Cybersecurity News
Filters
Filtered by category: Krebs On Security × Clear
Widespread PHP Flaw May Cause Many Site Outages Today
Matched: OpenAI
A critical pair of PHP vulnerabilities affecting roughly 70% of websites is being actively exploited, with working exploits already circulating. All PHP versions since 5.4 are affected, enabling remote code execution, denial-of-service, and data exposure. Fixes are available in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Cloudflare implemented firewall protections early today, while government sites in Europe have already gone offline. Researchers compare the severity to the 2021 Log4Shell flaw.
Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site
Matched: cryptocurrency, medical
U.S. federal investigators suspect executives at two ransomware negotiation firms had unusually close ties to the ShinyHunters hacking group, with one U.S.-based executive allegedly helping operate the group's victim extortion website. Canadian cybersecurity executive Edward Dubrovsky has been charged with extortion-related offenses. Investigators also identified connections to Daniel Tobok, linked to the alias "Ghostbyte," which appeared in communications from the Dharma ransomware group. ShinyHunters has extorted over $70 million this year.
U.K. Sanctions Cryptomus for RU Money Laundering
Matched: Australia, cryptocurrency
The U.K. sanctioned Cryptomus, a cryptocurrency platform accused of processing payments for ransomware, drug markets, cybercrime, and helping Russia evade financial restrictions. The sanctions freeze U.K.-held assets and bar British firms from doing business with it. Also targeted were VexPay, TokenSpot, and Tsunami Payments. Cryptomus, which has operated under multiple names including Certa Payments and now Heleket, processed over $7 billion since 2022. Analysts say sanctions are more effective than Canada's earlier $176 million fine, which proved unenforceable.
Microsoft Patches More Than 1,400 Security Flaws
Microsoft released patches for over 1,400 security vulnerabilities, surpassing September's record of nearly 1,000 fixes. One zero-day (CVE-2026-96951), a Windows Shell security bypass, is actively exploited. At least 78 flaws are rated critical. Microsoft attributes the high discovery volume to AI. Security teams face strain from testing large patch batches, and experts recommend prioritizing the 26 Microsoft flaws listed in CISA's Known Exploited Vulnerabilities catalog.
FBI Arrests Executive at Ransomware Negotiation Firm
Matched: medical
FBI agents arrested Edward Dubrovsky, a Canadian cybersecurity executive specializing in ransomware negotiations, in Pennsylvania on cyber extortion and conspiracy charges. Dubrovsky, associated with firms Cypfer and CyberSteward, was attending a cyber insurance conference when arrested. His case has been moved to Texas, the center of the FBI's investigation into ShinyHunters, a hacking group that has extorted over $70 million this year and recently stole sensitive FBI personnel data.
ShinyHunters Extorted Boeing Spin-off Prior to Arrests
Matched: health, medical
A teenager from Amman, Jordan, suspected of leading ShinyHunters, was detained and is reportedly cooperating with the FBI. Saif Al-Din Khader, known as "Rey," was apprehended while the group was extorting Jeppesen ForeFlight, a former Boeing subsidiary, over allegedly stolen sensitive aviation data. Separately, Dutch cybercriminal Pepijn van der Stap faces new allegations of ordering murders abroad. Experts describe ShinyHunters as a franchise-style operation, with Rey accused of exploiting the brand's reputation after its original French members were arrested.
Dutch Police Arrest ‘Reformed’ Hacker in Shiny Hunters Investigation
Matched: Artificial Intelligence, Australia, health, medical
Dutch police arrested 24-year-old Pepijn van der Stap, a previously convicted hacker known as "Umbreon," on suspicion of involvement with the hacking group ShinyHunters. Van der Stap had served prison time for data theft and extortion, claimed rehabilitation, and worked in cybersecurity. Following his arrest, ShinyHunters escalated attacks, breaching the FBI's jobs site and extorting Russian ransomware group Cl0p. Investigators also suspect van der Stap may have ordered two murders abroad.
U.S. Soldier Gets 70 Months in Prison for AT&T, Verizon Extortions
U.S. Army soldier Cameron Wagenius, 22, was sentenced to 70 months in prison and ordered to pay nearly $300,000 in restitution for hacking telecoms including AT&T and Verizon. Operating as "Kiberphant0m" while stationed in South Korea, he stole call and text metadata from over 100 million AT&T customers via Snowflake cloud storage breaches and extorted companies. Despite the massive scale, he earned only around $1,500. While awaiting sentencing, he was caught attempting to research prison network vulnerabilities using other inmates' email accounts to query AI tools.
Data Broker Radaris Loses Domains in Privacy Fight
Matched: cryptocurrency
Data broker Radaris.com lost its domain and over a dozen related domains after a New Jersey court ruled against it in a lawsuit filed by Atlas Data Privacy Corp alleging violations of Daniel's Law, which protects law enforcement officials' personal information. Radaris repeatedly delayed proceedings and cycled through offshore shell companies to avoid judgment. Emails obtained in litigation confirmed Russian-born brothers Igor and Dmitry Lubarsky operated the network, which earns roughly $100,000 monthly across its sites.
Microsoft Plugs Nearly 1,000 Security Holes
Matched: Artificial Intelligence
Microsoft released its largest-ever patch batch, fixing 974 security vulnerabilities across Windows and other software, bringing 2026's total past 2,600 — more than double the previous annual record. Two actively exploited zero-days allow privilege escalation. Microsoft attributes the surge partly to AI-assisted vulnerability discovery, though security experts warn organizations are struggling to test and deploy the growing volume of monthly fixes.
FBI Probes Service Selling 153M+ Drivers Licenses
Matched: medical
A dark web service called Nexus was selling scans of over 153 million drivers licenses from the US and Canada, apparently stolen from Louisiana-based identity verification company IDScan.net. Timestamps on stolen records matched when victims used services at Hertz rental car locations and marijuana dispensaries. The FBI's New Orleans field office opened an investigation, and Nexus subsequently went offline. IDScan.net confirmed unauthorized access to customer data including names and ID numbers.