The Signal
Must Know
Incident · Securityaffairs
What happened
A cybersecurity incident forced UNM Health to divert ambulances, cancel appointments, suspend outpatient care, and temporarily stop accepting new patients while it contained the threat. [1]
UNM Health operates New Mexico’s only Level 1 trauma center, which treats the most serious and complex injuries; the disruption left the state without an emergency department able to treat the most serious injuries. [1]
Why it matters
The organization told patients not to come to its main Albuquerque hospital, canceled appointments across more than 30 clinics, and diverted ambulance traffic to other hospitals. [1]
For critical-care organizations, operational resilience warrants attention alongside protection of information and systems. [1]
Cloud · Theregister Security
What happened
The *sshole vulnerability can permit root or other password-disabled accounts to be accessed with a 257–1,024-character password when specific musl Linux and OpenSSH conditions are met. [2]
Affected systems use musl libc, run OpenSSH without PAM, enable password authentication, have an asterisk-marked target account, and have at least one other account with a valid password hash. [2]
Why it matters
Musl is common in embedded Linux and is the standard C library for Alpine Linux, including official AWS and Azure cloud images; some systems may therefore be vulnerable depending on configuration. [2]
Asset inventories need deployment detail sufficient to distinguish relevant conditions from broad platform exposure. [2]
AI & Agents · Theregister Security
What happened
OpenAI released GPT-6 Cyber, describing it as a cybersecurity-tuned model intended to improve vulnerability discovery and exploitation while adhering to researchers’ authorized rules of engagement. [3]
In OpenAI’s ExploitGym evaluation, GPT-6 Cyber scored 48.5%, compared with 32.1% for GPT-5.6 Cyber on the same benchmark tests. [3]
Why it matters
OpenAI classified GPT-6 Cyber as Critical, its highest cyber-capability risk tier, describing that tier as including functional zero-day exploit development in real-world critical systems and end-to-end cyberattacks. [3]
Security teams assessing such models should consider stated research constraints alongside the model’s stated capability classification. [3]
Exploitation · Arstechnica Security
What happened
Researchers said hackers possibly linked to the Kremlin exploited previously patched iOS and Android flaws while targeting visitors to multiple websites. [4]
Researchers assessed with moderate to high confidence that the attackers were part of Russia’s Foreign Intelligence Service and targeted sites connected to Russia’s war against Ukraine. [4]
Why it matters
The campaign impersonated america250.org through the domain america250[.]holiday, which acted as a reverse proxy to the legitimate site. [4]
Threat reviews should account for adversaries’ targeting context, not only whether a flaw was previously patched. [4]
Also Worth Knowing
Identity · Malwarebytes Labs
What happened
mSecure’s developer, mSeven Software, warned current and former customers about suspicious activity associated with the mSecure password-management application and said it launched an investigation, took mitigation steps, and engaged external cybersecurity experts. [5]
Exploitation · Helpnetsecurity
What happened
Binarly found that Zyxel GS1900 series switches remained exposed to an exploit reportedly used in the wild, despite receiving a fix for a flaw. [6]
Incident · Arstechnica Security
What happened
Binance said hackers spent months targeting the exchange, using social engineering and novel malware; the FBI and TRM Security attributed the heist to North Korean actors. [7]