FulcrumSec says it stole 86 GB of data from Manchester Airports Group. Data on 8.8 million people has since leaked, after the company refused to pay a ransom. That is one entry in Security Affairs’ weekly roundup, Round 593 from Pierluigi Paganini, which covers a crowded run of breaches, zero-days and arrests.
Breaches and leaks
Besides the airport case, the newsletter lists ticketing data from The Town 2025 that was sold as a Ticketmaster breach, and an FBI probe into a service selling more than 153 million driver’s licenses. It also points to a university leak that exposed Russian military cyber training materials, and to a Chinese-speaking operator who used AI agents against government and education systems across Asia.
Two North Korea-linked groups are named for the Ted backdoor and curlRAT, aimed at South Korean media and automotive companies. A Serbian pro-democracy student activist was infected with Pegasus spyware.
Zero-days and patches
The vulnerability list is long. Attackers are exploiting two SonicWall SMA 1000 zero-days that may form an attack chain, and Google has pushed a Chrome update for an actively exploited V8 zero-day. Researchers detailed PrettyPrague, an Avast Antivirus privilege-escalation zero-day, and FalconFlank, a privilege-escalation zero-day involving CrowdStrike Falcon. GiveWP has an unauthenticated PHP object injection that leads to remote code execution. Eclypsium flagged 1,051 CVEs in infrastructure advisories. PostgreSQL, the database behind much of the internet, had an open door for 12 years.
PaperCut flaws are being used to steal credentials from schools and universities.
Malware
Hackers are stealing Claude login sessions with infostealer malware to hijack accounts. Gryxa is an AI-built toolkit that watches how you remove it. Thirteen malicious Packagist themes deliver iOS spyware that steals crypto wallet seeds, and the Mini Shai-Hulud campaign now hunts for secrets in 280 new places. Aurora ransomware targets ESXi and abuses Cursor Agent.
Arrests and courts
An FBI investigation led five Venezuelan nationals to plead guilty to attempting to jackpot Kansas ATMs. Two Nigerian nationals were extradited to the United States to face sextortion charges in North Carolina and Mississippi. In a separate item, a judge called the Pentagon’s measures against Anthropic “illegal and baseless.”
