SANS ISC reports TeamPCP’s 26-day lull ended with three concurrent compromises impacting Checkmarx KICS (GitHub repo data exposure), a Bitwarden CLI credential “cascade,” and a xinference PyPI package, alongside discovery of a self-spreading npm worm dubbed “CanisterSprawl.” Operators tracked by Google as UNC6780 (SANDCLOCK) appear focused on credential monetization and developer-tool supply chains. Teams should rotate tokens, audit CI/CD secrets, scrutinize npm/PyPI dependencies, and tighten artifact signing and repo access controls.
Source: SANS ISC
OpenSSH bug enabling full root shell lingered for 15 years
A long-standing OpenSSH certificate parsing issue allowed comma characters in certificate principals to be misinterpreted as list separators, opening a path to full root shell access under specific configurations. Admins should update to the latest OpenSSH release, review certificate authorities/principals usage, and audit sshd_config for risky certificate-based auth patterns.
Source: SecurityWeek
‘Pack2TheRoot’ Linux privilege escalation affects PackageKit across distros
A race condition in PackageKit allows unprivileged users to escalate to root during package installations, making exploitation straightforward on many Linux distributions. Patch availability varies by vendor; in the interim, restrict local shell access, limit PackageKit usage, and monitor for suspicious package install activity.
Source: SecurityWeek
Incomplete Windows patch leaves door open to zero‑click attacks
Researchers warn that Microsoft’s earlier fix for a Windows flaw—previously exploited by Russia-linked APT28—was insufficient, enabling renewed zero-click exploitation paths. Enterprises should apply the most recent cumulative updates, review hardening guidance for the affected components, and hunt for related IOCs and lateral-movement attempts.
Source: SecurityWeek
Thousands of Zimbra mail servers exposed to actively exploited vulnerability
A widely used Zimbra Collaboration Suite flaw affecting versions 8.8.15, 9.0, 10.0, and 10.1 is under active exploitation, with thousands of servers still unpatched. Email platforms are high-value targets; prioritize patching, disable exposed admin interfaces, enforce MFA for webmail, and review logs for suspicious account access or webshell indicators.
Source: SC Media
Medtronic confirms breach after ShinyHunters claims 9M records
Medical device maker Medtronic confirmed a cyber incident following ShinyHunters’ claim to have stolen data on nine million individuals. While full details remain limited, defenders in healthcare and life sciences should review vendor connections, tighten B2B data exchanges, and prepare for credential stuffing and targeted phishing leveraging exposed PII.
Source: SecurityWeek
Utility tech giant Itron hacked; potential impact spans energy and water networks
Itron disclosed unauthorized access to its systems on April 13; the company provides metering and management technology to utilities and cities worldwide. Critical infrastructure operators should assess downstream exposure, validate network segmentation around AMI/OT interfaces, and coordinate with vendors on patches, telemetry, and incident response.
Source: SecurityWeek
You May Also Be Interested In...
Hackers impersonate Microsoft Teams help desk to breach corporate networks
Open source package with 1 million monthly downloads stole user credentials
Hacker allegedly tied to Chinese state group extradited to the U.S.