Pugh’s engagements brought together military leaders, government officials, industry experts, and academic institutions. On December 5, he met with U.S. Ambassador to Jordan Jim Holtsnider in Amman. They discussed cybersecurity efforts and innovation initiatives between the United States and Jordan.

On December 9, Pugh attended Cyber Week 2025 at Tel Aviv University. This annual conference addressed emerging cyber challenges and emphasized international collaboration. “The engagement highlighted opportunities for public-private collaboration to strengthen cyber defense and protect critical infrastructure,” said Pugh.

During his remarks, he underscored the Army’s commitment to Continuous Transformation and advanced cyber capabilities. He stated, “The visit highlighted the importance of whole-of-government coordination in advancing U.S. security cooperation priorities.” His comments reflect a broader strategy to integrate cybersecurity into national defense operations.

The Defense Industrial Base (DIB) faces significant challenges regarding cybersecurity compliance. Approximately 68,000 small and mid-sized DIB suppliers must meet Level 2 requirements for compliance with the Cybersecurity Maturity Model Certification (CMMC). CMMC Level 2 compliance is mandatory for defense contractors to continue receiving Department of Defense contract revenue.

The Cyber Interceptor will launch in late April 2026. This system is designed for resource-constrained contractors, simplifying compliance with CMMC Level 2 requirements. Vince Crisler noted, “The Cyber Interceptor gives each contractor their own individual cyber dome.” This innovative approach aims to enhance security for smaller contractors struggling with compliance costs.

Pugh’s efforts signify a shift towards more robust cybersecurity frameworks in defense contracting. Observers anticipate that these initiatives will lead to stronger protections against evolving cyber threats. Yet uncertainties remain about how quickly these measures can be implemented across the DIB.

As these developments unfold, the focus remains on enhancing collaboration among various stakeholders in the cybersecurity landscape. The integration of advanced technologies and partnerships will be crucial as nations confront increasingly sophisticated cyber adversaries.

The post Cyber: Strengthening security Partnerships in Tel Aviv appeared first on Rapidcel News.

The attackers exploited the situation by taking over the employee’s Google Workspace account. This allowed them to access various Vercel environments. They accessed non-sensitive environment variables, which could potentially expose API keys and database credentials.

Vercel has identified a limited number of affected customers and has contacted them to rotate their credentials. However, the incident may impact hundreds of users across different organizations due to the OAuth app associated with Context.ai.

In response to the breach, Vercel is collaborating with Mandiant and law enforcement agencies to investigate the matter further. The company stated that its services remained operational throughout the incident, minimizing disruption for users.

Guillermo Rauch, CEO of Vercel, remarked, “The attackers were able to gain further access through the enumeration of these non-sensitive variables.” Yet, Vercel indicated it has no evidence that sensitive data was accessed during this incident.

A post on BreachForums claimed to be selling Vercel data for two million dollars. Details remain unconfirmed regarding the legitimacy of these claims. Vercel has published specific Indicators of Compromise (IoC) to help Google Workspace administrators check their environments for any relevant OAuth applications.

This incident comes at a time when Vercel is valued at $9.3 billion following its most recent funding round in September 2025. The company is known for being the primary steward of Next.js—a widely used web development framework that boasts six million weekly downloads.

As investigations continue, Vercel emphasizes its commitment to user security and transparency. The company aims to mitigate risks and prevent future incidents while maintaining trust with its user base.

The post Vercel Discloses Security Incident on April 20, 2026 appeared first on Rapidcel News.

The malware, once installed, is designed to steal sensitive information such as passwords, payment details, and account access. It installs an Electron application that runs a Python interpreter to execute its harmful payload. Notably, the malware employs two persistence mechanisms: a registry entry and a shortcut in the Startup folder, ensuring it remains active even after system reboots.

Recent data breaches in France have compromised a staggering 90 million records, with 43 million records linked to France Travail alone. This has made the region an attractive target for cybercriminals, as 19 million subscriber contracts were affected by these breaches. The high volume of personal information circulating from these incidents has likely contributed to the malware’s focus on French-speaking users.

VirusTotal, a widely used malware detection service, showed zero detections across 69 engines for the main executable and 62 for the VBS launcher associated with this malware. This alarming statistic highlights the sophistication of the attack, as a zero-detection result does not necessarily indicate a file’s safety. “The most important takeaway is that a zero-detection VirusTotal result does not mean a file is safe,” a cybersecurity expert noted.

Microsoft has emphasized that the only legitimate source for manual downloads of Windows updates is through the Microsoft Update Catalog. Users are advised to be cautious, as domains like microsoft-update[.]support may appear plausible but are not affiliated with Microsoft. “If you think you may have installed this update, here’s what to do:” the advisory states, urging users to take immediate action if they suspect they have been compromised.

