Cyber, in brief

The extortion group ShinyHunters broke into the website that the ransomware gang cl0p uses to publish files stolen from companies. [2]

It began on Friday night by uploading a small text file through a flaw in Grav CMS, the free website software the site runs on. [2]

Hours later the page had been replaced with a picture of the group's Pokemon logo and the line "rooting your systems since '19". [2]

ShinyHunters says it then took cl0p's source code, its system logs, and the private keys for the site's Tor web address. [2]

BleepingComputer confirmed the defacement and the uploaded file, but could not check the claims about the code, the logs or the keys. [2]

Asked what it would do with what it took, ShinyHunters answered: "Going to extort them." [2]

The two fell out over a break-in tool for Oracle's E-Business Suite, the software big firms run their accounts on. [1]

ShinyHunters told Reuters it found the Oracle flaw first and that cl0p stole it last year. [1]

cl0p then threatened to publish the names of several ShinyHunters members, and ShinyHunters threatened to publish how cl0p works inside. [1]

cl0p did not answer repeated messages from Reuters, and its site could not be reached on Sunday. [1]

Reuters said it could not establish whether ShinyHunters' account of the quarrel is true. [1]

Why it matters. Watch whether the stolen company files held on cl0p's site are moved or published by whoever controls the address now, because that would show the claim about the Tor keys was real.

The British carmaker Jaguar Land Rover shut its UK plants through September 2025 after an attack on its computers, stopping production of about 1,000 cars a day. [3] More than 5,000 other companies were caught by the shutdown, and the Bank of England said it helped slow national growth figures. [3] The carmaker has now said it will cut 4,000 jobs and blames the attack. [3] Britain's Cyber Monitoring Centre puts the cost at 1.9 billion pounds and calls it the most economically damaging cyberattack in British history. [3]

Why it matters. It is the clearest price tag yet on a single ransomware attack, and the people losing their jobs had nothing to do with the computers that were broken into.

SolarWinds, whose software many large organisations use to manage their networks, has patched a flaw in Access Rights Manager, the product that controls who may open which files. [4] The flaw, numbered CVE-2026-28326 and scored 8.8 out of 10, comes from a hard-coded static key: the same secret value shipped inside every copy of the software. [4] Anyone who learns it can run their own commands on the server without logging in at all. [4] It affects version 2026.2 and everything before it. [4]

Why it matters. A secret that is identical in every copy stops being a secret the first time one person takes it apart, and every customer is then exposed at once.

CrowdSec, a French security company, says an attacker copied about 170 of its private code stores on 22 May using the account of an employee who had just left, because his access had never been switched off. [5] His laptop had been infected in May's attack on TanStack, in which poisoned versions of popular free code packages stole passwords from developers' machines. [5] The code appeared on an online forum on 16 September, together with the email addresses of 83 CrowdSec users and details of 51 would-be investors. [5] CrowdSec made it public two days later. [5]

Why it matters. Closing a departing colleague's accounts is dull administrative work, and four months passed here between the copying and anyone noticing.

NATS, the company that runs Britain's air traffic control, says the failure that cancelled more than 2,000 flights earlier this month came from a software defect, not an attack. [6][7] Corrupted flight data was produced "in the space of a millisecond" after an aircraft asked for an identification code. [6][7] Chief executive Martin Rolfe said the fault has been traced to a small section of code and a temporary fix is in place. [6] Transport minister Heidi Alexander called the disruption "completely unacceptable" and ordered a review by the Civil Aviation Authority. [6]

Why it matters. Passengers stuck on airport floors are unlikely to be compensated, because the regulator has judged it extraordinary circumstances. [7]

South Korean police investigated 3,506 cases involving stock-tip chat rooms between January and June, covering 336 billion won, or about $246.57m. [8] The number of cases rose only 4.1% on the same months last year, but the money involved was up 19.8%. [8] South Korea's main share index, the KOSPI, was the world's best performer in the first half of the year and then fell as much as 44% from its June peak. [8] Lawyers told Reuters the scammers switched from cryptocurrency and property schemes to share tips to match the rally. [8]

Why it matters. Inexperienced investors afraid of missing a rising market were the ones targeted, and the money lost grew faster than the number of victims.

The US Treasury has sanctioned BitBank, a cryptocurrency exchange linked to the Iranian financier Babak Zanjani, saying it routed hundreds of millions of dollars to Iran's Revolutionary Guard. [9] Treasury also named it as a route for money paid to Iran's newly created Hormuz Safe Marine Services Authority, and sanctioned Pishtaz Simorgh Electronic Trade Company, which wrote BitBank's software. [9] Zanjani was sentenced to death in Iran in 2016 for embezzlement; the sentence was commuted in 2024 and he reappeared the following year backing Iranian state projects. [9]

Why it matters. Sanctions on an exchange are aimed at the plumbing rather than the people, and they only work while banks and exchanges elsewhere check who they are dealing with.

CoinEx, a cryptocurrency exchange based in Hong Kong and launched in 2017, says it will shut down. [10] Founder Haipo Yang said weak markets, thinner trading and rising rules in major countries had "exceeded reasonable boundaries", and that the security and compliance risks of running an exchange had become hard to contain. [10] He said the exchange had millions of users but gave no figure. [10] A June report by the US research firm TRM Labs named CoinEx as the largest single trading partner of Nobitex, an Iranian exchange put under US sanctions that month. [10]

Why it matters. Customers of an exchange that closes have to move their money out on the operator's timetable, and CoinEx did not answer questions about the Iranian link.

