• A new distribution method for the NWHStealer infostealer that leverages the Bun JavaScript runtime, marking a significant evolution in the malware’s delivery infrastructure. The threat actors behind this Rust-based stealer are exploiting Bun’s relative newness and high-performance capabilities to package malicious code into larger executables that evade traditional detection methods. Bun is a legitimate, fast […]

    The post NWHStealer Campaign Deploys Bun Loader, Anti-VM Evasion, and Encrypted C2 appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Vercel has rolled out vital security updates for Next.js to address a wave of high-severity vulnerabilities affecting versions across the 13.x to 16.x branches. Published via GitHub advisories by Tim Neutkens, these flaws expose web applications to severe risks, including unauthenticated Denial of Service (DoS), Server-Side Request Forgery (SSRF), and multiple middleware authentication bypasses. The […]

    The post Multiple Critical Flaws Fixed in Next.js and React Server Components appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • An ongoing data extortion attack targeting the widely-used education technology platform Canvas disrupted classes and coursework at school districts and universities across the United States today, after a cybercrime group defaced the service’s login page with a ransom demand that threatened to leak data from 275 million students and faculty across nearly 9,000 educational institutions.

    A screenshot shared by a reader showing the extortion message that was shown on the Canvas login page today.

    Canvas parent firm Instructure [NYSE:INST] responded to today’s defacement attacks by disabling the platform, which is used by thousands of schools, universities and businesses to manage coursework and assignments, and to communicate with students.

    Instructure acknowledged a data breach earlier this week, after the cybercrime group ShinyHunters claimed responsibility and said they would leak data on tens of millions of students and faculty unless paid a ransom. The stated deadline for payment was initially set at May 6, but it was later pushed back to May 12.

    In a statement on May 6, Instructure said the investigation so far shows the stolen information includes “certain identifying information of users at affected institutions, such as names, email addresses, and student ID numbers, as well as as messages among users.” The company said it found no evidence the breached data included more sensitive information, such as passwords, dates of birth, government identifiers or financial information.

    The May 6 update stated that Canvas was fully operational, and that Instructure was not seeing any ongoing unauthorized activity on their platform. “At this stage, we believe the incident has been contained,” Instructure wrote.

    However, by mid-day on Thursday, May 7, students and faculty at dozens of schools and universities were flooding social media sites with comments saying that a ransom demand from ShinyHunters had replaced the usual Canvas login page. Instructure responded by pulling Canvas offline and replacing the portal with the message, “Canvas is currently undergoing scheduled maintenance. Check back soon.”

    “We anticipate being up soon, and will provide updates as soon as possible,” reads the current message on Instructure’s status page.

    While the data stolen by ShinyHunters may or may not contain particularly sensitive information (ShinyHunters claims it includes several billion private messages among students and teachers, as well as names, phone numbers and email addresses), this attack could hardly have come at a worse time for Instructure: Many of the affected schools and universities are in the middle of final exams, and a prolonged outage could be highly damaging for the company.

    The extortion message that greeted countless Canvas users today advised the affected schools to negotiate their own ransom payments to prevent the publication of their data — regardless of whether Instructure decides to pay.

    “ShinyHunters has breached Instructure (again),” the extortion message read. “Instead of contacting us to resolve it they ignored us and did some ‘security patches.’”

    A source close to the investigation who was not authorized to speak to the press told KrebsOnSecurity that a number of universities have already approached the cybercrime group about paying. The same source also pointed out that the ShinyHunters data leak blog no longer lists Instructure among its current extortion victims, and that the samples of data stolen from Canvas customers were removed as well. Data extortion groups like ShinyHunters will typically only remove victims from their leak sites after receiving an extortion payment or after a victim agrees to negotiate.

    Dipan Mann, founder and CEO of the security firm Cloudskope, slammed Instructure for referring to today’s outage as a “scheduled maintenance” event on its status page. Mann said Shiny Hunters first demonstrated they’d breached Instructure on May 1, prompting Instructure’s Chief Information Security Officer Steve Proud to declare the following day that the incident had been contained. But Mann said today’s attack is at least the third time in the past eight months that Instructure has been breached by ShinyHunters.

