TechLogHub Blog — Page 5 of 22
Insights, guides, and product strategy for builders and product teams.
Maine disables data breach notification portal after fake disclosures
Maine has temporarily disabled its public data breach notification portal after fraudulent disclosures were posted, including fake notices involving VRChat and Discord. The Maine Attorney General’s Office confirmed the reports were hoaxes, removed them, and is reviewing procedures to prevent future abuse. While companies can still submit breach notices, the public must request copies directly from the AG’s Office. The incident highlights how automated breach disclosures can be exploited to spread misinformation and damage a company’s reputation.
Ukrainian national pleads guilty to role in Conti ransomware operation
A Ukrainian national extradited from Ireland to the United States pleaded guilty to conspiracy to commit wire fraud in connection with the Conti ransomware operation, admitting to joining the group in September 2021 and possessing data stolen from eight U.S. victims and four overseas victims. He helped code a loader used in attacks and faces up to 20 years in prison. Conti, linked to TrickBot, targeted more than 1,000 victims and collected over $150 million in ransom before disbanding in 2022.
Over 400 Arch Linux packages compromised to push rootkit, infostealer
More than 400 Arch User Repository (AUR) packages were compromised by a threat actor who spoofed a trusted maintainer to push infected updates. The attackers inserted preinstall scripts that download a malicious npm package, atomic-lockfile, whose Linux ELF payload functions as a credential stealer and includes an optional eBPF rootkit to hide activity. The malware targets sensitive data such as GitHub credentials, SSH artifacts, Vault tokens, browser cookies, and data from Slack, Discord, Microsoft Teams, and Telegram, with exfiltration capabilities. Investigations by IFIN and Sonatype detail the campaign, including hijacking orphaned packages and modifying PKGBUILD files to invoke npm during installation. Arch maintainers are removing malicious commits, advising users to audit affected packages, rotate credentials, and consider reinstalling Arch if compromised; a detection script is also recommended.
Early Warning Signs of Supply-Chain Attacks Live in the Dark Web
Early warning signs of software supply-chain attacks are already appearing in dark-web forums and marketplaces, often not labeled as such but involving GitHub access, private repositories, source code, API keys, OAuth tokens, cloud credentials, and CI/CD data. The article emphasizes that the risk lies in where access sits within trusted relationships across vendors and developers, not in a single incident, and it cites cases like the April 2026 Vercel breach and discussions around TeamPCP, Mistral AI, Sportradar, and the Shai-Hulud npm attack to show how leaked credentials and development tooling can enable broader compromises. For defenders, it recommends broader monitoring that includes exposed developer credentials, SaaS access, environment variables, package registry tokens, and CI/CD secrets, in addition to vulnerability alerts, and highlights Flare’s free underground monitoring as a way to detect threats early.
Microsoft Fixes Windows Update Failures Linked to WUSA Installer
Microsoft has fixed a WUSA update failure that affected updates released since May 2025 when installed from network shares. The issue impacted Windows 11 24H2/25H2 and Windows Server 2025 on enterprise networks, but not local or single .msu installations. The fix is included in the June 2026 Patch Tuesday cumulative updates for Windows 11 (KB5079391) and Windows Server 2025 (KB5094125). Workarounds if you were affected: save the .msu files locally and install from there, and after a restart, wait at least 15 minutes before checking Update History.
Novo Nordisk Discloses Breach of Clinical Trials Data
Novo Nordisk disclosed a data breach affecting patient data from some clinical trials, with attackers gaining access to internal IT systems and copying non-public data including pseudonymized patient IDs, trial participation details, demographics, biomarkers, health data, and lifestyle factors. The company says this information cannot be linked to individuals by name, and the breach also exposed some healthcare professionals’ names and contact details. Core operations were not affected, and the incident is under investigation with external cybersecurity experts; the number of affected individuals and the breach detection time have not been disclosed. Affected healthcare professionals have been warned to expect potential phishing attempts.
Maine breach portal abused to publish fake data breach disclosures
A misinformation campaign led to fake data breach disclosures being posted to Maine’s breach portal, including a bogus VRChat notice. VRChat denies submitting the notice and says the cited employee does not exist, with the company seeking removal from the portal. Maine’s Attorney General’s Office confirmed the portal accepts submissions without verification and flagged another suspicious entry (Discord). The episode highlights the need for independent verification of breach notices before treating portal postings as legitimate.
