The jscrambler supply chain attack involved a malicious preinstall hook within version 8.14.0 of the npm package.

The ACSC reports that malicious actors are actively scanning websites for vulnerabilities in various CMS platforms and plugins, including WordPress, Craft CMS, MaxSite CMS, MetInfo CMS, and Joomla JCE.

The campaign reportedly centers around a website known as "GdeBenz," which has attracted over one million visitors.

The vulnerabilities, CVE-2026-48939 affecting iCagenda and CVE-2026-56291 affecting Balbooa Forms, both allow for unrestricted file uploads.

The compromised assets included servers hosting web applications that manage critical police and citizen data, such as criminal and biometric records, hotel and tenant registrations, and personnel files.

The vulnerabilities, found in U-Boot's FIT signature verification code, range from denial of service to arbitrary code execution.

ScamBuster operates by responding to incoming phishing emails with an AI-driven persona designed to appear as a gullible victim, such as an elderly individual or a novice business owner.

Matt Burch, a principal security researcher at Atredis Partners, will present his findings on CryptoPro Secure Disk at Black Hat USA 2026.

QiAnXin, a Chinese cybersecurity company, reported that while the group's operations may appear unsophisticated due to the use of SEO poisoning and counterfeit software installers, their organizational structure is more complex, involving multiple distributors.

The APS-ONE-400, part of Keysight's APS-100/400-gigabit Ethernet (GE) hardware line, offers 400 Gb/s Layer 4-7 throughput and 95 Gb/s of elephant flow throughput, addressing the substantial data transfers common in AI applications.