Supply Chain Attack
Microsoft's attribution analysis ties the JavaScript-ecosystem compromise to a North-Korea-linked cluster, assessing with high confidence that the actor it tracks as Sapphire Sleet published poisoned Mastra packages to reach developers and crypto wallets.
Vulnerabilities
A 29-year-old proxy bug surfaces — defender review for Squid Proxy deployments. Researchers at Calif.io disclosed Squidbleed, a heap over-read that can leak another user's cleartext HTTP request on a shared Squid proxy.
Vulnerabilities
A lifecycle deadline that requires defender coordination with hardware vendors, as Microsoft's 2011-era Secure Boot certificates begin expiring across Windows and Linux environments.
Vulnerabilities
A WordPress plugin vulnerability requires API-key rotation work for affected site administrators, after researchers found an unauthenticated endpoint leaking live mail-provider credentials from roughly 100,000 installations.
Vulnerabilities
Another silicon-level finding lands with lifecycle implications — defenders issuing affected iPhones have device-policy work to plan.
Data Breaches
A large state-level data breach disclosure from Texas — the Parks and Wildlife Department says a license-system vendor exposed personal data for more than 3 million residents, who should review the state's notification process.
Cybercrime
Operation Endgame's multi-month coordinated action takes down another major distribution backbone, seizing more than a hundred servers and remediating nearly 15,000 compromised WordPress sites worldwide.
Ransomware
Another RaaS profile lands on defenders' desks — detection-engineering review for the week.
Vulnerabilities
Apple's firmware update for the Beats Studio Buds closes a high-severity Bluetooth flaw that let a nearby attacker listen through the microphone of an unpaired unit — verification work for organizations issuing the device.
Nation-State Cyber Threats
NCSC UK's CEO puts a number on hostile-state activity — three-quarters of attacks on UK critical systems. The figure, drawn from a year of incident response, reframes the threat as a sustained contest.
Supply Chain Attack
Another contributor-account compromise hits the JavaScript ecosystem — defenders using Mastra packages have inventory and rotation work this week.
Vulnerabilities
CISA's KEV addition is the defender's signal to verify Joomla JCE patches across managed deployments, confirming every Content Editor install is on the fixed 2.9.99.5 build before automated scanning reaches it.