Cybersecurity Roundup: Google Layoffs, AudiA6 Takedown and $400 Million Coupang Fine
Summary
SecurityWeek’s roundup covers reported Google security layoffs, the AudiA6 crypto-laundering takedown, a $400 million Coupang fine, Oxford’s CareerConnect breach, an actively exploited LiteLLM flaw, and other security developments.
Key points
- A former IBM cybersecurity executive alleges IBM and AT&T concealed repeated foreign government-linked hacks; the companies’ alleged conduct is described in a lawsuit.
- The University of Oxford disclosed that hackers accessed CareerConnect and compromised names, email addresses and encrypted passwords for alumni, research staff and employer accounts.
- Google has reportedly laid off employees in its cybersecurity division, including Mandiant and Google Threat Intelligence Group staff; the number has not been confirmed.
- Microsoft released an incident-response playbook for investigating potentially malicious activity involving Microsoft 365 Copilot and Azure AI Services.
- CISA added CVE-2026-42271, a critical command-injection flaw in LiteLLM, to its Known Exploited Vulnerabilities catalog; details about attacks were not provided.
- South Korea’s PIPC fined Coupang $400 million over security and data-handling failures that exposed information on more than 30 million customers; Coupang plans to appeal.
- Europol- and Eurojust-supported authorities dismantled AudiA6, a cryptocurrency-laundering network that laundered more than $388 million for ransomware actors, and shut down the operators’ Dark2Web forum.
- Bitsight’s 2026 ICS/OT exposure report found monthly internet-facing exposures remained near 170,000 while support for additional protocols widened the attack surface.
Article Details
- Event Type
- Weekly cybersecurity news roundup covering a data breach, a vulnerability added to CISA’s Known Exploited Vulnerabilities catalog, regulatory penalties, a cryptocurrency-laundering network takedown, and other cybersecurity developments.
- Impact
- The University of Oxford breach exposed names, email addresses, and encrypted passwords for alumni, research staff, and employer accounts; students were not affected. CISA reported active exploitation of CVE-2026-42271, a critical command injection flaw in LiteLLM, but the article provides no details about the attacks. Coupang’s data-handling and security failures exposed information belonging to more than 30 million customers and led to a $400 million fine, which Coupang plans to appeal. Authorities dismantled AudiA6, which reportedly laundered more than $388 million for ransomware actors between 2022 and 2025.
CVE
Vendors
AT&TIBM and AT&T accused of hack cover-upsBerriAICISA has added CVE-2026-42271, a critical command injection vulnerability in the AI gateway BerriAI LiteLLM, to its Known Exploited Vulnerabilities (KEV) catalog due to evidence of active exploitation in the wild.BitsightBitsight’s 2026 Global State of ICS/OT Exposure report indicates that internet-facing industrial control systems (ICS) have plateaued at roughly 170,000 monthly exposures.Google CloudGoogle Cloud has reportedly initiated a round of layoffs impacting its cybersecurity division, specifically targeting members of the Mandiant team and the Google Threat Intelligence Group (GTIG).IBMIBM and AT&T accused of hack cover-upsMicrosoftMicrosoft issues incident response playbook for AINokiaNokia debuts automated edge defense for proxy botnets
Products
Azure AI ServicesMicrosoft has released a new practitioner’s playbook detailing how to investigate security incidents involving Microsoft 365 Copilot and Azure AI Services.CareerConnectUniversity of Oxford impacted by CareerConnect data breachDeepfield Genome ShieldNokia has introduced Deepfield Genome Shield, an automated security platform designed to proactively defend against massive DDoS attacks driven by residential proxy botnets.LiteLLMCISA mandates patching for actively exploited LiteLLM flawMicrosoft 365 CopilotMicrosoft has released a new practitioner’s playbook detailing how to investigate security incidents involving Microsoft 365 Copilot and Azure AI Services.
Industries
Cryptocurrencylaw enforcement coalition supported by Europol and Eurojust has dismantled AudiA6, a prominent cryptocurrency laundering network that laundered over $388 million for ransomware actors between 2022 and 2025.Industrial control systemsBitsight’s 2026 Global State of ICS/OT Exposure report indicates that internet-facing industrial control systems (ICS) have plateaued at roughly 170,000 monthly exposures.