Grafana Labs has confirmed a significant data exfiltration from its GitHub repositories, attributing the incident to a broader supply chain attack that recently impacted several high-profile development projects. The compromise resulted in the theft of proprietary source code and internal operational data, highlighting persistent vulnerabilities within the software supply chain.

International law enforcement agencies, collaborating across North America and Europe, have successfully dismantled "First VPN," a long-standing service critical to numerous cybercriminal operations. This coordinated action led to the arrest of the alleged administrator and the seizure of infrastructure that facilitated malicious activities, including ransomware attacks and data theft. The operation sends a clear signal regarding the increasing reach of authorities into the dark web's illicit services.

Authorities have announced the arrest of a Canadian national accused of administering the Kimwolf DDoS botnet, marking a significant development following the botnet's recent disruption. This operation highlights ongoing international efforts to dismantle large-scale cybercriminal infrastructure and bring operators to justice.

A sophisticated supply chain attack has compromised several PHP packages hosted on Packagist, deploying Linux malware via GitHub. This coordinated campaign uniquely targets projects utilizing both PHP and JavaScript build tooling, exploiting a blind spot in common security scanning practices.

Suspected Iranian cyber operatives have reportedly infiltrated digital systems controlling fuel tank monitors at numerous gas stations across the United States. This incident, coupled with revelations of widely exploited industrial router vulnerabilities and internal security lapses at a major US cybersecurity agency, highlights a critical period of elevated threat to national infrastructure and digital supply chains.

A severe vulnerability within Drupal's content management system is now facing active exploitation attempts shortly after its disclosure. This critical flaw targets an API responsible for database query sanitization, specifically impacting instances configured with PostgreSQL databases. The rapid emergence of in-the-wild attacks underscores the immediate threat to affected organizations.

A critical vulnerability, dubbed Underminr, is enabling threat actors to conceal malicious network activity behind seemingly trusted domains by exploiting shared content delivery network infrastructure. This novel technique circumvents existing defenses against domain fronting, presenting a significant challenge for network egress policies and detection systems. Attackers can leverage this flaw to mask command-and-control communications and unauthorized proxy connections.

Cryptocurrency theft has dramatically evolved beyond isolated incidents, now operating through highly organized, professionalized 'Drainer-as-a-Service' platforms. This marks a significant shift from ad-hoc scams to a structured underground economy designed for scalable digital asset pilfering.

Transnational law enforcement efforts have led to the apprehension of an individual allegedly responsible for operating a vast distributed denial-of-service (DDoS) botnet. This significant development targets a cybercriminal enterprise accused of orchestrating attacks across numerous global networks, impacting organizations including defense infrastructure.

Ubiquiti has recently addressed multiple critical vulnerabilities within its UniFi OS, which powers a wide array of network infrastructure. These flaws present a significant risk, allowing remote attackers unauthenticated access to systems managing vital IT services. The widespread deployment of UniFi devices, with a substantial portion exposed online, amplifies the urgency for organizations to implement these crucial security updates.

A critical SQL injection vulnerability impacting Drupal is now actively being exploited by threat actors, necessitating immediate security updates across affected deployments. This flaw, initially flagged with high severity, targets sites leveraging PostgreSQL databases and poses a significant risk for remote code execution and data compromise.

Senior figures from a prominent call-tracking and analytics firm have admitted guilt in a scheme to conceal widespread tech support fraud. These former executives are now facing federal sentencing after knowingly enabling global scam operations that targeted individuals with deceptive technical support pitches.