Breaking News – Cyber Threats (last 6h)
Generated: 2026-07-25 08:00 PDT
- ShinyHunters data leaks fuel $2,000 sextortion email scam
BleepingComputer • 2026-07-25 07:16 • www.bleepingcomputer.com
Threat actors are using email addresses exposed in data breaches leaked by the ShinyHunters extortion group to send sextortion emails demanding $2,000 in Bitcoin. […]
https://www.bleepingcomputer.com/news/security/shinyhunters-data-leaks-fuel-2-000-sextortion-email-scam/ - Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patched Available
The Hacker News • 2026-07-25 05:52 • thehackernews.com
Security firms ThreatBook and Imperva say attackers are targeting a critical flaw in Fastjson, Alibaba’s JSON library for Java. In affected Spring Boot applications, a malicious JSON request can execute code without authentication, with the privileges of the Java process.Tracked as CVE-2026-16723, the vulnerability carries an Alibaba-assigned CVSS score of 9.0. The confirmed chain requires
https://thehackernews.com/2026/07/fastjson-1x-rce-vulnerability-targeted.html - Researcher Publishes GitLab RCE PoC Letting Authenticated Users Run Commands as Git
The Hacker News • 2026-07-25 03:14 • thehackernews.com
Security researchers at depthfirst published working exploit code on July 24 for a GitLab flaw that GitLab patched six weeks earlier, on June 10. It runs commands as git on any self-managed 18.11.3 server that has not taken the update.Any authenticated user who can push to a project can run it. The attacker commits a crafted Jupyter notebook and opens its commit diff, which leaks a heap
https://thehackernews.com/2026/07/researcher-publishes-gitlab-rce-poc.html - CTM360 Research Reveals How Insurance Phishing Has Evolved Into Real-Time Account Hijacking
The Hacker News • 2026-07-25 03:14 • thehackernews.com
For years, phishing campaigns targeting financial institutions followed the same playbook. Victims were tricked into entering usernames and passwords, attackers collected the credentials, and accounts were compromised later when an opportunity arose.That model is changing.
Recent investigations into insurance-focused phishing operations reveal a more immediate approach. Instead of harvesting
https://thehackernews.com/2026/07/ctm360-research-reveals-how-insurance.html - Cl0p Affiliates Target Internet-Exposed PTC Windchill and FlexPLM with Unauthenticated RCE
The Hacker News • 2026-07-25 03:14 • thehackernews.com
Threat actors linked to the Cl0p (aka Chubby Scorpius, FIN11, Graceful Spider, and Lace Tempest) ransomware campaign are exploiting flaws in internet-exposed PTC Windmill and FlexPLM deployments as part of a new data extortion campaign.“Attackers chain a pre-authentication information disclosure in the FlexPLM WSDL endpoint with a server-side flaw in the Windchill login servlet, enabling
https://thehackernews.com/2026/07/cl0p-affiliates-target-internet-exposed.html - DevMan RaaS Portal Centralizes Payload Builds, Victim Management, and Affiliate Payouts
The Hacker News • 2026-07-25 02:53 • thehackernews.com
The operators of the DevMan ransomware-as-a-service (RaaS) scheme are maintaining a dedicated web platform that offers affiliates the ability to build payloads, oversee earnings, and manage various aspects related to victims.Swiss cybersecurity company PRODAFT is tracking the centrally administered RaaS operation under the name Funky Mantis.
“The portal combined build generation, finance,
https://thehackernews.com/2026/07/devman-raas-portal-centralizes-payload.html - OpenAI confirms ChatGPT is down worldwide
BleepingComputer • 2026-07-25 02:31 • www.bleepingcomputer.com
ChatGPT, the famous artificial intelligence chatbot that allows users to converse with various personalities and topics, has connectivity issues worldwide. […]
https://www.bleepingcomputer.com/news/artificial-intelligence/openai-confirms-chatgpt-is-down-worldwide/
Sources: BleepingComputer, The Hacker News, KrebsOnSecurity, SANS ISC, CISA.
