Hackers who breached Harvard University's Alumni Affairs and Development systems in November 2025 stole data linked to more than 850,000 unique email addresses, according to breach notification service Have I Been Pwned. [...]

The Florida Department of Education says SSNs and other personal data may have been exposed in a breach of its financial aid website.

The post Florida Student Aid Website Hack Puts Data of 4.9 Million People at Risk appeared first on SecurityWeek.

Google said today it worked with industry partners to dismantle a botnet made up of more than 1.3 million Android TV set-top boxes that ship with malicious software which secretly rents the user’s Internet connection out to strangers and conducts advertising fraud. Experts involved in the takedown say the action is likely to sever the botnet’s access to more than 10 million additional compromised systems, including other Internet of Things (IoT) products such as Android-based healthcare devices and karaoke machines.

A report from the Google Threat Intelligence Group (GTIG) said Google has severed ties with Videostrong Technology Co., a TV box manufacturer in China that GTIG and other industry experts concluded was responsible for including malware that enrolled more than 1.3 million set-top boxes in a botnet dubbed “XCPE” (named after one of the malware’s core code components).

The report said the XCPE botnet loaded the user’s device with software that makes their Internet address available for resale by multiple “residential proxy” services, which allow customers to rent Internet addresses as a way to anonymize their web traffic or spoof their true location. As detailed in several stories here over the past year, residential proxy services are a major source of unwanted and often malicious traffic, including account takeover activity, advertising fraud, and mass content scraping for AI projects.

“Videostrong monetized the backdoor by selling access to criminal affiliates and loading those affiliates’ malware modules onto infected devices,” the GTIG post reads, noting that Google took legal action to take down the domains and servers Videostrong used to control the botnet and install additional malware. “A device manufacturer intentionally infecting their users with malware is an unacceptable breach of trust, and represents a serious risk to those users. Without users’ knowledge or consent, infected devices were offered as a distribution mechanism for a wide array of criminal actors.”

The report notes that while TV boxes made up the the majority of the botnet, the same XCPE malware was found in other Android-based IoT products, including telehealth devices, karaoke machines, and even digital signage systems.

Google said it requires all Android device makers to pass compatibility and security tests to ensure their products don’t harm users, but that Videostrong nevertheless found a way to load their malicious software immediately after a user boots up one of these devices for the first time (Google says it has since addressed that weakness).

The GTIG report calls out a number of residential proxy providers whose software development kits were routinely downloaded by devices infected by the XCPE botnet. Those include AppSalt, also known as Honeygain, which is owned by the Vilnius, Lithuania-based Oxylabs. In October 2026, Oxylabs was relaunched under a new brand called Source, after receiving $130 million in funding from private equity firm Warburg Pincus that reportedly valued the business at $3.6 billion. Oxylabs did not respond to a request for comment.

Another provider linked to the botnet was NetNut, a once sprawling residential proxy company operated by the publicly-traded Israeli company Alarum Technologies. In July 2026, the FBI worked with industry partners to seize hundreds of domains associated with NetNut, saying the company was responsible for operating a separate botnet called Popa that enslaved TV boxes as residential proxies. Other proxy providers named in the GTIG report include EarnFM, Traffmonetizer, Jaguar, LINKFOG, BMW/IPWeb and GaGaNode.

Google’s announcement credits a number of industry partners, including Synthient, a startup that tracks proxy providers. In January 2026, Synthient published research into the rapid spread of the Kimwolf botnet, which at the time was hammering networks worldwide with record-smashing DDoS attacks. Synthient documented how Kimwolf infected millions of Android set-top boxes virtually overnight, using a widespread vulnerability in these residential proxy services to compromise other Android-based devices inside the local networks of unsuspecting TV box users.

Synthient’s research caused dozens of residential proxy providers to patch their networks, which helped to fragment the Kimwolf botnet into much smaller pieces that made its incessant and disruptive DDoS attacks far easier for network operators to manage. It also attracted the attention of the Motion Picture Association (MPA), a trade group representing the major Hollywood studios, which partnered with Synthient to purchase and tear apart a number of popular Android TV set-top boxes — including some that were being infected by Kimwolf and other IoT botnets.

In a report published today, Synthient examined a popular, pre-infected TV box sold under the brand MECOOL by a publicly traded company in China called Skyworth Technology, concluding that MECOOL also bundled the malware from Videostrong Technology Co. and likewise installed AppSalt/Honeygain and other proxy components.

Synthient founder Ben Brundage told KrebsOnSecurity that Videostrong’s malware also distributed software for the proxy service Grass. In our November 2025 story, “Is Your Android TV Streaming Box Part of a Botnet?” we quoted a researcher from Censys who found the popular Superbox TV streaming device bundled Grass’s residential proxy software. We also quoted the Grass founder, who denied any affiliation with the TV box maker.

That November 2025 story noted that Superbox and similar Android TV set-top boxes gain new customers primarily by engaging influencers on Tiktok and other social networks who praise the product’s ability to offer hundreds of (pirated) pay TV streaming services for a one-time fee.

