DanSec

Cybersecurity Brief

Saturday 13 June 2026

In this brief Arch Linux, Cal Water, Anthropic, Novo Nordisk, phpBB, Oracle, +6 more
Vendors
Arch Linux, Cal Water, Anthropic, Novo Nordisk, phpBB, Oracle, Google, Apple
Threat actors
Handala, ShinyHunters, Velvet Ant, Conti

Major Incidents or Breaches

  • Attackers compromised over 400 packages in the Arch Linux User Repository (AUR), modifying build scripts to distribute an infostealer and eBPF-based rootkit capable of stealing credentials and access tokens from affected systems [5][14].
  • Danish pharmaceutical company Novo Nordisk disclosed a data breach impacting patient information from clinical trials [17].
  • The state of Maine disabled its public data breach reporting portal after fraudulent breach disclosures were published on the site, prompting a procedural review [11].
  • Iranian cyber group Handala claimed responsibility for hacking Cal Water, publishing 5GB of data including customer personal information and RTKBase platform credentials [25].

Newly Discovered Vulnerabilities

  • Researchers identified a 10-year-old authentication bypass vulnerability in phpBB forum software that allowed attackers to log in as any user, including administrators [12].
  • A major bug in Oracle ERP software was exploited by the ShinyHunters group, leading to significant data theft from American universities [18].

Notable Threat Actor Activity

  • A China-linked threat actor, tracked as Velvet Ant, maintained a backdoor in Linux login software for nearly a decade, enabling persistent access to compromised systems [7].
  • Google initiated legal action against a Chinese cybercrime network accused of using Gemini AI to send phishing SMS messages targeting American users [6].
  • A Ukrainian national pleaded guilty in the United States to conspiracy charges related to the Conti ransomware operation [13].
  • AI-generated and AI-assisted fraud schemes have surpassed physical forgery as the dominant type of fraud, facilitated by advanced tools that allow attackers to create highly convincing forgeries [3].
  • Researchers described a new class of attack called “Agentjacking,” which tricks AI coding agents into executing malicious code on developer machines [8].
  • Early warning signs of supply-chain attacks, such as GitHub access sales, leaked repositories, and stolen API keys, are increasingly being identified on dark web forums [15].
  • Collaboration between Apple and the Metropolitan Police aims to make stolen iPhones more difficult to reset, resell, and profit from, potentially reducing the incentive for device theft [26].

Regulatory or Policy Developments Affecting the Security Industry

  • The US government ordered Anthropic to suspend access to its advanced AI models, Fable 5 and Mythos 5, for all foreign nationals, resulting in the models being taken offline globally to comply with new export controls [4][10][19][22][24].

Sources

  1. Over 400 Arch Linux AUR Packages Hijacked to Deploy Infostealer and eBPF Rootkit - thehackernews.com
  2. Over 400 Arch Linux packages compromised to push rootkit, infostealer - bleepingcomputer.com
  3. Pharma giant Novo Nordisk discloses breach of clinical trials data - bleepingcomputer.com
  4. Maine disables data breach notification portal after fake disclosures - bleepingcomputer.com
  5. Iranian Cyber Group Handala Claims Cal Water Hack - securityweek.com
  6. phpBB forum fixes auth bypass bug lurking for a decade - bleepingcomputer.com
  7. ShinyHunters Uses Oracle Zero-Day to Rampage Higher Ed - darkreading.com
  8. China-Linked Hackers Backdoored Linux Login Software to Hide for Nearly a Decade - thehackernews.com
  9. Google Sues Chinese Smishing Network Accused of Using Gemini AI in Phishing - thehackernews.com
  10. Ukrainian national pleads guilty to role in Conti ransomware operation - bleepingcomputer.com
  11. Report: AI-Assisted Fraud is Surging - blog.knowbe4.com
  12. Agentjacking Attack Tricks AI Coding Agents Into Running Malicious Code - thehackernews.com
  13. Early Warning Signs of Supply-Chain Attacks Live in the Dark Web - bleepingcomputer.com
  14. Stolen iPhones could soon be worth a lot less to thieves - malwarebytes.com
  15. U.S. Orders Anthropic to Suspend Fable 5 and Mythos 5 Access for Foreign Nationals - thehackernews.com
  16. US Gov asks Anthropic to ban 'foreign national' access to Fable, Mythos - bleepingcomputer.com
  17. Claude Fable 5 Doesn't Change the Mythos Security Story - darkreading.com
  18. Anthropic Says It Has Taken Its Latest AI Models Offline to Comply With New Export Controls - securityweek.com
  19. Industry Reactions to Claude Fable 5: Feedback Friday - securityweek.com