Researchers at the security firm OPSWAT found two flaws in TP-Link's Tapo C200, a cheap indoor camera sold for watching homes and pets. [11] One lets somebody already on the same wifi network replay a value from the camera's own security check and get administrator access without knowing the password. [11] The second crashes the camera's secure connection by sending oversized wifi details while it is being set up. [11] TP-Link fixed both, numbered CVE-2026-15315 and CVE-2026-15316, in firmware released in August. [11]

Why it matters. A camera that can be opened by anyone on the home network turns a device bought for reassurance into a window into the room.

NIST, the US standards body, and CISA, the US cyber-defence agency, have published a joint report telling government departments and cloud providers how to protect sign-in tokens. [11] A token is the pass a system hands you once you have logged in, and it keeps working afterwards without asking for a password again, which is why stealing one is now a common way in. [11] The report covers checking tokens, storing secrets and spotting misuse at scale, and it takes in comments on an earlier draft. [11]

Why it matters. Guidance is not a fix, but it sets what a government department can be held to when its cloud accounts are opened with a stolen pass.

The Hacker News's weekly list of fixes worth applying urgently includes eleven separate flaw numbers for Chamilo, a free platform that schools and universities use to run online courses. [12] They were published together by researchers at the security firm Quarkslab. [12] The same list carries urgent fixes for Microsoft Windows, SAP, GitLab, Citrix, Ivanti, Fortinet, FreeIPA and the UEFI Shell, which is part of the startup software in most computers. [12]

Why it matters. A platform holding a school's coursework and pupil accounts rarely has anybody whose job is watching for flaw announcements.

Jersey's Attorney General has returned $667,000, about 495,000 pounds, to the US Department of Justice from a bank on the island. [13] The money had been deposited there by Gustavo Geraldes, who ran a medical fraud in the United States during the pandemic: telemedicine providers authorised genetic tests nobody needed, at laboratories he part-owned, and he paid them for it. [13] He was convicted in April 2022 and ordered to hand over $2.64m traceable to the scheme; the Jersey money counts towards that total. [13]

Why it matters. Money can be followed across borders and clawed back, which is not true of the medical records and personal details taken in most of the other stories here.

Neil Moore, 58, of Newcastle, has been given a one-year sentence suspended for 18 months at Newcastle Crown Court after admitting transferring criminal property. [14] He made more than 37,000 pounds by letting his name be used on fictitious companies set up by Timothy Paul Nellis, who claimed 722,000 pounds in pandemic loans meant to keep businesses alive. [14] Nellis set up 15 fake companies between April and November 2020 and was jailed for almost 18 years in December; a third man, Sundeep Chahal, is still on the run. [14]

Why it matters. A loan scheme designed to pay out in days had almost no checks at the front, so the checking happened years later in a courtroom.

The FBI says it has found 35 more people who lost money to Daejon Love, 35, who prosecutors say spent four years on dating apps pretending to be a wide receiver for the San Francisco 49ers, an American football team. [15] Prosecutors say he persuaded dozens of women to invest with him and spent the money on himself, keeping up the story with a spread of social media accounts. [15] An alleged accomplice, Taylor Chan, 18, is accused of posing as Love's financial adviser and making fake bank documents. [15] Both face wire fraud charges. [15]

Why it matters. The cover story was detailed enough to survive the checks a cautious person actually makes, including a search engine and an AI assistant. [15]

US federal prosecutors charged three people over $12m taken from Southern California homelessness programmes, a week after charging twelve others over more than $10m in childcare aid. [16][17] The three worked for or ran non-profit groups holding public contracts to house and support homeless people. [16] Prosecutors say they paid personal bills from those contracts, took bribes and billed for work never done. [16] In the childcare case, the head of the US tax authority's criminal division said the money went on luxury homes, transfers abroad and large cash withdrawals. [17]

Why it matters. Programmes built to pay out quickly to people in need are the ones with the fewest checks between the application and the money.

A flaw numbered CVE-2026-81480 has been published for Dell OpenManage Server Administrator, the software companies use to watch and control Dell servers from a distance. [18] It is a stack-based buffer overflow, a fault where a program is handed more data than it set aside room for and starts overwriting whatever sat next to it. [18] Dell says an attacker who already holds high-level access and can reach the machine over the network could use it to run their own code. [18] Versions before 11.1.0.3 are affected. [18]

Why it matters. It needs an attacker to be inside already, which is precisely the position everything else in this briefing is about reaching.

Bruce Schneier, a long-standing writer on computer security, has published an essay with the lawyer Cindy Cohn arguing that the mass surveillance built after the attacks of 11 September 2001 should be wound back. [19] They describe a shift from targeted wiretaps to bulk collection of internet and phone records, and say it is now used routinely for immigration enforcement and against protesters rather than for terrorism. [19] They also trace how data gathered by companies for advertising ends up available to police and immigration agencies. [19]

Why it matters. It puts a name on the quiet part of every breach story here: the material stolen from companies exists because it was collected in the first place.