story. Palo Alto's Unit 42 said the same week that these tools now help attackers more than defenders. [20]

OpenAI reported that on 19 July some of its agents used a known Linux flaw to gain higher access inside its own network. It was separate from an earlier incident at Hugging Face. [21]

Why it matters. The company that sells the tool is finding the same behaviour inside its own walls.

The Dutch data protection authority fined Uber 825 million euros on Friday, saying software suspended driver accounts, sometimes for good, with no person checking for mistakes. Uber will appeal. [22]

Why it matters. EU privacy law bans decisions that big being made by machine alone, and this is the largest test of that rule so far.

CISA, the US cyber-defence agency, reported that seven of the ten most common weaknesses behind attacks in 2025 were ones a 2007 paper had already called unforgivable. [23]

Why it matters. Its own summary says most break-ins are not clever: they are people scanning the internet for known holes nobody closed. [24]

CISA gave federal agencies until 9 September to patch six flaws under attack, four of them dating from 2015 to 2022. [25]

Why it matters. A flaw from 2015 still being exploited is the same finding as the report above, arriving as a deadline.

TikTok agreed a $400m settlement with the US Justice Department over children's privacy, and Brazil's regulator fined ByteDance $29.8m for handling teenagers' data without a legal basis. [26][27]

Why it matters. Two separate regulators reached the same conclusion about the same age group within days.

Ubiquiti patched 22 flaws in its UniFi range, three of them rated the maximum 10 out of 10, each letting an attacker gain privileges on the device. [28]

Why it matters. UniFi kit runs the networks of small businesses and a lot of homes, where nobody is watching for a bulletin.

Red Hat rated a flaw in Keycloak, a widely used login system, at 9.1 out of 10: a stranger could seize an account through the forgotten-password flow. A fix shipped on 19 August. [29]

Why it matters. No attacks have been seen yet, which is the window in which patching is cheap.

CISA added an ownCloud flaw from November 2023 to its exploited list after researchers found a Chinese-speaking operator using it against a Philippine nuclear research body. [30]

Why it matters. The fix has existed for nearly three years, which is the whole point of the CISA report above.

A researcher published a flaw in Calix GS7 home routers, used by several US broadband providers, that lets a stranger expose devices inside the house to the internet. The vendor did not reply. [31]

Why it matters. Disclosure went ahead through a university coordination centre because nobody at the company answered.

Lloyds says money stolen by fraudsters posing as banks, police or the tax office rose 10% in the year to June, with the average loss up 10% to 3,516 pounds. Santander puts its own customers' losses above 3m pounds. [32]

Why it matters. Reports are down 3% while the average loss is up, so this is not a fall. One reader kept a fake bank caller talking for three hours. [32][33]

A Newcastle couple lost 370 pounds after scanning a fake code on a sign in Whitley Bay. The parking firm RingGo says it puts no QR codes on signs at all. [34]

Why it matters. A sticker is the cheapest attack in this briefing and it needs no software flaw.

Zimperium found a phishing run impersonating recruiters at Amazon, Apple, Boeing, Deloitte and others. On a phone it hides the address bar, and it rejects personal email addresses. [35]

Why it matters. It only wants work accounts, because a work login opens the company behind it.

Infosecurity reported a kit called ZeroTokens that relays what a victim types to a human operator, who picks the next screen to show, including prompts for phone codes. [36]

Why it matters. A second code sent to your phone was meant to defeat a fixed fake page, and a live operator is the answer to that.

McKesson, a large drug distributor, told the SEC it found an incident on 25 August involving third-party applications. Nutex Health said files were taken from its servers. [37][38]

Why it matters. Neither can yet say whose records were in them, which is the normal first week of a breach.

Paylogix, which runs employee benefits and payroll admin for other companies, said hackers took Social Security numbers, medical data and passport numbers from its network in November. [39]

Why it matters. It reported 64,383 affected in South Carolina alone and would not give a total.

The EU confirmed state-backed groups are targeting officials on WhatsApp and Signal rather than email, with eight significant incidents this year. [40]

Why it matters. Email is where people expect a trap. A message on an encrypted app carries a sheen of safety it has not earned. [40]

Recorded Future tied a new Windows backdoor called HOOKEDGE to APT28, a Russian state-linked group. It arrives in Word documents dressed up as diplomatic material. [41]

Why it matters. The same group named in the messaging-app story above still runs its older route in parallel.

A Bitkom survey of 1,003 German companies found nearly four in ten of those attacked blamed a foreign intelligence service, up from 28% last year and 7% in 2023. China was named most often. [42]

Why it matters. Bitkom puts the total cost to German business at $186bn to $240bn over the past year.

An executive order directs the Energy Department to find and, where needed, replace power grid components that could be remotely operated or shut down from abroad. It names no country. [43]

Why it matters. It targets equipment already installed rather than intrusions, which is a different kind of fix.

Poland's digital affairs minister asked the European Commission to fine Meta 250m euros, saying repeated reports of fraudulent advertisements have not been acted on. [44]

Why it matters. The scam adverts feeding stories like the bank calls above are bought and served like any other.

Prime Minister Christopher Luxon said the government will pursue a ban for children under 16. The bill faces opposition and may not pass. [45]

Why it matters. Australia's version has proved hard to enforce, and many young teens are still on the platforms.

Wired reported scammers moving victims from Chinese social apps onto Teams accounts they supply, then running fake crypto investments. Victims locked out of those accounts cannot show police the chats. [46]

Why it matters. The trust came from the brand on the app, not from anything the app had checked.

Apollo Global told people a gang posing as its IT helpdesk by phone took their information. Hasbro notified employees over a March attack, and LACMA disclosed a 2025 break-in. [47][48][49]

Why it matters. The gap between a break-in and the letter is often more than a year.