Supply Chain Bust, Crypto Drained, and Your Phone Just Got a Big Privacy Upgrade
Friday, August 28, 2026 · 5-minute read
A Chinese-speaking hacking group broke into a nuclear research body in the Philippines by exploiting a critical flaw in ownCloud, a file-sharing platform used by many organizations. The bug — CVE-2023-49105 — lets an attacker read, change, or delete any file without ever logging in, as long as they know the victim's username. CISA added the flaw to its official "exploited in the wild" list this week, meaning you should treat it as an active emergency if your organization runs ownCloud.
↗ The Hacker NewsAustralian federal police arrested two men from Western Australia, aged 21 and 23, accused of being part of TeamPCP — a cybercrime group that hid malicious code inside hundreds of popular open-source software tools to steal from thousands of companies worldwide. The group used a self-spreading program called Shai-Hulud to keep infecting new developer networks in a repeating cycle, and even ran a public hacking contest to recruit new members. The arrests follow months of investigative reporting and cooperation with international security firms.
↗ Krebs on SecurityThe Manchester Airports Group (MAG), which runs Manchester, Stansted, and East Midlands airports, confirmed that hackers broke into its systems and walked away with customer data — including details from Wi-Fi sign-ups at all three airports. If you've connected to airport Wi-Fi at any of these locations, your personal information may be in the mix. The group has not disclosed exactly how many people were affected.
↗ BleepingComputerAttackers are actively exploiting two security bugs in PaperCut NG and MF, software used by schools, hospitals, and businesses to manage office printing. By combining the two flaws, a hacker can send a specially crafted request to the software and gain complete control over the server — no username or password needed. Researchers at Huntress discovered that attackers can trick PaperCut's permission system into trusting the wrong page, slipping past its security checks entirely. PaperCut has already released one emergency fix, and then released a second emergency fix this week after researchers found ways around the first patch.
Security researchers at Socket found 19 browser extensions — 18 for Chrome and one for Edge — that secretly stole cryptocurrency from users' wallets. The scheme was sneaky: the attackers either bought existing, legitimate extensions with real user bases, or published clean versions first to build trust. Once the extension had enough downloads, they pushed an update that silently added the wallet-stealing code. The campaign may have been running since early 2024, and all 19 extensions were published in the last six months.
This flaw in ownCloud's WebDAV API lets anyone access, modify, or delete files without logging in — as long as they know a valid username and the account has no special signing key set up, which is the default. A Chinese-linked group used this exact bug to steal nuclear research records from a Philippine government body. CISA has now added it to its must-patch list.
Status: Patch available — upgrade to ownCloud core version 10.13.1 or later immediately.
A critical bug in the shared Cosmos EVM module let attackers manipulate account balances and drain real funds. Six separate blockchains were hit between August 20 and 25. Cosmos Labs had known about the bug since April but originally assessed it as low risk — a judgment that turned out to be wrong. The fix requires a coordinated network upgrade; chains that can't upgrade immediately are being told to shut down entirely rather than remain exposed.
Status: Patches released in v0.6.2 and v0.7.2 on August 19. Chain operators must upgrade or halt.
ServiceNow — software used by IT and HR departments at large organizations worldwide — patched three maximum-severity vulnerabilities this week. The bugs could let attackers inject malicious code, manipulate the database with SQL injection, or escalate their own privileges to gain admin-level control. If your company uses ServiceNow, assume your IT team needs to apply these patches urgently.
Status: Patches released by ServiceNow this week — contact your IT or system admin to confirm they're applied.
GiveWP is a popular plugin used by nonprofits and charities to collect donations on WordPress sites. A newly discovered bug lets anyone — without logging in — run commands directly on the server hosting the site. That means an attacker could steal donor data, deface the site, or use it to attack visitors. If you run a WordPress site with GiveWP installed, this needs immediate attention.
Status: Update GiveWP to the latest version through your WordPress dashboard immediately.
Google's Android 17 adds built-in support for Encrypted Client Hello (ECH), a new privacy technology that prevents your mobile carrier, home internet provider, or anyone snooping on your network from seeing which websites or apps you're accessing. Previously, even if a website used HTTPS, the domain name of the site you were visiting was still visible in plain text during the initial connection handshake. ECH encrypts that too, from the very first moment of contact. Combined with Android's existing private DNS feature, this makes it significantly harder for network-level trackers to build a profile of your browsing habits. The feature works automatically for apps and websites that support it — no configuration needed.
When you install an app or a software update, you trust that the code inside it is safe. TeamPCP spent the better part of a year systematically breaking that trust — and this week, two of its alleged members were arrested in Western Australia. The story of how they did it is a masterclass in how modern cybercrime can spiral far beyond what two people could ever pull off alone.
TeamPCP's core trick was a software supply chain attack. Think of it like poisoning a water treatment plant instead of individual water bottles. The group compromised tools that software developers use every day — code libraries, extensions, and utilities hosted on platforms like GitHub and NPM. Once those tools were infected, they spread a self-propagating worm called Shai-Hulud to every developer who downloaded them. Those developers' credentials were then stolen, giving TeamPCP access to the next layer of tools — and so the cycle repeated. At its peak, the group claimed to have infected more than 3,800 code repositories at GitHub alone, and stole cloud keys from over 2,500 organizations after hitting LiteLLM, an AI tool used by many of the world's largest tech companies.
What made TeamPCP particularly dangerous wasn't just technical skill — it was how they scaled. They published the source code for their worm publicly and ran a contest, offering $1,000 in cryptocurrency to whoever could compromise the most popular software packages using it. Security firm Dataminr called this "talent identification at scale." The group wasn't just hacking; it was recruiting. The arrested suspects communicated through a private Matrix chat server called "Cybercats," whose administrator allegedly used his real Twitter/X handle — making it easier for investigators to eventually connect the dots.
The arrests are good news, but they're not the end of the story. Security experts say TeamPCP was never a tightly organized crew — it was a loose community of skilled individuals who occasionally worked together. The tools, the worm's source code, and the stolen access they gathered are still out there. Watch for follow-on arrests and for organizations to begin disclosing breaches linked to this group in the weeks ahead. If your company uses open-source software (and almost every company does), now is a good time to ask your IT team what tools you rely on and whether any were flagged in this investigation.