    In a blog post today, Mann noted that in September 2025, ShinyHunters released thousands of internal University of Pennsylvania files — donor records, internal memos, and other confidential materials — through what the Daily Pennsylvanian and other outlets later determined was, in part, a Canvas/Instructure-mediated access path.

    “Penn was the named victim,” Mann wrote. “Instructure was the mechanism. The incident was treated as a Penn-specific story by most of the national press and quietly handled by Instructure as a customer-specific matter. That framing was wrong then. It is dramatically more wrong in light of the May 2026 events, which now look like the planned escalation of an attack pattern that ShinyHunters had been working against Instructure’s environment for at least eight months prior. The September 2025 Penn breach was the proof of concept. The May 1, 2026 incident was the production run. The May 7, 2026 recompromise was ShinyHunters demonstrating publicly that the May 2 ‘containment’ did not happen.”

    In February, a ShinyHunters spokesperson told The Daily Pennsylvanian that Penn failed to pay a $1 million ransom demand. On March 5, ShinyHunters published 461 megabytes worth of data stolen from Penn, including thousands of files such as donor records and internal memos.

    ShinyHunters is a prolific and fluid cybercriminal group that specializes in data theft and extortion. They typically gain access to companies through voice phishing and social engineering attacks that often involve impersonating IT personnel or other trusted members of a targeted organization.

    Last month, ShinyHunters relieved the home security giant ADT of personal information on 5.5 million customers. The extortion group told BleepingComputer they breached the company by compromising an employee’s Okta single sign-on account in a voice phishing attack that enabled access to ADT’s Salesforce instance. BleepingComputer says ShinyHunters recently has taken credit for a number of extortion attacks against high-profile organizations, including Medtronic, Rockstar Games, McGraw Hill, 7-Eleven and the cruise line operator Carnival.

    The attack on Canvas customers is just one of several major cybercrime campaigns being launched by ShinyHunters at the moment, said Charles Carmakal, chief technology officer at the Google-owned Mandiant Consulting. Carmakal declined to comment specifically on the Canvas breach, but said “there are multiple concurrent and discreet ShinyHunters intrusion and extortion campaigns happening right now.”

    Cloudskope’s Mann said what happens next depends largely on whether Instructure’s customers — the universities, K-12 districts, and education ministries paying for Canvas — choose to apply pressure or absorb the breach quietly.

    “The history of education-vendor incidents suggests the path of least resistance is the second one,” he concluded.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • ShinyHunters hackers defaced the official Canvas LMS portal after breaching Instructure systems, disrupting university access worldwide.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Researchers have discovered a new malvertising campaign using a fake Claude AI website to plant a new, undocumented backdoor named Beagle on user devices.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • CAPE CANAVERAL, Florida—The guardians manning screens in the mission-ops center here oversaw the launch of five types of rockets in April, a new record that involved NASA’s Artemis II, the first reused New Glenn booster, and a Falcon 9 lofting the final GPS III satellite. But tomorrow's Space Force may have no time to mark even epochal missions. Within a decade, service leaders say, Cape Canaveral Space Force Station will be launching hundreds of rockets a year.

    To facilitate the Pentagon’s fast-growing demand for orbital capability, the Space Force is looking for more launch sites, more money, more troops, and more AI. 

    “In 2025, the Space Force saw a drastic increase in mission requirements across space access, global mission operations, and space control. This trend shows no signs of slowing,” Gen. Chance Saltzman, the Space Force’s top uniformed leader, told House lawmakers last week. “The Space Force we have today is not the Space Force we will need in the future.”

    Nestled on a thin stretch of land just miles from nature preserves and cruise-ship ports, the historic Cape Canaveral facility launched 36 rockets in 2021, its first year as a Space Force facility. Last year, it sent 110 into the heavens, while its California counterpart, Vandenberg Space Force Base, launched another 65.

