← Cybersecurity Headlines
Cybersecurity Headlines
World Cup fraud, US military location targets, IBM and Red Hat go Project Lightwell
00:07:07
Loading summary
Transcript4 lines
- [00:00]
A
From the CISO series, it's Cybersecurity Headlines
- [00:07]
B
these are the cybersecurity headlines for Friday, May 29, 2026. I'm Sarah Lane. Fraud Gang Steals from World Cup Fans Researchers at Group IB say a Chinese speaking fraud network dubbed Ghost Stadium has set up more than 300 fake FIFA ticketing sites across the thousands of domains to target fans ahead of the 2026 World Cup. The phishing pages reportedly mimic FIFA's login flow to steal credentials and payment details, then redirect victims to the real site, while some can trigger password resets to lock users out and resell legitimate tickets. Pentagon says US Military Targeted by Location Reuters reports that US Military officials say adversaries are using commercially available location data to surveil and potentially target American troops in active war zones. A bipartisan group of lawmakers warned the Pentagon that data harvested through the ad tech ecosystem can reveal troop movements and patterns, creating risks ranging from missile and drone attacks to counterintelligence exposure. The Pentagon is being urged to disable AD IDs on military devices, restrict location sharing and move personnel away from tools like Google Chrome, IBM and Red Hat Commit to Project Lightwell IBM and Red hat have invested $5 billion and assigned more than 20,000 engineers to project Lightwell, a new initiative focused on securing open source software using used across enterprise supply chains. This centers on an AI powered enterprise clearinghouse that will identify, prioritize and validate vulnerabilities in widely used open source projects, then work with maintainers to develop and distribute secure patches through commercial subscriptions. Major financial institutions like bank of America, JPMorgan Chase and Visa are backing the effort. Microsoft slams GitHub zero day disclosures Microsoft is criticizing a researcher known as Chaotic Eclipse who published details and proof of concept code for multiple Windows flaws, bypassing Microsoft's disclosure process. The company says three of the bugs affecting components including Defender and BitLocker, are being actively exploited and and warned that releasing details before patches are available puts customers at greater risk. The dispute escalated after the researchers GitHub and GitLab accounts hosting the code were removed. Huge thanks to our sponsor, Guard Square, attackers are treating your mobile app like an open book. 63% of security leaders recently detected app tampering, cloning or unauthorized modifications. When your code runs in an untrusted environment, you need runtime, self protection and code hardening to keep attackers out. Address tampering before it starts. Learn more@guard square.com Cruise giant Carnival confirms data breach Carnival Corporation says a cyber attack in April exposed personal data of 6 million people and after attackers compromised an employee account and accessed part of the company's IT systems. The stolen information includes names, contact details and in some cases dates of birth, passport and driver's license numbers. Shiny Hunters has claimed the breach and says it published millions of records. Gogs allows arbitrary code Open source Self hosted Git service Gogs has a critical unpatched vulnerability that can let any authenticated user execute arbitrary code on the server. By abusing Git's rebase function with a malicious branch name, security firm Rapid7 warns it could let attackers access every repository on a server, steal credentials, move deeper into a network and potentially expose other users. Private code, Windows, Linux and macOS deployments are all affected. It's recommended to disable open registration or repository creation until a fix is available. Gray vibe attackers use ChatGPT and Gemini researchers at with Secure say a likely Russian linked threat group called Gray Vibe has been using ChatGPT and Gemini to create realistic phishing lures, fake websites and even parts of its malware toolkit. In campaigns aimed mainly at Ukraine related targets, the group has used custom Windows and Android malware to steal files, credentials, location data and communications across military, government and business sectors. The operation seems to align with Russian interests, but doesn't act like a typical state backed campaign. Typo squatting or realistic package impersonation Sonatype reports that attackers are moving beyond typo squatting in open source repositories and instead are publishing malicious packages that look like legitimate plugins, SDKs or or config tools that developers would expect to see. An analysis of more than 4,300 malicious packages showed 91% using naming tactics targeting ecosystems like React, Eslint and Tailwind. The packages are known to steal credentials or system data and can install backdoors. Sonatype warns that typo detection alone is no longer enough and that teams need closer scrutiny of of new dependencies and publisher behavior. Join us later today for hacking pen testing in the age of agentic AI on Super Cyber Friday. It all starts at 1pm Eastern Time. You can join our chat, play some games, learn how pen testing is evolving, and even win some CISO series back, go to the events page@cisoseries.com to register and we'll see you there. If you have some thoughts on the news from today or about our show in general, be sure to reach out to us feedbackisoseries.com we always want to hear from you. I'm Sarah Lane reporting for the CISO series. Stay classy out there. Planet Earth
- [06:51]
A
Cybersecurity headlines are available every weekday. Head to CISO series.com for the full stories behind the headlines.
- [07:02]
B
Sam.