Global Campaign Targets 30,000 Devices
A new law enforcement advisory has exposed a massive cyber campaign by the North Korean hacking group WaterPlum. Between December 2025 and July 2026, the group successfully compromised at least 30,000 devices globally, funneling over $10.7 million in stolen cryptocurrency back to North Korea.
Key Updates for Small Businesses:
- SolarWinds Alert: A high-severity hard-coded key flaw (CVE-2026-28326) in Access Rights Manager could allow attackers remote code execution. Patch immediately.
- Critical RCE Exploits: The Orkes Conductor workflow platform is facing active, in-the-wild exploitation of a critical, pre-authentication RCE vulnerability (CVE-2026-58138).
- AI Security Risks: Researchers successfully used Anthropic's Claude Opus 5 to chain flaws and infiltrate OpenAI staff accounts, highlighting the growing danger of AI-assisted cyberattacks.
- Supply Chain Caution: CrowdSec confirmed that 170 private repositories were exposed due to lingering employee access, serving as a reminder to conduct regular offboarding audits.