Megalodon Supply Chain Attack Hits 5,500+ GitHub Repos; Critical Drupal Flaw Under Mass Exploit

New analysis explicitly attributes the 'Megalodon' supply chain attack to the threat actor TeamPCP. Beyond financial gain, the campaign is now understood to have a geopolitical dimension, with evidence of destructive wiper malware deployed against targets in Iran and Israel. Attackers utilized throwaway GitHub accounts like 'build-bot' and 'ci-bot' to obscure their actions. The update also provides more detailed 'Cyber Observables - Hunting Hints' and expanded detection and mitigation strategies for CI/CD compromises, emphasizing the need for robust log analysis and commit monitoring.

Anthropic's Project Glasswing has reported significant progress, identifying over 10,000 high and critical severity vulnerabilities within its first month. The initiative, leveraging a specialized 'Claude Mythos preview' AI model, collaborates with major tech companies including Amazon Web Services, Apple, Cisco, Google, and Microsoft. This demonstrates the AI's capability to autonomously find and report flaws at an unprecedented scale, aiming to proactively secure the software ecosystem. The AI performs variant analysis, logical flaw detection, and exploit generation for validation, moving beyond traditional static analysis tools.

International law enforcement, supported by Europol, has successfully dismantled 'First VPN', a bulletproof VPN service widely used by ransomware actors and fraudsters. The operation, led by French and Dutch authorities, resulted in the seizure of 33 servers and the shutdown of its domains (1vpns.com, .net, .org). This action directly counters the industrialization of cybercrime and the abuse of legitimate technologies for malicious ends, as highlighted in the recent IOCTA report. The takedown provides valuable intelligence, advancing 21 other investigations, and significantly disrupts the cybercrime-as-a-service ecosystem, making it harder for criminals to operate anonymously.

New reports confirm a strategic shift among ransomware groups towards 'pure extortion,' focusing solely on data theft and public leaks. This pivot is driven by a significant drop in ransom payment rates, from 76% in 2019 to just 28% today, as organizations improve backup and recovery capabilities. This evolution makes detection harder, as the focus shifts from noisy encryption to stealthier data exfiltration, and the damage from stolen data is permanent, unlike recoverable encrypted systems. Incident response now emphasizes damage control and managing public fallout.

The critical SQL injection vulnerability, CVE-2026-9082, in Drupal Core affecting PostgreSQL sites is now under active mass exploitation, just 48 hours after its patch release. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added this flaw to its Known Exploited Vulnerabilities (KEV) catalog, confirming widespread attacks and mandating immediate patching for federal agencies. This development significantly escalates the threat, as attackers are actively scanning for and compromising vulnerable systems at scale. Organizations are urged to apply patches without delay and check for signs of compromise.