Log4j developers have a name for the remote code execution alarm that went around this week: a “known security non-finding.”
Reports of a critical flaw in Apache Log4j 2 started circulating, and for a moment it looked like a repeat of Log4Shell. The maintainers say it is not. They accept the bug could allow remote code execution in theory, but exploitation needs a specific set of circumstances. They also pointed out that the volunteers who maintain the library have limited time and can use it on better things.
Banks, breaches and a shutdown
U.S. Bancorp said ransomware claims using its name come from a possible incident at a fourth-party provider, outside the bank’s own environment. It says nothing so far shows its systems, networks or data repositories were compromised. LockBit has threatened to publish data it says it stole.
Minimus, which sold hardened container images, is winding down after raising $51 million in 2025. The company said the business and investment climate left it unable to continue. It had appeared at Black Hat less than a month earlier. Soon after the shutdown notice, Echo said it had acquired Minimus and its technology.
Two studies counted exposed cloud credentials. Truffle Security reviewed 10,616 AWS keys that were exposed between 2022 and 2026 and found more than 700 still active, each giving full control of a corporate account. Intruder scanned 3.5 million active hosts and turned up 28,000 exposed Git repositories, which held more than 400 AWS keys, 107 Stripe keys, 123 OpenAI keys, 80 Telegram tokens and 17 GitHub personal access tokens. Some still worked.
Zimperium counted 30 mobile malware families aimed at more than 800 banking and fintech apps across 44 EMEA countries. Its researchers also saw attackers using AI at several stages, from localized lures to better phishing pages and overlays.
Carhartt, Paylogix and Manchester
Troy Hunt looked at the alleged Carhartt breach and found that much of the data was synthetic TPC-DS benchmark data mixed with real customer records. By his analysis about half of the 24.8 million email addresses were junk, so ShinyHunters’ original claims overstated how many real customers were involved.
Paylogix is a different case. The company says attackers took files from its network over several days in November. The files held Social Security numbers, financial and health insurance details, medical data, passport numbers and taxpayer IDs. At least 67,789 people in South Carolina, New Hampshire and Vermont have been reported affected, and the Akira ransomware group took credit.
Hackers got into personal data on about 8.7 million Manchester Airports Group customers, including email addresses, phone numbers, vehicle registrations and postcodes. They demanded a ransom to return it. MAG refused. The company said airport operations, passenger safety and aviation security were untouched.
Leaked records from Bauman University describe a long-running program that trained roughly 250 career and reserve students for Russian military intelligence and cyber work. The courses covered offensive and defensive techniques, malware analysis and intelligence work, and some graduates went to units associated with APT28 and Sandworm.
The U.S. Treasury sanctioned Iranian cyber actors tied to the MOIS, accusing them of breaking into critical infrastructure and carrying out financially motivated theft. It named Keyvan Fayyaz Ghareh Blagh, Saber Shahbazi Balujeh and Mohammad Reza Kadkhoda’i. Four of the 17 Iranian cyber actors the FBI has charged were designated in the same action.
