perfect4sec

DFIR | Threat Intelligence | Malware Analyst | Researcher | Cybersecurity Proactive Defense Team

[perfect4sec @perfect4sec]

@IntCyberDigest No problem, I use Windows

[International Cyber Digest @IntCyberDigest]

🚨 BREAKING: More than 400 Arch Linux User Repository packages have been compromised with infostealer malware and a rootkit.

Attacker posed as a trusted maintainer and "adopted" orphaned packages.

Arch maintainers are purging infected packages now. Audit your AUR installs.

[perfect4sec @perfect4sec]

@TheHackersNews Ivanti again???

[The Hacker News @TheHackersNews]

🚨 CVE-2026-0257, a PAN-OS and Prisma Access authentication bypass flaw, is under active exploitation.

The CVSS 7.8 bug can enable unauthorized VPN access and, in some observed cases, access to internal networks.

Patch immediately or apply mitigations.

Details: https://t.co/BlECtBGWR1

[Socket @SocketSecurity]

UPDATE: So far we've identified 639 compromised npm package versions across 323 unique packages in tonight’s Mini Shai-Hulud wave.

That includes 558 versions across 279 unique @​antv packages. Most were detected within ~6 minutes of publication.

https://t.co/JXJK1NT4dp

[perfect4sec @perfect4sec]

@DailyDarkWeb

[perfect4sec @perfect4sec]

@DarkWebInformer Good job Instructure

[perfect4sec @perfect4sec]

@BleepinComputer NVIDIA now? Shinyhunters again...

[perfect4sec @perfect4sec]

@0xSabir 14K?? This is crazy

[perfect4sec @perfect4sec]

@vxunderground Shinyhunters please update my grades!! Haha

[perfect4sec @perfect4sec]

@FBICyberDiv Shinyhunters .l.

[vx-underground @vxunderground]

Here is the list of every school district, college, and university impacted by the ShinyHunter's Canvas compromise. It is nearly indeed over 9,000 schools because it includes entire school districts.

Here is a list of every place currently impacted:
https://t.co/E9wCXYGczw

[The Hacker News @TheHackersNews]

🚨 12 vulnerabilities in the vm2 Node.js library enable sandbox escape and arbitrary code execution.

Flaws (CVSS up to 10.0) affect versions up to 3.11.1; patches released through 3.11.2.

Read the full story: https://t.co/1AIOjXp53f

[perfect4sec @perfect4sec]

@IntCyberDigest

[BleepingComputer @BleepinComputer]

Backdoored PyTorch Lightning package drops credential stealer
https://t.co/Wph67MgE52

https://t.co/Wph67MgE52

[Mandiant (part of Google Cloud) @Mandiant]

UNC6692 is impersonating IT helpdesk employees on Microsoft Teams to deploy custom malware.

The SNOW ecosystem (SNOWBELT, SNOWGLAZE, SNOWBASIN) enables deep network penetration and exfiltration. Read the analysis and get indicators of compromise.

➡️ https://t.co/vnHZVuNWi2

[BleepingComputer @BleepinComputer]

PyPI package with 1.1M monthly downloads hacked to push infostealer
https://t.co/9GkEK9bHgg

https://t.co/9GkEK9bHgg

[Hackmanac @H4ckmanac]

🚨Cyber Alert ‼️

🇺🇸US - 𝗨𝗱𝗲𝗺𝘆

ShinyHunters claims to have breached Udemy, with over 1.4M records compromised, including PII and other internal corporate data.

Threat actor: ShinyHunters
Sector: Education
Data exposure (claimed): 1,400,000 records
Data type: Personal data and internal corporate data
Observed: Apr 24, 2026
Status: Pending verification
ESIX©: 6.30

Full details and impact assessment on https://t.co/eB7qgxKFAa

[The Hacker News @TheHackersNews]

🚨 73 VS Code extensions flagged as malicious.

Researchers say some are sleeper packages that later update to steal data and install backdoors across developer tools.

🔗 Full details: https://t.co/ZIEGP2uact

[BleepingComputer @BleepinComputer]

CISA has ordered U.S. federal agencies to patch a Microsoft Defender privilege escalation flaw (dubbed BlueHammer) that has been exploited in zero-day attacks.
https://t.co/isROAzx5Az