Chongwei Chen, a cybersecurity analyst, remarked, “Windows updates are cumulative but not infinitely so,” suggesting that users should remain vigilant about the updates they install. This incident underscores the importance of verifying the authenticity of software updates, especially in light of the ongoing threat landscape.

As the situation develops, cybersecurity experts continue to monitor the spread of this malware and its impact on users. France’s recent history of data breaches has created a fertile ground for such attacks, and officials are urging users to exercise caution when downloading updates or software from unfamiliar sources. Details remain unconfirmed regarding the full extent of the malware’s reach and the potential implications for affected users.

The post Windows Update Malware Targets French-Speaking Users appeared first on Rapidcel News.

Healthcare data breaches are a growing concern, with CareCloud being the latest to confirm an incident. On March 16, 2026, the organization reported a serious security breach involving unauthorized access to its systems. Hackers accessed one of CareCloud’s systems that stores electronic health records, with the unauthorized access lasting more than eight hours.

CareCloud restored full system functionality and data access on the same day of the breach. The company stated that the incident was contained to a single environment and did not impact other systems or platforms. “The company believes the attackers are no longer inside,” a representative noted.

However, the breach exposed sensitive patient data, which can support fraud and identity theft. CareCloud serves more than 45,000 providers and supports millions of patients, raising significant concerns about the potential implications of this incident.

In response to the breach, CareCloud has engaged external cybersecurity specialists and notified law enforcement. “That detail matters because stolen health data often fuels identity theft, insurance fraud, and targeted scams,” experts have warned.

The disruption affected one of its electronic health record environments and required incident response and forensic investigation. Observers have noted that even when companies respond quickly, the ripple effects can last much longer.

Details remain unconfirmed regarding whether any data was taken during the breach, and the specific information involved has not been disclosed. As the investigation continues, stakeholders are closely monitoring the situation to understand the full impact of the incident.

The post CareCloud Faces Data Breach Amid Growing Concerns appeared first on Rapidcel News.

Scammers are increasingly using emails to obtain personal information from retirees, posing as the Social Security Administration (SSA). In 2025, over 330,000 government impersonation complaints were reported to the Federal Trade Commission (FTC), marking a 25% increase from the previous year. This alarming trend has prompted the SSA to issue warnings about the dangers associated with these fraudulent communications.

According to Michelle L. Anderson, a spokesperson for the SSA, “We are seeing a sharp increase in fraudulent emails designed to look like official Social Security Administration communications.” These scams often employ official-looking language, logos, and formatting to mislead recipients into believing they are legitimate. Scammers may claim that a Social Security statement is ready to download, further enticing individuals to engage with the email.

The SSA emphasizes that official emails will always originate from addresses ending in .gov. In contrast, scam emails frequently contain suspicious links or attachments that can lead to identity theft and financial loss. The agency advises recipients to avoid clicking links or opening attachments in unsolicited messages, as these actions can compromise personal information.

Individuals are particularly vulnerable as scammers specifically target sensitive information such as full or partial Social Security numbers, dates of birth, and bank account access. Scammers often pressure victims to act immediately, claiming there is a problem or that they have won a prize, creating a sense of urgency that can cloud judgment.

In response to these threats, the SSA urges anyone who receives a suspicious email to report it to the SSA Office of Inspector General. Michelle L. Anderson further advises, “If you receive a message from someone claiming to be from the agency, don’t respond, don’t click any links, and don’t call the number in the message.” These precautionary measures are vital in protecting oneself from potential scams.

For those who may have inadvertently shared personal information with a scammer, the SSA recommends stopping all contact immediately and reporting the incident. The agency’s guidance is clear: “These messages are not from Social Security. Anyone who receives one should delete it immediately and report it.” This proactive approach is essential in mitigating the risks associated with these scams.

As the number of reported impersonation complaints continues to rise, observers expect further efforts from the SSA to combat these fraudulent activities. The agency’s ongoing public awareness campaigns aim to educate individuals about the signs of scam emails and the importance of safeguarding personal information. Details remain unconfirmed regarding any new measures that may be implemented in response to this growing threat.

The post SSA Imposter Scam Emails on the Rise appeared first on Rapidcel News.

“The FBI is aware of malicious actors targeting Director Patel’s personal email information, and we have taken all necessary steps to mitigate potential risks associated with this activity,” an FBI spokesperson stated regarding the recent hacking incident involving Kash Patel. The breach, attributed to the Iran-linked Handala group, has raised significant concerns about cybersecurity and personal privacy.

Kash Patel’s personal email was reportedly hacked, with the attackers releasing a trove of personal photographs and emails from his Gmail account. Among the leaked content, which includes emails dating back to 2010, the most recent was a plane ticket receipt from 2022. The Handala group claimed that the leak was a form of retaliation for the seizure of its websites by the FBI.

