A ransomware negotiator has been sentenced to 70 months in prison for aiding the BlackCat ransomware group in its attacks. The individual acted as a liaison between the criminals and victims, helping to facilitate ransom payments. This case highlights the legal crackdown on intermediaries who enable ransomware operations.

Researchers have uncovered a new Windows backdoor named GigaWiper that bundles multiple malicious functions: it can wipe disks, deploy fake ransomware for extortion, and install spyware. This multi-purpose threat poses a significant risk to organizations by combining destructive data destruction with espionage and ransom demands.

npm version 12 now disables package install scripts by default, a major security change to prevent supply chain attacks. The move means packages cannot automatically run arbitrary code during installation unless explicitly enabled by developers. This reduces the risk of malicious scripts compromising systems, which has been a growing concern in the JavaScript ecosystem.

Researchers discovered that leading AI security agents designed to detect malicious code can be manipulated into executing it instead. This vulnerability undermines trust in AI-powered defenses and could allow attackers to bypass automated security checks. The findings highlight critical weaknesses in relying solely on AI for code safety.

Cybercriminals are distributing counterfeit 7-Zip installers that secretly turn infected computers into residential proxy nodes. This allows attackers to route malicious traffic through victims' IP addresses, enabling ad fraud, credential theft, and other cybercrimes. Users should download software only from official sources to avoid compromising their devices.

Researchers have discovered a novel attack called HalluSquatting that exploits AI coding assistants by generating plausible but malicious code snippets. These snippets can trick developers into installing botnet malware during routine use. This attack poses a significant threat to software supply chains and developer security.

Ubiquiti has released patches for critical vulnerabilities affecting its UniFi platform, including Connect, Talk, Access, Protect, and OS products. The flaws could allow attackers to compromise devices or gain unauthorized network access. Users are urged to apply the updates immediately to prevent potential exploits.

A new wave of ghost phishing attacks is bypassing conventional email security measures by using transient accounts to send deceptive emails. This technique makes detection difficult for traditional filters, posing a significant threat to organizations reliant on standard defenses.

Researchers discovered a vulnerability in Git's commit signing process that allows attackers to rewrite verified commits on GitHub without invalidating their signatures. This undermines the trust in commit verification, potentially enabling malicious code to be disguised as coming from a trusted source. The flaw highlights a critical gap in code integrity for repositories relying on verified commits for security.