Posts

🟡 Medium | Source: The Hacker News A malware-as-a-service campaign dubbed Weedhack has been targeting Minecraft players since January 2026, distributing malicious software disguised as game clients and mods via YouTube. The operation has already compromised approximately 86,000 systems and includes components such as CountLoader and cryptocurrency miners. The campaign highlights how gaming communities remain a significant vector for delivering credential-stealing and system-control malware at scale. Architect’s Take: If your organisation permits personal devices or BYOD access to cloud workloads, ensure endpoint detection controls can identify MaaS-delivered loaders such as CountLoader, and audit whether compromised personal credentials could pivot into corporate cloud environments via SSO or reused passwords. ...

🟡 Medium | Source: The Hacker News A malware-as-a-service campaign dubbed Weedhack has been targeting Minecraft players since January 2026, distributing malware through YouTube by impersonating legitimate Minecraft clients and mods. The campaign has compromised thousands of systems and is linked to a loader dubbed CountLoader, which has recorded over 86,000 infections. The threat is notable for its exploitation of gaming communities and pirated software channels as a delivery mechanism for system-control malware. ...

🔴 Critical | Source: CISA Known Exploited Vulnerabilities A critical vulnerability in the Mirasvit Full Page Cache Warmer extension for Magento/Adobe Commerce allows unauthenticated attackers to execute arbitrary code on affected servers. The flaw stems from unsafe deserialisation of a crafted PHP object passed via the CacheWarmer cookie, requiring no login or prior access. This vulnerability is actively being exploited in the wild, confirmed by CISA’s inclusion in its Known Exploited Vulnerabilities catalogue. ...

🟡 Medium | Source: The Register — Security A ransomware operator has broken the unwritten but widely observed rule among Russian-speaking cybercriminal groups by attacking targets within Russia or CIS countries, drawing attention to themselves and likely facing consequences from both law enforcement and criminal peers. This norm has historically served as an informal shield, with many ransomware variants including code to abort execution if a CIS locale is detected. The incident highlights the internal politics and geographic conventions that shape how ransomware gangs operate. ...

🟡 Medium | Source: The Register — Security A ransomware operator has been caught after violating one of the unwritten rules of Russian-linked cybercrime: never target victims in Russia or other CIS nations. This breach of convention drew attention from Russian authorities, who typically turn a blind eye to ransomware gangs operating abroad. The case highlights the implicit geopolitical arrangement that has allowed many ransomware groups to operate with near-impunity. Architect’s Take: While this story is primarily threat-intelligence context rather than a technical vulnerability, cloud security architects should use it as a prompt to review their ransomware resilience posture — ensure immutable, offline-tested backups exist in cloud environments, and verify that incident response plans account for ransomware-as-a-service actors who may face reduced operational risk depending on their geography. ...

🟠 High | Source: AWS Security Bulletins A vulnerability in Graph Explorer (versions 1.1.0 to 3.0.1), an open-source tool used with Amazon Neptune, can cause the application to silently fall back from HTTPS to unencrypted HTTP when TLS certificates are unavailable. This means sensitive data, potentially including graph database queries and results, may be transmitted in cleartext without any visible warning. The issue is tracked as CVE-2026-10584 and requires an explicit upgrade to version 3.0.1 or later. ...

🟡 Medium | Source: AWS Security Blog AWS has published guidance on identifying unused KMS encryption keys and protecting them from accidental deletion across large, multi-account environments. Orphaned or forgotten keys can inflate costs, create compliance gaps, and pose a risk if unexpectedly deleted — potentially making encrypted data permanently inaccessible. The post outlines tooling and processes to audit key usage and apply deletion safeguards at scale. Architect’s Take: Implement regular KMS key usage audits using AWS CloudTrail and CloudWatch metrics, and ensure deletion windows and key policies are configured to prevent accidental removal — particularly in multi-account organisations where key ownership can become unclear over time. ...

🟠 High | Source: The Hacker News Google’s June 2026 Android security update addresses 124 vulnerabilities, including a high-severity privilege escalation flaw (CVE-2025-48595) in the Android Framework component that is actively being exploited in the wild. The flaw requires no user interaction, making it particularly dangerous as attackers can escalate privileges silently. Organisations with Android devices in their mobile fleet or BYOD programmes should treat this update as urgent. Architect’s Take: Prioritise enforcement of this patch across managed Android devices via your MDM solution (e.g. Intune, Jamf, or Google Endpoint Management) — focus first on devices accessing corporate cloud resources or sensitive SaaS applications. Review your mobile threat defence policies to detect any exploitation attempts against unpatched devices in the interim. ...

🟢 Low | Source: The Register — Security Cisco has publicly praised its AI model ‘Mythos’ for its performance in automated vulnerability discovery but has declined to disclose the number of bugs it actually found. Separately, Anthropic has expanded its Project Glasswing initiative by adding 150 new partners, signalling growing industry investment in AI-driven security tooling. The opacity around Mythos’ results raises questions about transparency and how organisations should evaluate AI security claims. ...

🟠 High | Source: The Hacker News Russian state-linked threat group Gamaredon is actively exploiting CVE-2025-8088, a path traversal vulnerability in WinRAR, to deploy a chain of malware against Ukrainian targets. The attack begins with an HTML Application payload (GammaPhish) which then downloads further malware including GammaWorm and GammaSteel, designed for data theft and lateral propagation. This is a targeted, state-sponsored campaign with significant implications for organisations operating in or with Ukraine. ...