ShinyHunters hijacks rival Clop's ransomware leak site
The extortion group known as ShinyHunters broke into the dark-web leak site of rival ransomware operation Clop, defaced it and claimed to have taken server data including source code, logs and the private keys for the site's hidden-service address. Security researchers confirmed the defacement was being served from Clop's own infrastructure, showing how fragile even criminal platforms can be.
Namibia's defence ministry hit by RansomHouse
Namibia's national computer emergency response team confirmed that the country's Ministry of Defence and Veterans Affairs was attacked by the RansomHouse ransomware group. The gang listed the ministry on its leak site on September 16, and officials confirmed the incident three days later. The attack method was described as double extortion — encrypting systems while threatening to publish stolen data.
Supply-chain attack exposes CrowdSec's private code
A malicious update to popular TanStack software packages, published back in May, continues to cause damage. Attackers used a compromised GitHub account to copy roughly 170 of cybersecurity firm CrowdSec's private repositories, and the archive surfaced on a public forum on September 16 containing source code plus contact details of dozens of users and investors. The same attack wave also touched devices at OpenAI and Mistral AI.
CISA flags three Linux kernel flaws under active attack
The US cybersecurity agency added three Linux kernel vulnerabilities to its list of flaws confirmed to be exploited in the wild, ordering federal agencies to patch by a tight September deadline. Kernel bugs that allow privilege escalation are prized by attackers who already have a basic foothold, making this a high-priority update for enterprise and cloud operators as well.