    This year, Space Force leaders intend to launch more than 200 rockets from their two main launch sites. And by 2036, they project the pair will launch more than 3,000 annually, according to a service document released last month.

    That’s going to take more launchpads.

    “As far as other launch locations, that's something that we've looked at quite a bit as well,” said Col. Ryan Hiserote, who leads Space Systems Command’s System Delta 80 and runs the National Security Space Launch program. “In terms of heavy launch, it's really just the two bases we have now—with Vandenberg and the Cape—I don't have a good solution for that one yet. But we're certainly open to other locations, and the team has been exploring those.”

    Hiserote said he was initially focusing on sites for smaller vehicles, like Rocket Lab’s work out of NASA’s Wallops Island flight facility. 

    Walt Lauderdale, System Delta 80’s system program director for the Falcon product line, said the service might use private sites such as SpaceX’s Starbase in Texas.

    But even as the Space Force looks to spread its launches around, Lauderdale said, it also needs to expand and improve its two main bases and “pivot to invest in ways we never did before.”

    Pushing policy

    The Space Force’s top brass has been making that pitch as well. 

    Last month at the Space Symposium in Colorado, Chief of Space Operations Gen. Chance Saltzman unveiled “Objective Force 2040,” an ambitious vision with a section on expanding the service’s launch capabilities. 

    “As the space domain becomes increasingly linked both to national security and to economic

    prosperity, the importance of space access grows commensurately,” the document said. “This is a significant challenge because the Space Force has supported exponential growth in launch cadence over the past few years using the same physical infrastructure first built decades ago. The future operating environment will only exacerbate this strain, with booming government and commercial demand as well as new mission requirements for responsive and scalable space access.”

    The document noted that the service will “expand and certify state, commercial, and private launch sites to address routine launches, increase surge capacity, and provide geographic diversity,” but also noted some spaceports won’t be fully suitable for some missions. 

    “These sites will increase overall launch capacity, but security and mission assurance requirements will limit their suitability for the most sensitive national security launches,” the document said.

    And the document adds a warning about overreliance on Cape Canaveral and Vandenberg, which “creates enduring vulnerability to natural hazards, operational disruption, and degraded performance during periods of peak demand.”

    Defense space expert Todd Harrison agreed.

    “It would make sense to diversify, because right now we are incredibly dependent on just two locations,” said Harrison, a fellow at the American Enterprise Institute. “One is at risk of hurricanes, and the other is at risk of wildfires and earthquakes.”

    Last year’s National Defense Authorization Act directed the Space Force to analyze the long-term suitability of Cape Canaveral and Vandenberg and  develop a list of alternative locations. Lawmakers have floated Wallops Island; Pacific Spaceport Complex, Alaska; and Spaceport America in New Mexico, as potential alternative national-security launch sites.

    In this year’s NDAA, lawmakers directed the service to report on the maintenance costs and age of infrastructure at Cape Canaveral and Vandenberg, as well as “potential strategies to mitigate adverse environmental effects.” The deadline was March 31. 

    Space Force launch officials said in April that their extensive report had not yet been delivered to Congress. A service spokesperson did not respond to a request for an update. 

    People problems

    Increasing the number of launches will require more than money. Top Space Force officers have recently called for doubling the service’s end-strength over the next decade.

    But even that won’t be enough, they say. Guardians will need to lean on AI to help. 

    “Our manpower is going to change,” said Air Force Col. Douglas Oltmer, commander of Cape Canaveral’s 45th Weather Squadron. “It’s going to have to change to be able to flex to that launch cadence, but we will not be able to do the job in the future the way we’re doing it now. We’re going to have to leverage technology, AI tools a lot more than we’re doing now.” 

    The Objective Force document calls for a service that can “operate at machine speed, leveraging artificial intelligence and autonomous systems while maintaining the primacy of human judgment for critical decisions.”

