Abbott Hit Twice While ShinyHunters Demands Ransom

Abbott Laboratories, the global medical device and diagnostics company, is currently investigating two separate security incidents at the same time, according to Bleeping Computer.

The first involves ShinyHunters, an extortion gang that gained access through a vishing (voice phishing — where attackers call employees by phone and impersonate trusted figures to extract credentials) attack on Abbott staff in mid-June. The group claims it compromised a Microsoft Entra SSO (single sign-on — a system that lets one login unlock many connected apps) account, then moved through connected services including ServiceNow, SharePoint, and Databricks. ShinyHunters claims to have stolen over 30 million rows of customer data including names, addresses, dates of birth, and more than one million Social Security numbers. They also claim 22 million doctor-patient conversation notes and 20 million medical orders. Abbott has confirmed unauthorised access to legacy Exact Sciences systems in its Cancer Diagnostics business, though it says operations have not been affected.

The second incident is a separate claim from a group called ShadowByt3$, which says it accessed Abbott's LabCentral customer portal on July 4 using compromised customer credentials. They claim to have taken internal technical and regulatory documents rather than patient data.

Abbott says it has engaged cybersecurity experts and notified law enforcement. Neither group's claims have been independently verified.

What you should do: If you have ever used Abbott or Exact Sciences health services, monitor your accounts for unusual activity, consider placing a credit freeze with the major bureaus, and be alert for phishing messages using your personal details as bait.

A newly identified botnet called NadMesh is systematically scanning for exposed AI tools and harvesting the cloud credentials stored on those machines, according to QiAnXin's XLab.

The botnet targets tools teams deploy quickly and rarely lock down: image generators, local model runners, and workflow builders such as ComfyUI, Ollama, and Gradio. Once it reaches an exposed service, it pulls AWS access keys, Kubernetes tokens (authorisation credentials for managing cloud server clusters), and saved configuration files from the host machine.

The operator's own dashboard — screenshotted by XLab on July 10 — claims 3,811 unique AWS keys collected. MCP (Model Context Protocol — a standard that lets AI models call external tools) sits at the top of the botnet's exploitation priority list because many MCP deployments skip authentication entirely. Think of it like leaving the staff entrance of a building propped open because the security spec said locks were optional.

Most observed exploit traffic, however, still targets Docker and Jenkins services rather than AI endpoints specifically.

What you should do: If your team runs any self-hosted AI tools, ensure they sit behind authentication and are not publicly reachable. Check that environment variable files like .env do not contain live cloud credentials on internet-facing machines.

What WordPress is: WordPress is the software that powers roughly half of all websites on the internet, from personal blogs to major news outlets.

What it is: A flaw in WordPress's REST API (the interface that lets external tools communicate with a site) batch-route endpoint can be chained with a separate SQL injection (a technique where an attacker inserts malicious database commands into a field that should only accept plain data) to let a completely anonymous user run code on any affected site. No login required.

Who's at risk: Any site running WordPress 6.9.0 through 7.0.1. Sites on 6.8.x are exposed to the SQL injection component only, not the full code-execution chain. A working proof-of-concept is publicly available.

CVSS: 7.5 (High — patch this week). Note: WordPress's own advisory rates the RCE chain Critical; the formal CVE score does not fully reflect code-execution impact. Treat this as Critical and patch today.

Root cause: WordPress's WP_Query function fails to check whether the author__not_in parameter is an array before using it. When a string is passed instead, the raw value drops into the database query unfiltered. The batch endpoint separately allows sub-request arrays to fall out of sync when one sub-request errors, causing a subsequent request to run under the wrong handler and bypass the endpoint's access controls.

Attack vector: An unauthenticated attacker sends a crafted batch request to /wp-json/batch/v1. A deliberate error in one sub-request shifts the handler assignment. The attacker's input then reaches the vulnerable WP_Query parameter, executing arbitrary database commands and ultimately arbitrary code on the server.

Recommended actions:

1. Update to WordPress 6.8.6, 6.9.5, or 7.0.2 immediately. Auto-updates may not have applied if you disabled them — verify manually.
2. Check your version now at wp2shell.com, where Searchlight Cyber has published a dedicated checker.
3. Review server logs for unusual requests to /wp-json/batch/v1.

Apple has published a warning that scammers are using FaceTime to impersonate banks and Apple itself, per Help Net Security.

The playbook goes like this: a caller spoofs (fakes) a trusted number, drops some personal details early to sound legitimate, then creates urgency so you stay on the line. The goal is to get you to share your password, a two-factor authentication (2FA) code, or disable security features entirely. Some callers instruct victims to turn off 2FA or Stolen Device Protection, claiming it will stop an attack. It will not. It opens the door to one.

Apple is clear: it will never ask you to share a password, a 2FA code, or to accept a 2FA prompt over the phone.

What to do: Hang up. Call the organisation back on a number you look up yourself. If you receive a suspicious FaceTime call from someone claiming to be Apple or a bank, take a screenshot and send it to reportfacetimefraud@apple.com.

A coalition of 42 US state attorneys general has reached an $18 million settlement with 23andMe over its 2023 data breach, which exposed the ancestry and personal data of over six million people, according to Infosecurity Magazine. The breach stemmed from credential stuffing (attackers using passwords stolen elsewhere to access accounts). New data security requirements have been imposed on TTAM Research, the company that acquired 23andMe's customer data through bankruptcy. The rules include formal risk analysis, a new data security advisory board, and the right for customers to delete their data.

What you should do: If you were a 23andMe customer, you can request deletion of your data through TTAM Research directly.