In today’s cybersecurity news…
Fortinet patches a new critical FortiSandbox flaw
Fortinet has released security updates “to address several vulnerabilities affecting FortiSandbox, FortiOS, FortiProxy, and FortiPortal. The most severe issue, a CVE numbered vulnerability (CVE-2026-25089) with a CVSS score of 9.8, is an OS command injection flaw in FortiSandbox products, which could “allow remote, unauthenticated attackers to send specially crafted HTTP requests and execute arbitrary commands on affected devices.”
GitHub to disable npm install scripts by default to stop supply chain attacks
GitHub has announced what it describes as “breaking changes” coming to npm version 12, one of which turns off install scripts by default to combat software supply chain threats. These changes are designed to deal with attack techniques that abuse the “npm install” command to trigger the execution of malicious code using npm lifecycle hooks. GitHub describes install-time lifecycle scripts as the “single largest code-execution surface in the npm ecosystem.” The idea going forward is “to require explicit user approval before code execution is initiated automatically during “npm install” as opposed to being trusted by default.
Nottingham University announces data breach
The UK based University of Nottingham has confirmed a cyberattack on its student record system, with the culprits identified as members of the ShinyHunters crew. They allegedly made off with 40 gigabytes of data from the Russell Group institution. ShinyHunters has claimed responsibility for the attack which occurred on Tuesday, saying the data includes “billing and payment records, credit card and payment details, student finance data, and “campus portal exports,” belonging to current students and alumni. The gang also compromised the university’s campuses in Malaysia and China.
FBI Seizes 13 websites allegedly used by China to recruit U.S. workers
The Justice Department announced on Wednesday that these websites were “part of a Chinese effort to target American workers who have access to classified or sensitive government information.” The sites appeared to be affiliated with consulting companies that advertised job openings for current and former holders of security clearances. This follows on from an announcement from the Five Eyes intelligence-sharing alliance that we reported on on Tuesday regarding an uptick in China-based recruitment scams.
Huge thanks to our sponsor, Doppel
They use one connected attack chain to hit your brand externally, infiltrate your inbox, and manipulate your team.
Stop playing whack-a-mole with fragmented tools. Doppel unifies Digital Risk Protection, Human Risk Management, and Email Security into one unified platform.
One attack chain. Three pillars of defense. Zero blind spots.
Secure your enterprise relentlessly at doppel.com.
Cyberattack shuts down major Australian sugar mills, disrupting harvest
Australia’s second-largest sugar producer, Mackay Sugar, announced the attack, which has disrupted sugar production in one of Australia’s largest cane-growing regions. This has forced two major sugar mills to shut down, bringing harvesting operations to a halt. The organization that represents local sugarcane farmers, said in a statement,that sugar milling and cane haulage operations at two major mills had been suspended, and this is occurring that the start of the annual sugarcane crushing season. Mackay Sugar supplies raw sugar to domestic customers as well as to markets in South Korea, Indonesia, Japan and Malaysia.
Coupang hit with record $409 million data breach fine in Korea
T, South Korea’s data protection regulator, the Personal Information Protection Commission (PIPC), has fined the e-commerce giant Coupang a record 624.6 billion won (roughly $409 million) following a massive data breach affecting more than 37 million customers. The company’s subsidiary, Coupang Fulfillment Service, was also fined 248 million won for “unlawfully collecting, using, and handling customers’ personal and sensitive data.” This breach, occurred in late June of last year but was discovered only in mid-November. The primary suspect is a 43-year-old Chinese national who worked in Coupang’s IT department between 2022 and 2024.
Company seeks to add Phone, AirPod, and Smartwatch trackers to license plate readers
A surveillance company by the name of Leonardo wants to add sensors to automatic license plate readers (ALPRs) to track unique identifiers of mobile phones, wearables, and other Bluetooth-enabled devices located in the cars whose plates they are scanning. The goal: to assist law enforcement in identifying specific drivers or passengers. The technology, called SignalTrace, would “turn ALPR cameras from devices focused on tracking cars to ones that can more readily track the location of particular people.”
Most cybersecurity teams struggle to find time for training on new threats
This warning comes from a new report from ISC2, who polled nearly 1000 cybersecurity leaders from large enterprises around the world on “how their organization approach cybersecurity team training.” Seventy-three percent of them said “their organization’s security training budget has increased over the past year, as businesses react to the emergence of new technologies and cybersecurity challenges that accompany them, especially AI, but at the same time 98% said that while their organization allows employees to engage with professional development and training during work hours, just over half of the respondents (53%) said they face challenges that “prevented them from engaging with training and professional development during the working day.” The report suggests that continuous training is key to preparedness, rather than packaging it as a one-time activity. A link to the report is available in the show notes to this episode.
(InfoSecurity Magazine and ISC2)