U.S. court sentences Karakurt ransomware negotiator to 8.5 years

Multiple high-impact cyber incidents and vulnerabilities were reported: a Latvian linked to the Karakurt ransomware group was sentenced to 8.5 years for money laundering and fraud; Vimeo confirmed a third‑party vendor compromise (Anodot) and a ShinyHunters data theft affecting ~119K users; and Instructure is investigating a breach potentially impacting thousands of schools. Several critical vulnerabilities were disclosed or actively exploited — Google patched Android RCE CVE-2026-0073; Progress fixed MOVEit Automation flaws CVE-2026-4670 (auth bypass) and CVE-2026-5174 (privilege escalation);/