Hackers push malicious Virtualizor update in BGP hijacking attack

Source: BleepingComputer

Attackers diverted Virtualizor update traffic by hijacking BGP routes associated with Softaculous infrastructure, then delivered a malicious package to a small number of servers. The vendor restored routing, released a security analyzer, and advised administrators to check for a suspicious service, rotate credentials, and audit systems for unauthorized access.

Link to article

Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks

Source: The Hacker News

Threat actors are using the signed Node.js runtime to execute malicious JavaScript in targeted intrusions against government, technology, hospitality, and financial organizations. The approach can evade binary-focused detection, establish persistence, and retrieve tooling through blockchain-based infrastructure after ClickFix campaigns or failed attempts to deploy more familiar command-and-control frameworks.

Link to article

Attackers Steal METR API Key and Burn $600,000 in AI Credits

Source: Infosecurity Magazine

Attackers exploited a fail-open authentication flaw in a publicly exposed, researcher-built application to obtain a METR model-provider API key. They retained access and consumed roughly $600,000 in credits over three weeks. METR said the credits were provided free and found no evidence that sensitive information was accessed.

Link to article

23-Year-Old Sality P2P Botnet Disrupted

Source: SecurityWeek

An international operation disrupted the 23-year-old Sality peer-to-peer botnet by manipulating its trusted peer lists, isolating infected systems, and taking down payload-hosting URLs. CrowdStrike-operated sinkholes now receive bot traffic, while the Shadowserver Foundation is helping internet providers and incident-response teams identify victims and clean affected machines.

Link to article

Exploit Published for Fresh Cleo Harmony Vulnerability

Source: SecurityWeek

A public exploit now targets CVE-2026-84115, an authentication bypass in Cleo Harmony's JWT refresh-token logic. Crafted bearer-token arguments could let remote attackers elevate privileges, retain access, or move laterally through connected systems. The flaw is fixed in version 5.8.1.11, and customers are urged to update quickly.

Link to article