Adding to the intrigue, the username “spiderkash” was linked to a Telegram account that appeared in 22 Russian-language groups. However, no verified connection between this account and Patel has been established. Cybersecurity analysts have noted that hacker groups often mix legitimate information with fabricated data, making it difficult to ascertain the truth.

Details remain unconfirmed regarding the authenticity of the connection between Kash Patel and the ‘spiderkash’ username, which was also found on an adult website, Xvideos. Screenshots of the Xvideos profile began circulating widely after the hack, prompting social media commentary. One observer remarked, “Bro was really out here spinning webs,” while another cautioned, “This is why you never reuse usernames across the internet.”

While the leaked emails predate Patel’s tenure with the Trump administration, the implications for his reputation are still unclear. The incident has drawn attention not only for its content but also for the potential risks associated with personal data breaches in the digital age.

The FBI has offered a reward of $10 million for information leading to the identification of the Handala hackers, underscoring the seriousness of the situation. As the investigation continues, the focus remains on the extent of the information leaked and its potential impact on Patel’s public image.

In the wake of this incident, cybersecurity experts emphasize the importance of safeguarding personal information and being cautious about online activities. The case serves as a reminder of the vulnerabilities individuals face in an increasingly interconnected world.

The post Spiderkash: Kash Patel’s Email Hack and the ” Connection appeared first on Rapidcel News.

On March 27, 2026, it was reported that a pro-Iranian hacking group, known as the Handala Hack Team, claimed to have breached the email account of FBI Director Kash Patel. This incident has drawn attention not only for its implications on Patel’s personal security but also for the broader context of cybersecurity threats faced by public officials.

The hackers published a range of materials, including photos and documents taken from Patel’s email account. The stolen emails reportedly date from around 2011 to 2022, indicating a significant window of vulnerability. The breach was characterized as a compromise of personal information rather than a direct attack on FBI systems, as confirmed by the FBI.

In response to the breach, the FBI stated that no government information was obtained, emphasizing that the incident primarily involved Patel’s personal, business, and travel correspondence. The agency has taken necessary steps to mitigate potential risks associated with the breach, highlighting the seriousness of the situation.

The Handala Hack Team claimed that their actions were a form of retaliation for a missile strike on an elementary school in Iran, which reportedly resulted in the deaths of 168 children. This context underscores the motivations behind the hacking, linking it to geopolitical tensions and conflicts.

This is not the first instance where Kash Patel’s private information has been targeted. In late 2024, he was informed that he had been specifically targeted as part of an Iranian hacking operation. The Justice Department has accused the hackers of being affiliated with Iran’s Ministry of Intelligence and Security, further complicating the narrative surrounding this breach.

As part of their investigation, the FBI is offering a $10 million reward for information leading to the identification of the Handala Hack Team. This significant financial incentive reflects the urgency and seriousness with which the FBI is treating this breach, particularly given the potential risks involved.

Ron Fabela, a spokesperson for the FBI, described the breach succinctly, stating, “This isn’t an FBI compromise — it’s someone’s personal junk drawer.” This comment highlights the nature of the information accessed and the distinction between personal and governmental security breaches.

As the investigation continues, details remain unconfirmed regarding the exact timeline of the hack. The implications of this breach extend beyond Kash Patel, raising questions about the security of personal information for officials and the ongoing threat posed by foreign hacking groups.

The post Kash Patel Email Breach Raises Security Concerns appeared first on Rapidcel News.

“Anyone who has installed and run the project should assume any credentials available to [the] LiteLLM environment may have been exposed, and revoke/rotate them accordingly,” stated a representative from the Python Packaging Authority (PyPA). This warning comes in the wake of a significant supply chain attack that compromised versions 1.82.7 and 1.82.8 of the LiteLLM software.

The attack, which began in late February 2026, involved the injection of credential-stealing code into LiteLLM via Trivy in the continuous integration and continuous delivery (CI/CD) pipeline. The malicious code was embedded in the file litellm_init.pth, targeting sensitive information such as environment variables, SSH keys, and cloud credentials.

On March 24, 2026, at approximately 8:30 UTC, the compromised versions were published on the Python Package Index (PyPI). Just under three hours later, at 11:25 UTC, PyPI quarantined the malicious packages after identifying the threat.

According to reports, TeamPCP, the threat actor behind the attack, has previously compromised various ecosystems, including GitHub Actions and Docker Hub. Their activities are part of a broader campaign targeting security tools and open-source infrastructure, raising concerns about the integrity of such systems.

“These companies were built to protect your supply chains yet they can’t even protect their own. The state of modern security research is a joke,” remarked a spokesperson for TeamPCP, indicating their intent to continue exploiting vulnerabilities in the system.

