Cloudflare blames database 

Cloudflare’s worst outage since 2019 knocked major websites offline for hours on Tuesday, and the company now says it wasn’t a cyberattack (like originally thought) but an internal configuration error. A database permissions change caused Cloudflare’s Bot Management system to generate an oversized feature file that repeatedly crashed its core proxy, leading to widespread 5xx errors across the network. The outage impacted major companies like X, Uber, Canva, and ChatGPT with traffic back to normal by mid-afternoon and Cloudflare’s CEO apologizing for the disruption.

(Bleeping Computer), (Dark Reading)

Crypto heist takedown 

A California man pleaded guilty to laundering at least $25 million USD in a massive $230 million USD cryptocurrency heist. The scheme, carried out between October 2023 and March 2025, involved a network of mostly young hackers who gained access to victims’ crypto accounts and laundered funds through mixers, peel chains, shell companies, and other blockchain techniques.  

(Bleeping Computer)

WhatsApp flaw exposed billions

Researchers in Austria discovered a flaw in WhatsApp that allowed them to collect personal data from over 3.5 billion users, including names, phone numbers, and profile images, potentially creating a massive reverse phonebook. The flaw exploited WhatsApp’s user lookup by phone number without effective rate limiting, though the collected data has now been securely deleted and no evidence of malicious use was found.

(The Register)

Iran’s cyber-enabled kinetic attacks

Amazon researchers documented cases where Iranian-linked threat actors used hacking to enable physical strikes, a tactic they call “cyber-enabled kinetic targeting.” In one case, Imperial Kitten compromised a ship’s AIS and CCTV systems over several years, preceding a missile strike by Houthi forces in February 2024. A second case involved MuddyWater accessing live CCTV feeds in Jerusalem to gather intelligence before a June 2025 missile attack. Amazon warns this combination of digital reconnaissance and kinetic operations is likely to become more common. 

(Security Week)

Huge thanks to our episode sponsor, KnowBe4

Russian ransomware hosting sanctioned

In a multi-country takedown, the U.S., United Kingdom, and Australia announced sanctions against Russian bulletproof hosting (BPH) providers that support ransomware gangs and other cybercrime operations. The infrastructure backed ransomware groups like LockBit, BlackSuit, and Play, and was used to facilitate malware campaigns and DDoS attacks against U.S. companies and critical infrastructure, including telecommunications systems. The sanctions freeze all assets in the three countries and warn that anyone continuing to provide services to these providers risk legal and financial ramifications of their own. 

(Bleeping Computer)

 $55 million crypto seized

Europol, the EU Intellectual Property Office, and Spain’s National Police coordinated a crackdown on online piracy. The coordinated efforts identified 69 suspect sites, including 25 illicit IPTV services, and tracing cryptocurrency flows worth about €47 million euros ($55 million USD). Investigators used crypto payments to buy illegal services themselves, enabling them to pinpoint operators and relay findings to exchanges for disruption.

(Europol), (InfoSecurity Magazine)

ShinySp1d3r ransomware emerges

A new ransomware-as-a-service called ShinySp1d3r is being developed by the ShinyHunters group, in collaboration with affiliates from Scattered Spider and LAPSUS$. The ransomware is still in development, but researchers analyzing early builds say it can kill processes that block encryption, overwrite deleted files, delete shadow copies, and spread across local networks. The group claims not to target healthcare organizations and victims have three days to start negotiations before the attack is posted publicly.

(Bleeping Computer)

Thousands of ASUS routers hijacked 

A new global campaign, Operation WrtHug, has compromised roughly 50,000 ASUS WRT routers, mostly outdated or end-of-life devices, by exploiting six known vulnerabilities. Most affected IPs are in Taiwan, with others across Southeast Asia, Russia, Central Europe, and the U.S..  Researchers at SecurityScorecard say the campaign may be linked to the earlier AyySSHush operation. The attacks exploit command injection and authentication flaws, including CVE-2025-2492, a critical issue affecting the AiCloud feature. ASUS has released firmware updates for all vulnerabilities.

(Bleeping Computer)