The Register-Security
- Get link
- X
- Other Apps
"33-hour BGP hijack of Softaculous traffic prompts security scramble."
Views expressed in this cybersecurity, cybercrime update are those of the reporters and correspondents. Accessed on 01 September 2026, 1439 UTC.
Content and Source provided by email subscription from https://feedly.com.
https://feedly.com/i/subscription/content/feed%2Fhttp%3A%2F%2Fwww.theregister.co.uk%2Fsecurity%2Fheadlines.atom
Please check subscription link or scroll down to read your selections. Thanks for joining us today.
Russ Roberts (https://www.hawaiicybersecurityjournal.net).
32
Today
IoC > 1 file path
2h
•Scheduled Task/Job (Enterprise T1053)
Softaculous and Virtualizor customers are being urged to reset credentials and inspect their servers after a 33-hour BGP hijacking incident diverted traffic and delivered malware to a handful of installations. Softaculous makes software for the web hosting industry, while its Virtualizor control panel is used by providers and administrators to deploy and manage virtual private servers. Beginning a
Yesterday
8h
Two major healthcare businesses, Boston Scientific and McKesson, disclosed more details over the weekend about separate cyberattacks that disrupted global operations and resulted in stolen patient data, respectively. Medical-device maker Boston Scientific, whose IT systems were hacked by unknown intruders last week, said the cyberattack remains ongoing. It also noted that pacemakers and other hear
8h
OpenClaw has unveiled what its makers call its largest ever update – large enough to earn a 2.0 moniker – with usability taking center stage, along with some security updates that critics are suggesting will be insufficient. The OpenClaw foundation announced the release of version 2.0 of its AI agent harness on Sunday, describing it as something with far more scope than they ever intended it to ha
8h
An unknown miscreant is using "TerminalFix" to trick unsuspecting users into running PowerShell commands that infect their computers with a reverse tunnel granting attackers access to their networks. Some of the malware is even hidden inside PNG graphics the PC downloads. TerminalFix is the latest variant of the wildly popular ClickFix initial access method for attackers. This type of social engin
8h
Rather than paying for their own Claude usage, crims are using malware to steal access to other people's accounts. Aware of this issue, Anthropic has signed at least one affected user out and removed the saved payment method to stop stolen sessions being abused. According to an email shared by Reddit user WorriedAssociate7029, who sent a copy to The Register, Anthropic has been keeping an eye on a
8h
Brits have delivered a fairly unambiguous verdict on giving the government access to their encrypted messages: no, thanks. New polling commissioned by the Center for Democracy & Technology (CDT) found that 93 percent of British adults believe they have a right to private conversations online, while 89 percent think nobody should be able to access their personal messages without a court order. Perh
8h
Anthropic’s Claude Code running Opus 5 in Auto Mode can be tricked into executing attacker-controlled code simply by asking the coding agent to summarize a website. The attack works up to 80 percent of the time, according to prompt-injection wizard Johann Rehberger, aka wunderwuzzi. In a blog and video demo, he detailed how to hijack Opus 5 in Auto Mode, which is the default setting for Claude as
8h
The former Defense Intelligence Agency (DIA) IT specialist previously accused of trying to pass secret and top-secret information to foreign spies has pleaded guilty following a successful FBI sting. Nathan Vilas Laatsch, then 28, and now 29, was arrested in May 2025 after an undercover FBI agent caught him for the second time transmitting intelligence packages in a public park that he believed wo
8h
CISA is still crying out for software vendors to adopt Secure by Design (SBD) development practices, and says in its latest review that longstanding vulnerability classes are still the most exploited. The agency examined soft spots across 2024 and 2025, finding that the majority of those that receive CVEs and make it to the Known Exploited Vulnerability (KEV) catalog belong to decades-old flaws th
8h
OpenAI has gathered more than 100 of the world's biggest tech and infosec companies to warn that cyber defense is in trouble - a reassuring development given quite a few of them helped build the technology involved. The open letter has more than 100 names attached to it, including many of the companies with the most to gain – or lose – from what happens next. OpenAI, Anthropic, Google and Microsof
