Australia Charges Two Alleged TeamPCP Hackers Over Supply-Chain

🚨 ACTIVE EXPLOITATION

• UPDATE: Australia Charges Two Alleged TeamPCP Hackers Over Supply-Chain Attacks
  Australia has charged two alleged TeamPCP members over global software supply-chain attacks.
  • Government, academic, and private-sector organizations worldwide were affected.
  • Trivy, LiteLLM, Telnyx, SAP, and TanStack packages were among the targets.
  • Malicious code was injected into open-source repositories and then incorporated by developers.
  • The activity potentially compromised more than 1,000 organizations, stealing 500,000 credentials and at least 300GB of data.
  • Louis Michael Gaebler, 23, and Ruben Ian Thomson, 21, face 14 combined charges after arrests in Western Australia.
    📎 Coverage: bleepingcomputer.com · 👁 via BleepingComputer, SecurityWeek (+2)

💥 BREACHES & INCIDENTS

• Hackers access data of 8.7 million customers at three UK airports
  Hackers accessed data belonging to 8.7 million customers of three UK airports.
  • Manchester Airports Group customers at Manchester, London Stansted and East Midlands airports were affected.
  • Exposed data included email addresses, phone numbers, vehicle registrations and postcodes.
  • Email addresses came mainly from airport Wi-Fi sign-ups.
  • Vehicle registrations and other details came from car-park, lounge and fast-track bookings.
    📎 Coverage: bbc.com · 👁 via r/cybersecurity, @metacurity@infosec.exchange

🕵️ RESEARCH & DEEP DIVES

• Russian-linked hackers target senior EU officials on Signal and WhatsApp
  Russian-linked hackers targeted senior EU officials through Signal and WhatsApp phishing.

  • Senior EU officials using Signal and WhatsApp were targeted, including political, military and diplomatic figures.
  • Attackers sought to hijack messaging accounts and read private and group conversations.
  • Personalized spearphishing messages used malicious links, files and social engineering.
  • Fake Signal support chatbots requested security codes that could link attacker-controlled devices to accounts.
    📄 Source: politico.eu · 📎 Coverage: darkreading.com · 👁 via Dark Reading

• Russian-Speaking Hackers Used Cursor AI in Intrusions Against Seven Companies
  Russian-speaking hackers used Cursor AI to accelerate intrusions against at least seven companies.

  • Victims included companies in chemicals, manufacturing, logistics, pharmaceuticals, and title insurance.
  • Aur0ra ransomware operators sought administrator accounts, credentials, and access to corporate networks.
  • Hackers used Cursor’s AI agent to plan attacks and generate technical guidance.
  • They bypassed Cursor’s refusals by claiming the activity was a security simulation.
  • The campaign was exposed after researchers found an unauthenticated server containing 28 Cursor chat sessions.
    📎 Coverage: reuters.com · 👁 via r/cybersecurity

🔓 CVEs & KEV

• CVE-2026-77554 — CVSS 10.0 — A malicious actor with access to the network could exploit an Improper Input ...

• CVE-2026-77550 — CVSS 10.0 — A malicious actor with access to the network could exploit an Improper Neutra...

• CVE-2026-77553 — CVSS 9.9 — A malicious actor with access to the network and low privileges could exploit...

• CVE-2026-77548 — CVSS 9.9 — A malicious actor with access to the network and low privileges could exploit...

• CVE-2026-77547 — CVSS 9.9 — A malicious actor with access to the network and low privileges could exploit...

• CVE-2026-77546 — CVSS 9.9 — A malicious actor with access to the network and low privileges could exploit...

• CVE-2026-18080 — CVSS 9.8 — ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce through 1.17.8 - Un...

• CVE-2026-77557 — CVSS 9.8 — A malicious actor with access to the network could exploit an Improper Access...

• CVE-2026-77552 — CVSS 9.8 — A malicious actor with access to the network could exploit an Improper Input ...

• CVE-2026-77532 — CVSS 9.6 — A malicious actor with access to an adjacent network could exploit a Buffer O...

• CVE-2026-80204 — CVSS 9.3 — Grav before 1.0.18 Authentication Bypass via Scoped API KeyThe Grav API plugi...

• CVE-2026-80203 — CVSS 9.3 — Grav before 1.0.18 Authentication Bypass via Scoped API KeyThe getgrav/grav-p...

• CVE-2026-77551 — CVSS 9.0 — A malicious actor with access to the network and under certain conditions cou...

• CVE-2026-77549 — CVSS 9.0 — A malicious actor with access to the network and under certain conditions cou...

• CVE-2026-81579 — CVSS 8.8 — WibuKey for Windows: Kernel Driver Privilege Escalation

• CVE-2026-81662 — CVSS 8.6 — Flowintel Alert Settings Configuration Allows Remote Code Execution via Arbit...

• CVE-2026-15985 — CVSS 8.1 — Classified Listing - Mobile Number Verification through 1.6.0 - Unauthenticated Au...

• CVE-2026-81743 — CVSS 7.5 — Flowintel Arbitrary Log File Path Allows Remote Code Execution via Template I...

• CVE-2026-81659 — CVSS 7.1 — Flowintel Note PDF Export Allows Arbitrary Local File Read via Pandoc/XeLaTeX...

• CVE-2026-81658 — CVSS 6.5 — Foreman: cross-tenant disclosure of template revisions via unauthorized audit...