Supply Chain Gang Busted, Berlin Refuses to Pay, and PaperCut Patches Twice in One Week
Saturday, August 29, 2026 · 5-minute read
Berlin's state government confirmed this week that hackers broke into its administrative network and stole data between August 7 and 14. The attackers are now demanding a ransom payment — and are threatening to publish 5.79 terabytes of files. Berlin is refusing to pay, which is the recommended approach: paying rarely stops leaks and funds future attacks.
Forensic investigators found that Berlin's Senate Department for Mobility, Transport, and Environment was hit hardest. Personal data of residents and staff may be included in what was taken, though the full picture is still being worked out.
↗ The Hacker NewsAustralian Federal Police arrested two men from Western Australia — aged 21 and 23 — accused of being part of TeamPCP, a software supply chain attack group. The gang spent months embedding malware into open-source software tools, infecting thousands of companies — including a wave of attacks on AI infrastructure giant LiteLLM and over 3,800 repositories on GitHub.
What made TeamPCP unusually dangerous was its self-reinforcing cycle: steal developer credentials, poison their software, infect more developers, repeat. Krebs on Security identified the alleged ringleader as George Prepakis, who used the handle @kernelstub on X and ran a Matrix chat server called "Cybercats" to coordinate with criminal associates.
↗ Krebs on SecurityA Chinese-speaking hacking group used a known vulnerability in ownCloud — a self-hosted file storage platform — to break into a nuclear research body in the Philippines and steal files. The flaw (CVE-2023-49105) lets attackers access, change, or delete any file without needing a password, as long as they know a username. The U.S. cybersecurity agency CISA added it to its official "must-patch" list this week.
↗ The Hacker NewsPaperCut — software used by thousands of schools, universities, and businesses to manage office printers — is under active attack right now. Hackers found a way to take full remote control of any unpatched PaperCut server without needing a username or password. PaperCut released an emergency patch, but researchers at Huntress quickly discovered attackers could bypass it by chaining two flaws together. A second emergency patch is now out. If your workplace uses PaperCut, your IT team needs to apply the latest update immediately — older fixes are not enough.
Healthcare distribution giant McKesson disclosed a breach this week after the ShinyHunters extortion group claimed it stole 284 million patient records from a third-party application McKesson uses. If accurate, this would be one of the largest healthcare data breaches ever recorded. The stolen data likely includes names, contact details, and medical information — exactly the kind of data used for medical identity theft.
An attacker who knows any user's username can access, modify, or delete every file on the server — no password required. This is possible because the WebDAV API skips its authentication check when a user has no signing key set, which is the default out-of-the-box setting. Real-world exploitation has now been confirmed against a nuclear research organization.
Status: Patch available — upgrade to ownCloud core version 10.13.1 or later immediately. Now on CISA's mandatory patch list for U.S. federal agencies.
A flaw in the shared Cosmos EVM module allowed attackers to manipulate account balances and drain funds. Six separate blockchain networks were exploited between August 20–25. The vulnerability was actually reported in April but was incorrectly judged to pose no real-world risk — a costly mistake that resulted in real money being stolen.
Status: Fix shipped in versions 0.6.2 and 0.7.2 on August 19. Chain operators must upgrade immediately or halt their network — leaving it running unpatched is not safe.
GiveWP is a popular donation plugin used on tens of thousands of WordPress charity and nonprofit websites. A maximum-severity flaw lets any visitor — without logging in — run commands directly on the web server hosting the site. That means an attacker could steal donor data, deface the site, or use the server to attack other systems. If your nonprofit or charity uses GiveWP, this is urgent.
Status: Update GiveWP to the latest patched version immediately via your WordPress dashboard. WordPress plugins are a frequent entry point for attackers.
Google's Android 17 quietly ships one of the most meaningful privacy upgrades in years: built-in support for Encrypted Client Hello (ECH). Before ECH, even if a website used HTTPS, your internet provider could still see exactly which sites you visited. ECH closes that gap by encrypting the destination website name right from the start of the connection. Combined with Private DNS, Android 17 makes it significantly harder for mobile carriers, Wi-Fi operators, or network snoopers to build a profile of your online activity. The feature works automatically on supported websites and apps — you don't need to do anything.
The privacy-focused Brave browser released version 1.94 with a new "Email Aliases" feature. When you sign up for a new service, Brave can generate a throwaway email address that forwards to your real inbox — so sites never learn your actual email. This makes it much harder for companies to track you across the web, and if a site gets breached, your real email address stays private. It's a feature previously found only in standalone tools like SimpleLogin or Apple's Hide My Email, now baked directly into the browser.
Imagine a criminal gang that didn't break into banks directly — instead, they poisoned the printing presses that banks use to print their forms. That's roughly what TeamPCP did to the internet's software ecosystem, and this week Australian police made their first arrests in the case.
TeamPCP's trick was elegant and brutal. Developers around the world rely on shared, open-source software libraries — free code that anyone can use and build on. TeamPCP targeted the developers who maintain these libraries. They phished or stole login credentials from coders, then used those credentials to slip malicious code into the libraries quietly. When other developers downloaded updates, they unknowingly installed the malware. That malware then stole their credentials too, letting TeamPCP infect even more libraries. The cycle repeated for months. In March, the group hit LiteLLM — a widely used tool for connecting to AI models — and harvested cloud access keys from more than 2,500 organizations. In May, they claimed to have compromised over 3,800 GitHub code repositories after a single developer installed a poisoned extension. To accelerate growth, they even ran a hacking contest: $1,000 in cryptocurrency to whoever could poison the most-downloaded software packages. Security firm Dataminr noted the prize was described as a "participation trophy" — the real payment came if you found something valuable.
For regular people, attacks like this are invisible until the damage is done. You didn't install anything suspicious. The software your bank, hospital, or employer uses did — and that's enough. The apps and services you rely on every day are built on thousands of these shared software components. When even one gets poisoned, the effects ripple outward unpredictably. The McKesson breach of 284 million patient records announced this same week is a reminder of what that downstream damage can look like.
The arrests are significant, but TeamPCP was described by Google's threat analysts as a loose community rather than a tight-knit crew. The alleged ringleader's habit of publicly taunting victims on X — and linking his real identity to his hacker handle — likely gave investigators the trail they needed. Watch for extradition proceedings and for whether other Cybercats chat members face charges next.