A U.S. government entity, believed to be Union County, Ohio, paid approximately $1 million to the Kairos extortion group. Attackers claimed to have stolen more than 2TB of data without deploying ransomware or encrypting systems. Blockchain analysis traced the payment through wallets linked to Bybit, OKX and the Russian service BELQI.

North Korean threat actors linked to the Contagious Interview campaign published 108 malicious packages across npm, Packagist, Go and Chrome extensions. The activity, tracked as PolinRider, remains active with new malicious packages continuing to appear. Threat actors compromised maintainer accounts to distribute the packages.

A critical authentication bypass, CVE-2026-48611, affected phpBB by allowing login as any user through a single unauthenticated request. The flaw abused the login_link feature and the apache authentication provider in default configurations. phpBB patched the issue in version 3.3.17.

Cisco Talos released ClamAV 1.5.3 and 1.4.5, fixing seven vulnerabilities in PE unpackers, archive parsers and the DMG parser. Some of the flaws dated back to 2004. The updates also hardened clamscan, clamdscan and clamonacc against race conditions in quarantine operations.

Researchers documented JadePuffer, described as the first ransomware operation conducted entirely by a large language model agent. Separately, new research identified a potential architectural flaw in the remote attestation mechanism underlying confidential computing. The flaw raises questions for trusted execution environment deployments tied to sovereign cloud initiatives.

Ransom-ISAC analysis linked the Kairos extortion group to a June 2025 incident in which a U.S. government entity, believed to be Union County, Ohio, paid approximately 9.44 BTC, worth about $1 million, after attackers claimed to steal more than 2TB of data without encrypting systems. The month-long negotiation began with a $3 million demand and ended at $1 million, while blockchain analysis traced the payment through multiple wallets towards deposit addresses associated with Bybit, OKX and the Russian service BELQI, and the attackers claimed initial access was gained by guessing a password.

Aikido disclosed technical details for CVE-2026-48611, a critical authentication bypass in phpBB that allows attackers to log in as any user with a single unauthenticated request by abusing the login_link feature and forcing the apache authentication provider, which trusts Basic Authentication usernames without verifying passwords. The flaw affects the default configuration, was patched in phpBB 3.3.17, and researchers showed attackers could escalate from a compromised founder account to full administrative control on 3.x forums, while phpBB 4.x beta installations could also be exposed to remote code execution through the Extensions Catalog feature.

Cisco Talos released ClamAV 1.5.3 and 1.4.5 to fix seven vulnerabilities, including CVE-2026-20213, CVE-2026-20214, CVE-2026-20215, CVE-2026-20216, CVE-2026-20217, CVE-2026-20243 and CVE-2026-20244, affecting PE unpackers, archive parsers and the 32-bit DMG parser, with some flaws dating back to 2004. The updates also harden clamscan, clamdscan and clamonacc against time-of-check/time-of-use race conditions in quarantine operations, upgrade Rust dependencies to address RUSTSEC advisories and CVE-2026-41676, and include additional stability fixes for ClamOnAcc.