Shimi's Cyber World
Real-time cyber intel for defenders.
LATEST Posts
View all →
New Phishing Campaign Uses Fake 'CEO Mandate' for Email Signature
A new phishing campaign, identified by Cyber News - Erez Dasa, is currently circulating, leveraging a deceptive email that purports to be from a CEO....
Chanhassen Dinner Theatres Suspend Shows After Ransomware Attack
Chanhassen Dinner Theatres in the US has temporarily suspended performances following a cyberattack on its systems. According to Cyber Updates - Asher Tamam, management proactively...
Mini Shai Hulud Campaign Hits AntV npm Packages, Echarts-for-React Affected
The Mini Shai Hulud campaign continues its aggressive activity, now targeting AntV's npm libraries. Cyber News - Erez Dasa reports that this includes the `echarts-for-react`...
Audio Prompt Injection Attack: AudioHijack Bypasses Voice AI Defenses
While prompt injection has become a common concern, a new attack vector, dubbed AudioHijack, introduces the concept of audio prompt injection. As reported by LΣҒΔ𝕽ΩLL...
CTT Data Breach Exposes 468K Portuguese Accounts
In April 2026, data allegedly sourced from CTT, Portugal's national postal service, surfaced on a public hacking forum. Have I Been Pwned reported that this...
Encrypted password vault
Open-source passwords with built-in 2FA and email aliases
Get Protected →
Addi Fintech Breach: 34 Million Accounts Exposed by ShinyHunters
In March 2026, the Colombian fintech Addi reported unauthorized activity on its platform, cautioning customers about potential personal information compromise. The "pay or leak" group...
Middle East Cyber Raids Net 200+ Scam Network Arrests
Law enforcement agencies, in a coordinated effort, recently arrested over 200 individuals linked to cyber scam networks operating in the Middle East. The raids uncovered...
Daily Security Digest — 2026-05-18
12 vulnerability disclosures (3 Critical, 9 High) and 30 curated intelligence stories from 10 sources.
Cloudflare Leverages AI for Code Review, Finds Critical Security Flaws
Cyber News - Erez Dasa highlighted Cloudflare's recent findings on using AI agents for code review. Over a 30-day period, Cloudflare executed 131,246 code scans...
UK Schools Face Extortion After AI Generates Deepfake Child Pornography
Schools in England are removing student photos from official websites and social media after attackers leveraged them for extortion. Cyber News - Erez Dasa reports...
Iran Threatens Global Internet with Strait of Hormuz Toll Demands
LΣҒΔ𝕽ΩLL 🇮🇱 reports that Iran is demanding transit fees from major technology companies for internet cables passing through the Strait of Hormuz and the Persian...
Grafana Refuses Ransom Payment After Codebase Theft
Grafana has confirmed a breach where attackers stole source code from its GitHub repositories. Despite the theft, the company has publicly stated its refusal to...
Leaked Shai-Hulud Malware Fuels New npm Infostealer Campaigns
The recently leaked Shai-Hulud malware is now actively being leveraged in new attacks targeting the Node Package Manager (npm) index. BleepingComputer reports that infected npm...
OpenAI ChatGPT Financial Account Integration Raises Major Privacy Concerns
OpenAI's recent announcement to integrate ChatGPT with users' financial accounts for personal finance advice is a serious red flag. The Record by Recorded Future highlights...
Bangladesh Government Customs Database Exposed on Darknet
DARKFEED reports a significant data breach involving a Bangladesh Government Customs database, which has been exposed and is now accessible on the darknet. This incident...
Grafana Codebase Stolen via GitHub Token Compromise
Grafana Labs recently disclosed a significant breach of its GitHub environment, where attackers successfully exfiltrated the company's source code. According to BleepingComputer, the breach was...
Anthropic Mythos Powers macOS M5 LPE Exploit Chain
Calif researchers, leveraging Anthropic's Mythos Preview AI, successfully developed a macOS LPE (Local Privilege Escalation) exploit chain for Apple M5 silicon in just five days....
Tabiq Hotel Platform Leaks 1 Million Passports and IDs via AWS S3
A critical misconfiguration in the Reqrea's Tabiq hotel check-in system has exposed over one million sensitive guest documents, including passports, driver's licenses, and selfie verification...