8h
Nothing smarts like a paper cut, but being attacked after leaving an application’s web interface exposed to the internet might be just as painful. Such attacks are the risk to which users of PaperCut print management software find themselves exposed today, after the company revealed a university’s security teams alerted it to an attack. The company analyzed info provided by the university and foun
8h
The Australian city of Perth is by some measures the world’s most isolated major metropolis, but is still sufficiently connected to US law enforcement authorities that the FBI was able to help Australia’s Federal Police (AFP) to find two men they believe were the masterminds of TeamPCP, a cybercrime crew that conducted prominent supply chain attacks. According to the AFP, two men aged 21 and 23 ar
8h
CRPx0, a cybercrime crew that has rapidly evolved from a scam service to a ClickFix-delivered ransomware and crypto-theft business over the summer, claims its victim count jumped from fewer than 10 in June to 48 organizations on its clear-web leak site at the time of publication. Keep in mind: criminals aren’t always the most trustworthy bunch, so take their claims with a healthy dose of salt. Sti
8h
PWNED Welcome back to PWNED, the weekly column where we explore the frightening and amusing world of foolish infosec errors. This week, it's all about a test site that exposed real information. Have a story about someone leaving a gaping hole in their network? Share it with us at pwned@sitpub.com. Anonymity is available upon request. Our story comes courtesy of Mia Morin, Editor & AI Quality Analy
8h
The controversial Omarchy distro is attracting both criticism and fans – and financial support, too. Omarchy is an opinionated respin of Arch Linux and a pet project of Ruby on Rails creator David Heinemeier Hansson, better known as DHH. Although the first release was as recent as June last year, this week sees the release of Omarchy 4.0.1 – a security fix for the mid-August Omarchy 4 “Quattro”. A
8h
The Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) said it’s responding to a “major” cybersecurity incident shortly after the Qilin ransomware gang posted the US federal law enforcement agency on its leak site. An ATF spokesperson told The Register the intruders accessed a “standalone computer system containing information about targets of ATF investigations” that wasn’t connected to an
8h
Schrödinger's Cat, the famous 1935 thought experiment, imagines a cat that, for reasons rooted in quantum physics we need not dwell on here, is simultaneously alive and dead. In a landscape of relentless cyberattacks and mounting infrastructural complexity, a routine backup task can appear finished, with every box ticked and every check made. The job is not actually done, however, until it has bee
8h
The company behind three of the UK’s busiest airports says “a quantity” of data was stolen by an extortion group during a recent “cybersecurity incident." Manchester Airports Group (MAG), which operates Manchester Airport in the North West of England, Essex’s Stansted Airport, and East Midlands Airport in Derbyshire, confirmed the attack did not involve ransomware. A MAG spokesperson confirmed the
8h
The UK’s data protection watchdog has fined a nuisance call blocking biz £190,000 ($258,000) for bombarding elderly people with hundreds of thousands of - you guessed it - nuisance calls. Elderly Aids Ltd made 758,053 unsolicited direct marketing calls between May 27, 2024, and February 10, 2025, according to the Information Commissioner’s Office (ICO). On average, that works out as 2,916 calls pe
8h
UPDATE After publication, the US Justice Department walked back its earlier claims that multiple US government agencies were hacked by Beijing’s cyberspies. In an updated press release, the feds removed “victims,” and now says NASA, the Federal Reserve, departments of Energy, Justice, and Health and Human Services, along with the National Institutes of Health, and the US Senate were “targets.” The
8h
OpenAI has published its technical report detailing "the Hugging Face incident," the compromise of the eponymous LLM repository by unreleased, ill-supervised AI models. The incident, widely reported, has prompted concern among technical types, the public, and lawmakers about how automated software was able to escape containment and hack an external organization, and about what can be done to preve
