Know what changed.
Trace why it matters.

Unknown attackers used compromised Qubole AWS IAM credentials to access customer AWS environments, steal secrets and other sensitive data from S3, and abuse Qubole’s cross-account IAM trust relationship. Wiz described the activity as a broad, opportunistic supply-chain campaign affecting multiple customer environments, although it did not disclose the number affected.

Researchers said active trust policies left after Qubole deprecation enabled attackers to assume integration roles, enumerate resources, harvest secrets and siphon data. A deprecated integration relationship is part of the exposure boundary here, not merely a credential-access issue.

Researchers report active exploitation of the critical *sshole vulnerability, which arises from interaction between OpenSSH and the musl library and can affect Linux systems meeting additional requirements. On affected systems, the vulnerability can provide unauthenticated access to high-privilege accounts within seconds.

Greynoise said its Southeast Asian honeypots were attacked by a group it tracks as GT10, describing the activity as mature intrusions. Assessment should distinguish systems meeting the stated additional requirements from Linux systems generally.

U.S. agencies urged critical-infrastructure organizations to secure industrial refrigeration and cold-chain monitoring systems after reported attacks involving French blood banks and European supermarkets. The agencies said attackers are targeting refrigeration controllers through unpatched vulnerabilities, misconfigurations, and weak or hard-coded passwords, then using remote access to manipulate temperatures and spoil food, blood, or other products.

The agencies said temperature changes could damage refrigerated products and trigger fire hazards, creating risks for healthcare, food and agriculture, chemicals, and transportation operations. The potential safety effects place this in a different operational risk category from ordinary information exposure.