Oracle mitigates PeopleSoft zero-day exploited in data theft attacks
Oracle warns of a critical zero-day in PeopleSoft PeopleTools (CVE-2026-35273, CVSS 9.8) that enables unauthenticated remote code execution and is linked to ShinyHunters data-theft attacks, affecting PeopleTools versions 8.61 and 8.62. Emergency mitigations are in place with a patch coming soon. While Oracle hasn’t formally confirmed active exploitation, researchers and media tie the flaw to a wave of breaches across hundreds of instances and 100+ organizations, with attackers leveraging a mix of old and zero-day flaws. Admins should review logs for known attack IPs and prepare for the update.
Authorities dismantle 'AudiA6' ransomware crypto-laundering service
European law enforcement, led by Europol, has dismantled the AudiA6 cryptocurrency laundering service, a hub used by ransomware actors to move and “clean” illicit proceeds totaling more than $380 million. Europol linked AudiA6 to more than 15 ransomware investigations worldwide from 2022 to 2025. The crackdown saw two administrators arrested in Georgia, the seizure of 25 domains and 80 properties/vehicles, and significant crypto seizures (€86,000 seized, €692,000 frozen) along with thousands of KYC records tied to money mule networks. The two suspects, Ruslan Igorevich Tkachuk and Alexander Vladimirovich Ledenev, face up to 20 years in prison for facilitating cybercrime money laundering.
Why AI-driven threats are exposing the limits of MSP security stacks
AI-driven threats are accelerating attack timelines and exposing the weaknesses of fragmented MSP security stacks. To keep pace, MSPs need unified, AI-powered security platforms that tightly integrate detection, automation, and recovery, reducing tool sprawl and speeding response. Kaseya argues that platforms like Kaseya 365 Endpoint can enable faster remediation, clearer reporting, and sustainable cybersecurity value—and invites MSPs to join its partner community.
Microsoft patches Exchange Server zero-day exploited in attacks
Microsoft patched CVE-2026-42897, a high-severity cross-site scripting vulnerability in Exchange Server that attackers could exploit by sending a crafted email to a user; when opened in Outlook Web Access under certain conditions, arbitrary JavaScript could run in the browser. The flaw affects Exchange Server 2016, 2019, and Exchange SE, and was already being exploited in the wild. Microsoft released June 2026 security updates and urged admins to apply them and keep the embedded EEMS mitigations for added protection. The vulnerability was added to the CISA Known Exploited Vulnerabilities catalog on May 15, with federal agencies ordered to patch by May 29; this continues a trend of Exchange-related exploits over the last five years.
The 5 Best Practices for Secure Identity Verification
Sponsored content highlights five best practices to strengthen identity verification amid rising credential theft (up 160% in 2025): deploy fatigue-resistant MFA with phishing-resistant methods; secure the service desk from social engineering; integrate device trust into authentication decisions; explore passwordless options like passkeys; and protect biometric data with encryption and privacy-preserving techniques. It also promotes Specops solutions for password policy, secure service desk, and verified ID.
China-Linked JDY Botnet Expands Targeting of U.S. Military Networks
Black Lotus Labs warns that the China-linked JDY botnet has expanded its reach in the United States, with a focus on military networks and a growing pool of compromised SOHO and IoT devices (over 1,500, up from about 650 in January 2024). Rather than a traditional DDoS botnet, JDY functions as a distributed scanning and fingerprinting network that rapidly targets newly disclosed vulnerabilities, including CVE-2026-35616 after Fortinet’s disclosure. The botnet operates via hidden Tor-based C2s (and sometimes the Platypus framework), surveying devices from vendors like Cisco, Ubiquiti, Hikvision, and others for TCP/SSL/UDP/ICMP scanning, banner grabbing, TLS certificate harvesting, and service fingerprinting. Security guidance urges patching devices, disabling exposed admin interfaces, restricting remote management, rotating default credentials, and monitoring for unusual outbound scanning.
Oracle PeopleSoft servers hacked in ShinyHunters data theft attacks
Security researchers are tracking a widespread data-theft campaign against Oracle PeopleSoft servers by the ShinyHunters gang, claiming access to about 300 instances across more than 100 organizations, many in the education sector. The attackers are using a mix of old vulnerabilities and zero-days, issuing extortion demands and leaving ransom notes on compromised systems. Nottingham University is named as a victim with some data reportedly published on a ShinyHunters leak site. Defenders are advised to review logs for specific IPs and indicators, look for TLS certificates linked to azurenetfiles.net, and isolate affected servers from the internet while conducting incident response.
