Poisoned Code, FBI Botnet Bust & the Convicted Felons Buying Zero-Days
Sunday, July 12, 2026 · 5-minute read
Researchers at SentinelOne revealed that hackers linked to both China and India spent over two years quietly burrowing into Pakistani law enforcement systems — at the same time, independently. The compromised servers held biometric records, criminal case files, hotel guest registrations tied to national ID numbers, and police personnel data. One hacking group even disguised their malware as a routine update to a police complaint portal, so officers installing what looked like an official patch were actually letting spies in.
This is a rare case where two separate state-sponsored espionage campaigns hit the same target without knowing about each other. It shows how valuable police databases — full of identities, movements, and criminal records — have become to foreign intelligence services.
↗ The Hacker NewsThe FBI seized hundreds of domains tied to NetNut, a residential proxy network operated by Israeli-listed company Alarum Technologies. Security researchers had connected NetNut to a botnet called Popa — roughly two million compromised devices, including smart TVs and streaming boxes in people's homes. The software turned those devices into always-on relay points that criminals could rent to hide their activity while running scams, scraping websites, or breaking into accounts. Google said it tracked 316 separate groups of bad actors using NetNut's network in just a single week in June 2026.
↗ Krebs on SecurityDutch police say they have strong evidence that local hackers were behind a February breach at Odido, one of the Netherlands' largest mobile carriers. Meanwhile, a former ransomware negotiator — someone companies hire to deal with criminals who lock up their files — was sentenced to 70 months in prison after it emerged he was secretly working both sides: negotiating for victims while also helping carry out ransomware attacks using the BlackCat group. The sentence is a warning that even people trusted as responders can be bad actors.
↗ BleepingComputerTwo separate software supply chain attacks hit developers hard this week. First, the popular jscrambler npm package was quietly replaced with a malicious version (8.14.0) that ran hidden malware the moment anyone installed it. The malware — a so-called infostealer — worked on Windows, macOS, and Linux. Security firm Socket spotted it just six minutes after it was published, but anyone who downloaded it in that window was already compromised.
Second, attackers broke into the GitHub account of a trusted developer at Injective Labs and used it to push a fake version of the @injectivelabs/sdk-ts package. That version silently grabbed private keys and seed phrases from crypto wallets and sent them to the attackers. The malicious release was pulled from the official registry, but the files are still downloadable directly from GitHub.
[email protected] or @injectivelabs/[email protected]. If either was installed, treat that machine as compromised and rotate all credentials immediately. Everyone else: this is a good reminder to only install software from sources you've verified.Progress Software — the company behind the ShareFile secure file-sharing platform — sent an urgent email to customers telling them to immediately shut down the Windows servers running their on-premises Storage Zone Controllers. Progress says it found a "credible external security threat" but has not explained what the threat actually is or who is behind it. The news broke publicly when a frustrated customer posted the company's email to Reddit. Progress says it has no evidence that any data was actually accessed — but the fact that they asked customers to shut systems down themselves, rather than issuing a patch, suggests the situation is serious and still developing.
Zimbra's email platform has a critical flaw in its Classic Web Client. An attacker can send you a specially crafted email and — just by you opening it — run malicious code inside your browser session. That code could read your emails, steal your login session, or change your account settings without you noticing. This is called a stored XSS vulnerability — the malicious payload sits inside the email itself and fires the moment the message is opened.
Status: Patch available — Zimbra is urging all customers to update immediately. No CVE number has been assigned yet, but the severity is confirmed critical.
Hackers are actively exploiting a critical bug in the official Docker image for Gitea, a popular self-hosted Git service used by software teams. The flaw lets an attacker completely bypass authentication — meaning they can log in as any user, including administrators, without knowing any password. Active exploitation is already confirmed in the wild, so this needs immediate attention from anyone running Gitea via Docker.
Status: Actively exploited. If you run Gitea using the official Docker image, update or apply mitigations immediately.
Six vulnerabilities were found in U-Boot, a piece of software used in countless embedded and IoT devices — think routers, industrial equipment, and smart home gadgets. The bootloader runs before the operating system even starts, so flaws here can let attackers install persistent malware that survives factory resets and is nearly invisible to normal security tools. These bugs could allow malicious code to run at the deepest level of a device's startup process.
Status: Fixes are in development. Users of affected embedded devices should monitor vendor advisories closely.
Security researchers demonstrated a technique called "Ghostcommit" that hides a prompt injection inside an ordinary-looking PNG image file. When an AI coding assistant reviews a pull request containing that image, it never actually opens the image — so it misses the hidden instruction entirely. The injected command then convinces the AI agent to read the project's .env file (which holds passwords and API keys) and write every secret into the code disguised as a list of numbers, where a human reviewer might not notice it. The technique successfully fooled two popular AI code review tools, CodeRabbit and Bugbot. This matters because more and more teams are trusting AI assistants to catch security problems in code — and this shows those assistants have blind spots attackers can exploit.
A company called IRIS C2 has been posting on social media promising to pay researchers up to $7 million for undiscovered software vulnerabilities — the kind of flaws that nobody has found yet and no patch exists for. That sounds exciting, maybe even legitimate. But investigative journalist Brian Krebs dug into who's actually running it, and the answer is remarkable.
IRIS C2 is operated through a Virginia company called Calvexa Group LLC, which traces back to Jack Burkman and Jacob Wohl — a pair best known for running fake intelligence operations, fabricating sexual assault allegations against public figures, and organizing an illegal robocall campaign designed to suppress Black voter turnout in 2020. Both were convicted felons by late 2025. Their previous ventures included fake intelligence firms and an AI lobbying platform they ran under assumed names. Now they appear to be trying to enter the world of zero-day exploit brokering, dangling huge payouts to attract young, talented security researchers.
Why does this matter to regular people? The market for undisclosed software vulnerabilities is largely unregulated. When a legitimate company or government agency buys a zero-day, there's at least some accountability. When convicted fraudsters do it — people with a documented history of operating under false identities and weaponizing information — the destination of those exploits becomes a very uncomfortable question. A zero-day in a major platform like Windows or iOS, in the wrong hands, could be used to spy on journalists, political opponents, or ordinary people.
Watch this story closely. Krebs's investigation has put a spotlight on IRIS C2 right as it was recruiting. Whether regulators, federal contractors, or the security research community respond — and how — will say a lot about whether the zero-day market has any guardrails at all.