8h
The US government disclosed that crims targeted more than 100 internet-exposed water systems during July cyberattacks. That's the first time the feds have put a number on the digital intrusions, but they have yet to attribute the campaign, widely suspected to be linked to Iran, to a particular group. “In July 2026, CISA observed malicious cyber activity targeting over 100 internet-exposed systems
8h
Medical device maker Boston Scientific’s global operations have been disrupted by an ongoing cyberattack, the company disclosed on Wednesday. According to an SEC filing, the “cybersecurity incident” affecting its IT systems started on Tuesday, and resulted in a “global disruption to the company’s operations.” Upon detecting the digital intruders, the company began an investigation with third-party
8h
Workwear and fashion retailer Carhartt’s data breach was about half as bad as ShinyHunters claimed, according to Troy Hunt, who reviewed the data dump before uploading it to his Have I Been Pwned website. Hunt’s HIBP service reported 12.9 million individuals affected by the alleged breach, around half of what ShinyHunters purported when it claimed to leak the company’s data earlier this month. Shi
8h
In late July, Oracle released a mammoth security patch dump with 1,449 patches, in a perhaps unprecedented bad day for database admins. None of them, it turns out, would have prevented the credential theft on an Oracle database server described by security platform Huntress. “Even if it had been fully patched, everything working, it still would have happened,” said Craig Savage, cybersecurity lead
8h
The US Cybersecurity and Infrastructure Security Agency (CISA) just dished out another three-day deadline for patching an actively exploited vulnerability, the most urgent in its wheelhouse. The culprit: a max-severity Oracle bug affecting Windows VMs. Tracked as CVE-2026-21962 (10.0), the improper access control (CWE-284) flaw affects Oracle’s HTTP Server and WebLogic Server Proxy Plug-in. Succes
8h
Cybercrims are using fake OpenAI Codex download pages to trick Mac developers into running malware disguised as installation commands. Researchers at Cato Networks uncovered the campaign after spotting sponsored Google search results targeting people looking to download Codex for macOS. The ads direct would-be users to a convincing-looking download page hosted on Google Sites, complete with the fa
8h
Like a sleeper cell awaiting activation, a never-before-seen Windows backdoor dubbed Sleepwalker waits silently in memory for one specifically crafted network packet to wake it up and deliver commands using the malware's 23-instruction language. The commands can do everything from running code directly in memory to moving data off the computer. Malware researcher Dominik Reichel discovered the pas
8h
If you're curious how easily tech companies can fingerprint your browser and device and potentially single them out from the crowd, a new utility Glassbox will show you. Aside from pinging a public geolocation API, it runs entirely in a user’s browser and doesn’t ship any info out to the web while acting just like all the various trackers, anti-fraud scripts, and other browser fingerprinting trick
8h
A suspected Iran-linked cyberattack shut down a small UK power plant around the time that a series of digital intrusions disrupted American water utilities across 12 states. A British government spokesperson confirmed the hack to The Register on Monday and told us that the security incident affected a “small-scale energy generator.” “At no point was there a risk to the wider energy system,” the sp
8h
Developer Matt Callaghan claims he caught Alibaba's B2C website, AliExpress, trying to track web users by playing sounds through browsers vulnerable to audio fingerprinting. The software engineer drew attention to the issue late last week after investigating why his Bluetooth headphones stopped playing music whenever he visited the AliExpress website. “Recently I ran into a strange problem with my
8h
Are you sick and tired of maintaining a password manager? Struggling with choosing the right one for you? Well, readers who live Down Under can get themselves down to their local AusPost branch where they can pick up an old-school alternative for just AU$4.90 (US$3.51). Password books are something of a historical relic, phased out largely because of the scrutiny associated with using one and the
End of feed
- Get link
- X
- Other Apps
Comments
Post a Comment
Please leave a comment about our recent post.