The PinTheft exploit for a Linux privilege escalation is now publicly available; the vulnerability primarily affects Arch Linux because the required RDS module is enabled by default there, and users should immediately install kernel updates or disable the RDS module.

An overlooked GitHub token following the TanStack attack enabled hackers to access Grafana’s private repositories, but the company confirms no customer data or production systems were affected.

Fox Tempest operated a malware signing service for ransomware gangs, which Microsoft disrupted through Operation OpFauxSign via server takedowns and website seizures.

Chinese-aligned hacker group Webworm is arming itself in 2025 with two new backdoors: EchoCreep leverages Discord, while GraphWorm uses Microsoft’s Graph API for command-and-control communications, with the group increasingly targeting European entities and using legitimate tools for obfuscation.