The Signal
The selected items reward careful boundary-setting: their evidence ranges from observed campaigns and incident statements to formal verification. That range calls for different confidence levels, and their operational implications should remain distinct rather than treated as one connected development. [1][2][3]
Must Know
Identity · Theregister Security
What happened
Huntress reported an active campaign using a third-party ScreenConnect extension to push malware to at least 288 machines across 48 organizations; six MSPs and more than 286 endpoints were initially tracked. [1]
Huntress observed attackers using ScreenConnect’s remote command feature to install rogue clients, with all 288 endpoints hit within 90 minutes and about one-third compromised in the first 10 minutes. [1]
Why it matters
Huntress said SCKit may attempt to transfer malware to a technician’s workstation, steal authentication cookies, and use that access to reach other machines, but it has not observed that spreading method succeed; console-takeover attempts failed in every recovered host log checked. [1]
Cloud · The Hacker News
What happened
Aikido Security said an attacker used stolen credentials for 4,837 GitHub accounts to plant a secret stealer in repositories those accounts could write to. [4]
The stealer was designed to take secrets and cloud credentials accessible to a repository’s CI workflows. [4]
Why it matters
The incident links developer-account governance to CI credential boundaries, without making repository access equivalent to cloud-account control. [4]
Incident · Securityaffairs
What happened
Maersk said it identified unauthorized access and data extraction from a local legacy system inherited through a previous acquisition; it said the affected system was secured and the investigation continued. [2]
WhiteArmor claimed responsibility for about 100 GB of stolen data from the OCF/LF Logistics platform and demanded a $5 million Bitcoin ransom with a 30-day payment deadline. [2]
Why it matters
The article says a breach of an older local platform could expose business and personal information belonging to drivers, customers, and logistics partners even if Maersk’s main systems remain unaffected. [2]
AI & Agents · Arstechnica Security
What happened
Google DeepMind researchers used agentic AI to formally verify several key cryptographic guarantees of the Signal protocol. [3]
The proof-of-concept project was conducted in four weeks and used Google DeepMind’s AlphaProof Code framework. [3]
Why it matters
The work is described as independent validation of cryptography protecting communications on Signal, Google Messages, and WhatsApp. [3]
Also Worth Knowing
Incident · Malwarebytes Labs
What happened
Vanderbilt University is bringing systems back online after a cybersecurity incident claimed by the BYOD ransomware group. [5]
The analytical boundary is between unverified group claims and the institution’s confirmed recovery posture; keeping them separate avoids converting an extortion narrative into established incident scope. [5]
Exploitation · The Hacker News
What happened
PTC released patches for a critical vulnerability affecting Windchill and FlexPLM that could enable remote code execution if successfully exploited. [6]
Its significance rests on the affected applications’ enterprise role, where remote reachability changes the exposure question from local maintenance to service-facing risk. [6]
AI & Agents · Sans Isc Diary
What happened
CVE-2026-102895 is described as a trivial authentication-bypass vulnerability affecting GPUStack, open-source software for managing GPU clusters used for AI workloads. [7]
AI workload management is distinct from the workloads it orchestrates: an authentication boundary in the control layer can have consequences beyond an individual compute task. [7]