7-Eleven Data Leak: ShinyHunters Sells Stolen Data for $250,000
Retail giant 7-Eleven has confirmed a data breach after the ShinyHunters threat group advertised stolen data on their leak site. According to Cyber News -...
Enable GuardDuty
Think about the last time you saw a breach report where an attacker lingered in an AWS account for weeks, undetected. This isn't theoretical. It's...
Israeli Banking Sector: Cyber Risk Tops CISO Concerns for 2025
The Israeli banking sector's C-suite is, predictably, most concerned about cyber risk heading into 2025. This isn't a surprise; it's a reflection of the unrelenting...
Microsoft MDASH AI Tool Outperforms Mythos, Finds 16 Vulnerabilities
Microsoft is accelerating the race for AI-driven security tools with the introduction of MDASH, a new platform leveraging over 100 agents to identify vulnerabilities. Cyber...
Opexus: Fired Employees Delete Government Databases Via Microsoft Teams
LΣҒΔ𝕽ΩLL 🇮🇱 reports on a glaring operational security failure involving Muneeb and Sohaib Akhter, two brothers formerly employed by Opexus, a U.S. federal contractor. The...
Former CISA Nominee Sean Plankey Joins Defense Startup UFORCE as US CEO
Sean Plankey, who recently withdrew his nomination for CISA Director, has been appointed U.S. CEO of UFORCE, a London-based defense technology company formed from nine...
Daily Security Digest — 2026-05-17
23 vulnerability disclosures (3 Critical, 20 High) and 7 curated intelligence stories from 3 sources.
Deepfake Phishing Campaign Targets Israeli Public with Fake Endorsements
A new deepfake phishing campaign is actively targeting the Israeli public, leveraging sophisticated AI-generated videos. Cyber News - Erez Dasa reports that these videos falsely...
Enable GuardDuty
Think about the last time you saw a breach notification. How many of those could have been caught earlier, or prevented entirely, if someone was...
THORChain Suffers $10 Million Crypto Theft
The THORChain decentralized finance (DeFi) protocol recently sustained a significant theft, with attackers siphoning off approximately $10 million in digital assets. This incident highlights the...
Grafana Labs Hit by Ransomware, Source Code Repositories Exfiltrated
Grafana Labs has confirmed a ransomware attack, with the Coinbase Cartel group claiming responsibility on their leak site. This incident highlights the persistent threat ransomware...
CVE Latest Vulnerabilities
View all →
GitHub Actions Supply Chain Attack Hijacks Tags to Steal CI/CD Credentials
Threat actors have compromised the popular GitHub Actions workflow, `actions-cool/issues-helper`, to execute malicious code designed to harvest sensitive credentials. The Hacker News reports that this...
OpenHarmony RCE: Remote Code Execution in Pre-Installed Apps (CVE-2026-27648)
CVE-2026-27648 — in OpenHarmony v6.0 and prior versions allow a remote attacker arbitrary code execution in pre-installed apps.
OpenHarmony CVE-2026-25781 Allows Local DOS, Unrecoverable Impact
CVE-2026-25781 — in OpenHarmony v6.0 and prior versions allow a local attacker cause DOS and it cannot be recovered.
OpenHarmony v6.0 RCE: Pre-Installed Apps Vulnerable
CVE-2026-24792 — in OpenHarmony v6.0 and prior versions allow a remote attacker arbitrary code execution in pre-installed apps.
O+ Connect Vulnerability: Local Privilege Escalation (CVE-2026-22069) Exposes Systems
CVE-2026-22069 — A local privilege escalation vulnerability exists in O+ Connect because it fails to validate the identity of the caller on the pipe interface....
AutoGPT Insecure Deserialization (CVE-2026-33233) Leads to RCE
CVE-2026-33233 — AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. In versions 0.6.34 through 0.6.51, the backend deserializes...
TOOLKIT Field Tools
Full Toolkit →NordVPN
recommendedFast, secure VPN with threat protection for operators.
Proton VPN
recommendedSwiss no-logs VPN with Secure Core routing and malware filter.
Surfshark
recommendedVPN + CleanWeb malware blocker. Unlimited devices for your whole team.
Proton Pass
recommendedOpen-source encrypted passwords with built-in 2FA and aliases.
Where machines detect and humans decide. Read the manifesto →