In light of this incident, users are advised to audit their environments for the compromised LiteLLM versions and to revoke any exposed credentials. The Python Packaging Authority has issued a security advisory to inform users of the risks associated with the compromised software.

As the situation unfolds, experts warn that the campaign is likely not over. “This campaign is almost certainly not over,” stated representatives from Endor Labs, emphasizing the ongoing threat posed by TeamPCP.

Gal Nagli, a cybersecurity expert, commented, “The open source supply chain is collapsing in on itself,” highlighting the vulnerabilities that have been exposed through this incident.

As the cybersecurity community continues to assess the damage and implement protective measures, the implications of this attack on the future of open-source software and security practices remain to be seen.

The post LiteLLM Supply Chain Attack Exposes Credentials appeared first on Rapidcel News.

“Anyone who has installed and run the project should assume any credentials available to [the] LiteLLM environment may have been exposed, and revoke/rotate them accordingly,” stated the Python Packaging Authority (PyPA) in response to the recent supply chain attack on LiteLLM.

The attack, which targeted versions 1.82.7 and 1.82.8 of LiteLLM, was executed through an injection of credential-stealing code via Trivy in the CI/CD pipeline. This malicious code was embedded in the file litellm_init.pth.

The campaign, attributed to the threat actor TeamPCP, began in late February 2026, with the compromised versions published on March 24, 2026, at approximately 8:30 UTC. Shortly after, at 11:25 UTC, PyPI quarantined the malicious packages.

The payload of the attack is particularly concerning as it targets environment variables, SSH keys, cloud credentials, and other sensitive data, which are then exfiltrated to domains controlled by the attackers.

TeamPCP has a history of compromising various ecosystems, including GitHub Actions and Docker Hub, indicating a broader trend of coordinated attacks targeting security tools and open-source infrastructure.

In light of these events, users of LiteLLM are advised to audit their environments for the compromised versions and to revoke any exposed credentials. The Python Packaging Authority has also published a security advisory regarding the compromise.

Gal Nagli, a cybersecurity expert, remarked, “The open source supply chain is collapsing in on itself.” This sentiment reflects growing concerns about the integrity of security measures within the open-source community.

TeamPCP’s audacious claim, “These companies were built to protect your supply chains yet they can’t even protect their own, the state of modern security research is a joke, as a result we’re gonna be around for a long time stealing terabytes of trade secrets with our new partners,” underscores the seriousness of the threat.

As the situation develops, experts from Endor Labs have warned that “This campaign is almost certainly not over.” The implications of this attack could resonate throughout the open-source community for some time.

The post LiteLLM Supply Chain Attack Raises Security Concerns appeared first on Rapidcel News.

In recent months, Iranian cyber attacks have intensified, particularly amid escalating geopolitical tensions in the region. Iranian-linked cyber espionage has surged across the Middle East, with state actors increasingly engaging with the cybercrime ecosystem to further their objectives.

On a notable occasion, the Handala group claimed responsibility for a significant cyber attack on Stryker, a major medical technology company. This attack resulted in the wiping of over 200,000 systems and the exfiltration of 50TB of data, leading to widespread disruption across Stryker’s global operations.

Stryker confirmed that the attack caused a global disruption of its Microsoft environment, impacting operations in 79 countries where its offices were forced to shut down. The company employs approximately 56,000 individuals, and the incident has raised concerns about the security of critical infrastructure.

In a statement, Stryker noted, “The incident has caused, and is expected to continue to cause, disruptions and limitations of access to certain of the company’s information systems and business applications supporting aspects of the company’s operations and corporate functions.” This highlights the ongoing challenges faced by organizations targeted by cyber attacks.

Experts have pointed out that the attack on Stryker involved the potential use of enterprise management infrastructure, possibly leveraging Microsoft Intune to execute destructive activities at scale. Kathryn Raines commented, “What makes the Stryker incident particularly concerning is the apparent use of enterprise management infrastructure – potentially weaponizing Microsoft Intune – to carry out destructive activity at scale.”

Additionally, the group TA453 conducted a credential phishing attempt against a U.S. think tank during this period, further illustrating the aggressive nature of Iranian cyber operations. Iranian hacktivist groups have claimed responsibility for various disruptive operations, often disguising their activities as ordinary cyber crime to complicate attribution.

Chris Henderson remarked, “This goes to show geopolitical conflicts don’t stay overseas. Nation-state actors are targeting American companies that support critical infrastructure, healthcare, energy, and manufacturing, because the disruption extends far beyond the initial victim.” This underscores the broader implications of such cyber attacks on global security.

Despite the significant developments, details remain unconfirmed regarding the exact methods used in the Stryker attack and how wider Iranian cyber operations will continue. As the situation evolves, the international community remains vigilant about the implications of these cyber threats.

The post Iranian cyber attacks appeared first on Rapidcel News.