Security Roundup: Satellite Cybersecurity Bill, Chrome Flaw and Teen Arrest
Summary
The roundup covers a satellite cybersecurity bill, a W3LL phishing-kit takedown, GlassWorm, AWS and ShowDoc flaws, ShinyHunters claims and leaks, a school-network breach, EPA cyber funding, and Chrome 147 fixes.
Key points
- A Senate committee advanced the bipartisan Satellite Cybersecurity Act of 2025, which would establish a Commerce Department resource for satellite-security best practices and require a GAO study.
- The FBI and Indonesian police dismantled W3LL phishing-kit infrastructure linked to more than $20 million in attempted fraud; its developer allegedly sold access associated with over 25,000 compromised accounts.
- A GlassWorm variant uses a Zig-compiled dropper in a malicious OpenVSX extension posing as WakaTime, then installs a second-stage payload across detected VS Code-based IDEs.
- AWS fixed three Research and Engineering Studio vulnerabilities in version 2026.03; threat actors are also actively exploiting ShowDoc CVE-2025-0520, patched in version 2.8.7.
- ShinyHunters claimed access to Rockstar Games through Anodot and threatened to leak data; Rockstar confirmed limited exposure of non-material information and said core operations and player data were unaffected. The group also leaked data tied to 13.5 million McGraw Hill accounts; the company said core systems and sensitive data were not compromised.
- Police arrested a 16-year-old in connection with an intrusion into Northern Ireland’s C2k education system; the Education Authority said personal data at a small number of institutions was compromised.
- The EPA proposed doubling its information-security program funding to $19.1 million and requested authority to fund cybersecurity grants for water systems.
- Chrome 147 fixes 31 vulnerabilities, including the critical ANGLE heap buffer overflow CVE-2026-6296, for which a researcher received a $90,000 reward.
Article Details
- Event Type
- Weekly cybersecurity news roundup covering legislation, cybercrime operations, vulnerability disclosures and exploitation, data breaches, and arrests.
- Impact
- Reported impacts include more than $20 million in attempted fraud linked to the W3LL phishing operation; a ShinyHunters claim of data exfiltration from Rockstar Games, with Rockstar confirming limited exposure of non-material information; a ShinyHunters leak of records tied to 13.5 million McGraw Hill accounts; compromised personal data at a small number of institutions in the C2k intrusion; and active exploitation of a ShowDoc vulnerability to deploy web shells. The roundup also reports command execution and privilege-escalation vulnerabilities in AWS RES and multiple Chrome vulnerabilities.
MITRE ATT&CK
T1190 · Exploit Public-Facing ApplicationThreat actors are actively exploiting an unauthenticated file-upload vulnerability in internet-exposed ShowDoc instances.T1505.003 · Web ShellThreat actors are using the ShowDoc vulnerability to deploy web shells.T1566.002 · Spearphishing LinkThe W3LL phishing-as-a-service platform facilitated phishing operations and account compromise.
CVE
CVE-2025-0520ShowDoc · ShowDocTracked as CVE-2025-0520, the flaw stems from an unrestricted file upload mechanism that fails to properly validate extensions for unauthenticated users.CVE-2026-5707AWS · Research and Engineering Studio (RES)CVE-2026-5707 and CVE-2026-5709 stem from unsanitized input, enabling command injection on virtual desktop hosts and cluster-manager EC2 instances, while CVE-2026-5708 allows attackers to assume instance profileCVE-2026-5708AWS · Research and Engineering Studio (RES)input, enabling command injection on virtual desktop hosts and cluster-manager EC2 instances, while CVE-2026-5708 allows attackers to assume instance profile permissions via crafted API requests.CVE-2026-5709Vendor / Product unavailableCVE-2026-5707 and CVE-2026-5709 stem from unsanitized input, enabling command injection on virtual desktop hosts and cluster-manager EC2 instances, while CVE-2026-5708 allows attackers to assume instance profileCVE-2026-6296Vendor / Product unavailableGoogle patched 31 vulnerabilities in Chrome 147, including a critical heap buffer overflow in the ANGLE graphics component tracked as CVE-2026-6296, which earned researcher ‘Cinzinga’ a $90,000 reward.
People
CinzingaResearcher credited with the Chrome vulnerability tracked as CVE-2026-6296 and awarded $90,000.Gary PetersSenator and co-sponsor of the Satellite Cybersecurity Act of 2025, which proposes measures to help secure commercial satellites.John CornynSenator and co-sponsor of the Satellite Cybersecurity Act of 2025, which proposes measures to help secure commercial satellites.
Threat Actors
G.L.Allegedly developed and sold access to the W3LL phishing kit and managed a marketplace associated with the compromise of more than 25,000 accounts.ShinyHuntersThe group threatened to leak data allegedly exfiltrated from Rockstar Games and separately leaked data tied to 13.5 million McGraw Hill accounts.
Malware
Vendors
Amazon Web ServicesAWS RES vulnerabilities enable command execution and privilege escalationAnodotThe threat actor group ShinyHunters is threatening to leak data allegedly exfiltrated from Rockstar Games by exploiting authentication tokens within the Anodot cloud cost-monitoring tool.GoogleGoogle patched 31 vulnerabilities in Chrome 147, including a critical heap buffer overflow in the ANGLE graphics component tracked as CVE-2026-6296, which earned researcher ‘Cinzinga’ a $90,000 reward.MetaMeta equips top researchers with professional testing suitesPortSwiggerMeta has partnered with PortSwigger to provide Burp Suite Pro licenses to security researchers who reach the HackerPlus Silver league on its bug bounty platform.SalesforceThe ShinyHunters extortion group leaked data tied to 13.5 million McGraw Hill accounts after exploiting a misconfigured Salesforce environment.
Products
AnodotThe threat actor group ShinyHunters is threatening to leak data allegedly exfiltrated from Rockstar Games by exploiting authentication tokens within the Anodot cloud cost-monitoring tool.AWS Research and Engineering Studio (RES)Multiple vulnerabilities in AWS Research and Engineering Studio (RES) allow authenticated users to execute arbitrary commands and escalate privileges.Burp Suite ProMeta has partnered with PortSwigger to provide Burp Suite Pro licenses to security researchers who reach the HackerPlus Silver league on its bug bounty platform.C2KThe Police Service of Northern Ireland detained a 16-year-old in connection with a targeted cyberattack on the C2k educational system, which provides core IT services to nearly all schools in the region.Google ChromeChrome vulnerability earns researcher $90,000SalesforceThe ShinyHunters extortion group leaked data tied to 13.5 million McGraw Hill accounts after exploiting a misconfigured Salesforce environment.ShowDocCritical RCE in ShowDoc sees active exploitationSnowflakeAccording to the group, the breach provided unauthorized access to Rockstar’s Snowflake data warehouse instances.WakaTimeA new GlassWorm variant uses a Zig-compiled native dropper embedded in a malicious OpenVSX extension posing as WakaTime, allowing it to bypass typical extension sandboxing and execute with full system access.