Ransomware Operators Keep Business Hours. The Data Proves It
2026-06-02T02:51:52Z•92b62f979cbcabda8954fcc981af3c01b1176647a4063397227b49d8c94dd63f
CVE-2026-0257CVE-2026-26980CVE-2026-8732charter-communicationscifswitchcisa-kevdata-leakgeolocationghost-cmslazaruslinux-privilege-escalationlocation-datapalo-altopan-osransomwareransomware-timingremotepeshinyhunterssignal-phishingsupply-chaintrapdoorwordpresswp-maps-pro
What happened
Feed of Security Affairs articles covering multiple active and high-impact issues: analysis of 16,699 ransomware leak-site posts showing operators’ activity follows business hours (European-afternoon peaks, yearly October spikes); CVE-2026-8732 in WP Maps Pro allows unauthenticated creation of WordPress admin accounts (plugin ~15k installs; 2,858 attack attempts blocked in 24h); CIFSwitch — a 19-year-old Linux logic bug enabling root via forged CIFS auth keys affecting distributions like Mint, CentOS, Rocky, Kali, SLES; CVE-2026-0257 (PAN-OS GlobalProtect) added to CISA KEV after active abuse—
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- securityaffairs
- Record identifier
- 92b62f979cbcabda8954fcc981af3c01b1176647a4063397227b49d8c94dd63f
- Enrichment time
- 2026-06-02T02:51:52Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.