Notable developments in infrastructure, security and cloud. Headlines and summaries are written in our own words; follow the link for the original source.
Pokémon Center told customers in the UK and Germany that a breach at CEVA Logistics exposed personal and order information and caused some orders to be cancelled. MSPs and sysadmins should reassess vendor access, data‑sharing arrangements and incident response procedures.
Researchers discovered a new Linux botnet family called Evooo1Bot that builds on Mirai’s leaked DDoS engine and can turn internet-exposed edge devices into SOCKS5 proxies. For MSPs and admins this means risk of anonymized malicious traffic and infrastructure abuse — prioritize changing default credentials, disabling unused services and monitoring outbound connections.
Philips and General Electric are probing reports that the Clop ransomware group exfiltrated data. Such vendor or partner intrusions can affect customer data and service continuity; review access logs, third‑party links and credentials promptly.
The French Ministry of the Economy and Finance reported an intrusion into DGFiP systems that resulted in data for 678,000 individuals being exfiltrated. For MSPs and admins the concern is increased phishing and identity-fraud risk—review access controls, audit logs and customer notification plans.
Microsoft is working on a patch for the 'ShieldBreak' zero-day in Defender, tracked as CVE-2026-69414. MSPs and system administrators should be ready to test and deploy the update quickly when released, since exploited endpoints or management hosts could be at risk.
Hardware wallet provider SafePal reports roughly 39,798 customers had order records exfiltrated following an exploited flaw. Adversaries claim to be offering the stolen dataset for sale; infrastructure teams should audit access logs, rotate credentials, verify database permissions, notify affected customers and prepare for increased phishing and fraud attempts.
Threema was hit by large DDoS attacks this week, causing significant message delivery interruptions. MSPs and sysadmins should review monitoring, capacity planning, and traffic-scrubbing/mitigation arrangements and coordinate with upstream providers to protect customer environments.
A Shai-Hulud variant of ChainDrop altered 444 npm packages and spreads via tarballs and developer-tool hooks. It can evade common defenses, creating a cascading threat to build systems, CI/CD pipelines and client infrastructure if contaminated packages are installed.
The Mirai-based modular Linux botnet Evooo1Bot is targeting internet-facing gateway devices and converting them into SOCKS5 proxy nodes. For MSPs and admins this increases the risk of customer devices being abused for anonymized malicious traffic, complicates attribution and highlights the need for strong credentials, firmware updates and network segmentation.
ShinyHunters has posted what it says are 1.6M RingCentral account records following an extortion claim. MSPs and sysadmins should assume credentials or contact data may be included and take steps such as scanning for reused passwords, forcing rotations where needed, reviewing logs, and enhancing monitoring for account takeover and phishing.
Reports indicate a Russian guided missile employed an Nvidia AI processor to enhance targeting. Kyiv is urging tighter export and procurement controls to prevent foreign chips being repurposed for weapons, a move that could impact hardware supply chains and compliance for service providers.
After an attacker claimed roughly 2 million tax records, the French tax office acknowledged a data breach while disputing claims of ongoing access. Investigators are quantifying the impact; MSPs and admins should audit credentials, verify backups and review logs for potential customer data exposure.
Experts warn that autonomous AI agents can automate cyber intrusions and escalate them into physical damage affecting energy, transport and industrial control systems. MSPs and administrators should strengthen defenses by segmenting OT, tightening access controls, increasing monitoring and exercising incident response for AI-driven threats.
Authorities arrested four suspects in Brazil and charged three in Europe over an exploitation of a service provider vulnerability that allowed withdrawals from Commerzbank customer accounts, with losses around €30 million. The case highlights the need for MSPs and admins to prioritize third-party security, access controls and transaction monitoring.
Cloudflare Gateway uses protocol-level signals to identify MCP requests. Security teams can leverage this to find shadow MCP connections, enforce Portal-only access for approved servers, and block direct connections on managed network paths—helping protect control-plane communications.
Cloudflare's Access for Workers lets you assign an Access policy to a Worker and have that policy enforced across all places the Worker runs — routes, custom domains, workers.dev and preview environments. For MSPs and sysadmins this means centralized authorization, consistent protection including previews, and fewer configuration steps.
Trezor has confirmed that about 13,000 customers' personal data were exposed after a breach at a logistics supplier. The incident illustrates that secure hardware cannot mitigate risks originating from fulfillment and supply-chain partners. MSPs and sysadmins should review third‑party security, data minimization and breach notification processes.
In a tongue-in-cheek BOFH piece the author recounts how internal 'Covid ransomware protocol' steps and a Y2K-style blockchain experiment reduced service availability. For MSPs and sysadmins the takeaway is clear: overcomplicated, untested security processes and flashy tech choices can raise operational risk.
Headlines and summaries are written by RADAR in its own words. Copyright belongs to the respective publisher; use the source link for the full text.