GitHub announces npm security changes to tackle supply-chain attacks
GitHub has unveiled npm v12 with security-focused changes aimed at stopping supply-chain attacks by requiring explicit approval for scripts and non-registry dependencies during npm install. The updates disable automatic execution of preinstall/install/postinstall scripts, block automatic resolution of Git-based dependencies, and prevent automatic resolution of remote URL dependencies unless explicitly permitted. Developers should upgrade to npm 11.16.0+ to see warnings before upgrading, after which only explicitly approved scripts and sources will function automatically; a community discussion has been opened for feedback.
The Miasma worm source code briefly leaked on GitHub
Security researchers warn that Miasma—a credential-stealing attack framework that evolved from Shai-Hulud—was briefly leaked on GitHub via compromised accounts. The self-propagating malware harvests cloud, CI/CD, and secret-store credentials to taint npm, PyPI, and RubyGems packages—as well as GitHub repositories and Actions workflows—with no external C2, using GitHub as its control plane. The leak reveals features like a dead-man switch that wipes the user's home and Documents if a stolen token is revoked, plus a five-stage, uniquely encoded build pipeline to thwart detection. The incident underscores growing open-source supply-chain risk and urges developers to pin dependencies, delay updates, and verify every build in isolated environments.
Microsoft patches YellowKey, GreenPlasma, MiniPlasma zero-days
Microsoft patched three zero-day vulnerabilities on the June 2026 Patch Tuesday: GreenPlasma and MiniPlasma, two privilege-escalation flaws in the Collaborative Translation Framework and Cloud Files Mini Filter Driver that can yield a SYSTEM shell on patched Windows (CVE-2026-45586 and CVE-2020-17103); and YellowKey, a WinRE backdoor that can bypass BitLocker on unpatched Windows 11 and Windows Server 2022/2025 (CVE-2026-45585). The flaws were disclosed by Nightmare Eclipse in protest of how Microsoft handles vulnerability disclosures; Microsoft provided mitigations and noted PoC leaks, with related zero-days and other exploits continuing to emerge.
Path traversal flaw in AI dev platform Langflow exploited in attacks
Security researchers warn that CVE-2026-5027, a high-severity path traversal vulnerability in Langflow, is being actively exploited to write arbitrary files on exposed servers via the POST /api/v2/files endpoint. The flaw stems from improper sanitization of the filename in multipart form data, and Langflow’s default unauthenticated auto-login allows attackers to obtain a session token with a single request. Tenable disclosed the issue in March 2026; fixes were released in langflow-base 0.8.3 and Langflow app 1.9.0, with the latest release 1.10.0 now recommended. Observations from honeypots show ongoing exploitation and Censys flagged thousands of publicly exposed Langflow instances, underscoring the urgency to upgrade.
Reducing security operations complexity with Wazuh Cloud
The article explains how Wazuh Cloud reduces security operations complexity by offering a fully managed, cloud-native SIEM/XDR. It highlights modern SOC challenges—extended onboarding, ongoing maintenance, high alert volumes, scaling constraints, inflexible licensing, and reactive support—across hybrid environments. It then shows how Wazuh Cloud addresses these issues with rapid time-to-value, zero-maintenance backend, an AI-powered Security Analyst, automatic scalability, flexible tiering, and proactive support. The piece describes the agent-server architecture, indexing and data pipeline, the detection engine, and the AI analyst layer, and concludes that Wazuh Cloud lowers MTTD/MTTR, reduces costs, and improves visibility, with an invitation to start a free trial.
Check Point links VPN zero-day attacks to Qilin ransomware gang
Check Point has issued critical hotfixes for CVE-2026-50751 and CVE-2026-50752, fixing an authentication-bypass vulnerability in Remote Access VPN/Mobile Access deployments that used the deprecated IKEv1 protocol. Exploitation began May 7 and, by early June, impacted a handful of organizations worldwide with at least one linked to the Qilin ransomware operation. The company recommends patching immediately, disabling IKEv1, enforcing IKEv2 with mandatory machine certificates, enabling IPS, and applying mitigations for the second flaw to prevent MITM attacks. Qilin ransomware-as-a-service has targeted numerous high-profile victims since 2022.
Showing 20 of 423 articles