    While Congress debates the future of the Space Force’s launch sites and service leaders push space-launch goals to new heights, guardians at Cape Canaveral said they don’t feel those additional pressures weighing down on them. Hiserote, of System Delta 80, said he’s working with what he’s got until new resources and manpower come.

    “It will mean more missions for us, so we’re working through how to balance that with the resources that we have and look at areas where we can accept more risk that maybe traditionally we haven’t before,” Hiserote said. “I think there’s a lot that we can do to automate some processes so we can handle a larger manifest with a team that we have.”

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The U.S. military will never again rely on just one vendor of AI tools as it did with Anthropic, the defense undersecretary for research and engineering said Thursday.

    “We were single-threaded on one vendor, one AI vendor at the Department of War, and to integrate into classified systems is not just putting your software on a public cloud and having it work,” Emil Michael said at the Special Competitive Studies Project’s AI+ Expo event in Washington, D.C. “These are sophisticated, protective systems that take a lot of work to integrate on, so it wasn't like I could just turn on a few other models that easily. But never again we’ll be single-threaded with any one model.”

    Michael said that his department's recent deals with eight leading AI developers represented a statement of support by a tech industry that not so long ago shied away from military work, as well as a promise to allow the Pentagon to use their tools "for all lawful use cases."

    Anthropic has sued the Defense Department and other federal agencies and their leaders for declaring the company a national-security risk after it declined to allow the Pentagon to use its tools for autonomous weaponry and mass surveillance of Americans. A judge has ordered the White House to stop telling agencies to remove the company's products as the lawsuit proceeds.

    Moreover, a new Anthropic product has drawn the Pentagon's interest: Mythos Preview, which has shown groundbreaking ability to spot cyber vulnerabilities. The U.S. government has drafted internal policies that would allow agencies to use Mythos.

    Michael said that the Anthropic product heralds an era of AI-powered cyber operations. 

    “The Mythos moment is really a cyber moment, and it's: ‘How is the U.S. government going to deal with cyber?’” Michael said. 

    Major tech companies are responding to Michael’s drive to diversify the Pentagon’s vendor portfolio. Rand Waldron, the vice president of the Global Government Sector for Oracle Cloud Infrastructure, told Nextgov/FCW that Defense officials are asking cloud service providers like Oracle to prioritize interconnectedness in the effort to avoid vendor lock-in.

    “From what I can see, the Department of War has some very savvy people who … don't want to go all in on one [model] because then six months later, they may need to go all in on another,” Waldron said. 

    He explained that there will likely be models that are more finely tuned to particular use cases, such as code generation, data analytics, supply chain management or targeting in warfighter operations. One model from a single provider may not effectively serve each of these workflows. 

    “I don't believe that all those different use cases will end up being the exact same model at any given time,” Waldron said. 

    The Pentagon’s desire to expand the service offerings available for its workforce has precedent. Waldron said that DOD and the intelligence community have laid the foundation for a flexible approach to AI services acquisition, citing the creation of the Commercial Cloud Enterprise and Joint Warfighting Cloud Capability contracting vehicles as the blueprints for future contracting structure.

    “It's not like they're trying to replace Anthropic with another model provider,” Waldron said. “They want to replace Anthropic with four model providers.”

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Ivanti is warning that a new security flaw impacting Endpoint Manager Mobile (EPMM) has been explored in limited attacks in the wild. The high-severity vulnerability, CVE-2026-6973 (CVSS score: 7.2), is a case of improper input validation affecting EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1. It allows “a remotely authenticated user with administrative access to achieve remote code

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Cybersecurity researchers have disclosed details of a new credential theft framework dubbed PCPJack that targets exposed cloud infrastructure and ousts any artifacts linked to TeamPCP from the environments. “The toolset harvests credentials from cloud, container, developer, productivity, and financial services, then exfiltrates the data through attacker-controlled infrastructure while attempting

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Cybersecurity expert Tom Rønning finds Microsoft Edge loads all saved passwords into computer memory as cleartext, making them easy for hackers to steal.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