This week has already been rough for cybersecurity. Critical PHP and GitLab RCE flaws, serious Linux security bugs, compromised eMudhra certificates, a Node.js RCE flaw, a hacked LiteLLM release, and hundreds of hijacked Tor relays. That's a lot to deal with in just a few days. And the week isn't even over yet.

But those big headlines are only half the story. Stolen passwords, exposed databases, broken login checks, and trusted tools being turned against their users are causing trouble too. Some attacks are clever. Others work because someone left a simple security gap open.

This ThreatsDay, we're digging into the stories that didn't make as much noise but still deserve attention. Some are strange, some are serious, and a few might surprise you. Here's everything else you shouldn't miss this week.

The threats change every week. Subscribe, and we’ll alert you when each new ThreatsDay Bulletin is out.

Bluesky has acknowledged it's aware of a phishing attack that has compromised more than 4,500 accounts. "The attack spread through posts promoting a fake offer of a government payment," Bluesky said. "We have temporarily suspended the compromised accounts and are working with their owners to secure them and restore access. If your account was suspended, email moderation@blueskyweb.xyz and we will help to get you back into your account."

The Singapore Police Force has alerted users of a malware-enabled scam variant involving advertisements on social media platforms promoting senior-focused activities and programmes, water-based fitness activities, and recycling initiatives.

Source link