Likewise, Synthient’s report observes that the MECOOL set-top boxes exploded in popularity after the product was mentioned in 2023 by the Youtube channel Linux Tech Tips, which has an audience of nearly 17 million subscribers [Linux Tech Tips said in a statement shared with Synthient that it has since updated the video to explicitly frame the product as a scam and have removed all associated affiliate links].

The GTIG report estimates the XCPE botnet takedown should sever access to at least 10 million additional compromised devices, noting that the various proxy and ad fraud affiliates of Videostrong “each have diversified distribution channels for their modules beyond XCPE.”

Synthient’s Brundage echoed that conclusion, calling the 1.3 million number “highly conservative.”

“The scale of affected devices is likely way higher,” he said. “This is probably the largest operation against backdoored TV boxes that we’ve seen.”

Further reading:
Plume Security Labs white paper on the XCPE botnet (PDF)
Black Lotus Labs writeup on LinkedIn
TrendAI’s analysis
Synthient’s list of affected devices, broken down by model number

Progress has disclosed 15 security vulnerabilities in WS_FTP Server that could expose administrative credentials, enable arbitrary operating system command execution, and disrupt file transfer services.

The flaws span authentication, authorization, path handling, and resource management, with six rated critical. Progress urges customers to upgrade affected installations to supported, patched releases.

The most severe issue, CVE-2026-84295, carries a vendor-assigned CVSS score of 10.0. It affects Windows installations running versions earlier than 2024.0.6 and 2025.0.3.

Critical Progress WS_FTP Server Flaws

Improper authentication allows an unauthenticated remote attacker to access sensitive information, including administrator credentials, creating a potential route to broader compromise.

The published CVSS vector identifies network accessibility, low attack complexity, and no requirement for privileges or user interaction. NIST lists the record as awaiting enrichment; the maximum severity rating comes from Progress rather than an independent NVD assessment.

Two command injection vulnerabilities expand the potential impact. CVE-2026-90868 scores 9.9, while CVE-2026-90865 scores 9.0 and involves FTP notification variables.

Progress describes command execution scenarios involving an authenticated administrator or an authenticated FTP user under specific configuration conditions. These prerequisites distinguish the command-execution issues from the unauthenticated credential-disclosure flaw.

Three additional critical vulnerabilities affect access boundaries. CVE-2026-90866 concerns virtual folder path confinement, while CVE-2026-90864 involves host administrator path containment.

Both score 9.1. CVE-2026-90863, also rated 9.1, involves missing authorization in WS_FTP Manager that can allow delegated administrators to perform actions beyond their intended privileges.

Other weaknesses include improper access control in the Web Admin console, password exposure through activity logs, and server side script injection in the Manager interface.

Separate authentication flaws affect SSH and the Web Transfer Module, potentially allowing multifactor authentication checks to be bypassed under specific conditions.

Availability is also at risk. CVE-2026-90869 can disrupt the shared SSH service through malformed public key authentication data. CVE-2026-90870 permits resource exhaustion through repeated unauthenticated requests because backend receiver sessions are not released.

Another pathname restriction flaw, CVE-2026-90871, can enable file deletion outside intended directories under particular conditions.

Progress identifies WS_FTP Server 2024.0.7, internally numbered 9.0.7, and 2025.0.4, internally numbered 10.0.4, as releases addressing the complete vulnerability set. The 2025 release notes date version 2025.0.4 to October 1, 2026.

Earlier updates, 2024.0.6 and 2025.0.3, already corrected CVE-2026-84294, CVE-2026-84295, and CVE-2026-84296. However, those builds do not resolve every issue covered by the bulletin, so later updates are needed for comprehensive remediation.

Heise states that upgrading with the full installer is the only remediation and warns of service downtime during installation. Customers running unsupported versions should migrate to a supported fixed release. The bulletin does not report active exploitation, and severity alone does not establish that attacks have occurred.

Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team 

The post Critical Progress WS_FTP Server Flaws Allow Hackers to Steal Admin Credentials and Execute Code appeared first on Cyber Security News.

Criminals who break into corporate cloud accounts are using the stolen access to run AI models at the victim’s expense, in some cases racking up more than $100,000 in charges in a single day, Google Threat Intelligence Group (GTIG) and Mandiant researchers have found. Usage chart showing LLMJacking generating a spike in API requests (Source: Google) In 2026, Mandiant responded to several of these LLMJacking incidents, recorded in attacks on the financial services, retail, technology … More →

The post Stolen AI access leaves companies with cloud bills of up to $1 million appeared first on Help Net Security.

Synology is urging customers to update the DiskStation Manager (DSM) software powering its Network Attached Storage (NAS) devices following ransomware attacks. The Taiwanese vendor said it observed threat actors exploiting a vulnerability patched in December 2024 to target devices running outdated versions of DSM. "These attacks aim to encrypt data and extort ransom," it said in a statement