Cybersecurity Roundup: Satellite Defenses, Phishing Crackdowns, and Critical Vulnerabilities This week’s cybersecurity landscape saw significant developments across policy, law enforcement actions, and emerging threats, underscoring the evolving risks to infrastructure, software, and user data. Policy & Defense Initiatives The U.S. Senate advanced the Satellite Cybersecurity Act of 2025, a bipartisan bill led by Senators Gary Peters and John Cornyn. The legislation mandates the Department of Commerce to create a centralized resource for satellite security best practices and requires a Government Accountability Office (GAO) study on existing defenses. The move follows research revealing that nearly half of commercial satellite signals remain unencrypted, despite transmitting sensitive data. The Environmental Protection Agency (EPA) proposed doubling its cybersecurity budget to $19.1 million for FY 2027, with a focus on water system defenses. The plan includes new authority to fund cybersecurity grants under the Drinking Water Infrastructure Resilience Grant Program, aiming to harden critical infrastructure against rising threats. Law Enforcement & Cybercrime Disruptions A joint operation by the FBI’s Atlanta Field Office and the Indonesian National Police dismantled the W3LL phishing-as-a-service infrastructure, which facilitated over $20 million in attempted fraud. The platform’s primary developer, identified as G.L., allegedly sold access to the phishing kit and managed a marketplace linked to the compromise of 25,000+ accounts. In Northern Ireland, police arrested a 16-year-old in connection with a cyberattack on the C2k educational network, which serves nearly all regional schools. The breach exposed personal data at a limited number of institutions, though the full scope remains under investigation. Critical Vulnerabilities & Exploits - AWS RES Flaws: Multiple vulnerabilities in AWS Research and Engineering Studio (RES) tracked as CVE-2026-5707, CVE-2026-5708, and CVE-2026-5709 enabled command execution and privilege escalation due to unsanitized input. AWS patched the issues in version 2026.03. - ShowDoc RCE Exploited: Threat actors are actively exploiting CVE-2025-0520, a critical remote code execution flaw in ShowDoc, a popular IT documentation platform in China. The vulnerability stems from an unrestricted file upload mechanism, with thousands of instances still exposed online. A patch was released in version 2.8.7. - Chrome Zero-Day: Google addressed 31 vulnerabilities in Chrome 147, including a critical heap buffer overflow (CVE-2026-6296) in the ANGLE graphics component. The bug earned researcher ‘Cinzinga’ a $90,000 bounty. Emerging Threats & Data Breaches - GlassWorm Dropper: A new variant of the GlassWorm malware spreads via a malicious OpenVSX extension disguised as WakaTime, targeting VS Code-based IDEs (including Visual Studio Code, Cursor, and VSCodium). The Zig-compiled dropper bypasses sandboxing to execute with full system access. - ShinyHunters Strikes Again: The extortion group ShinyHunters claimed responsibility for two high-profile breaches: - Rockstar Games: Allegedly exploited Anodot cloud tokens to access Snowflake data warehouse instances, though Rockstar confirmed only non-material information was exposed. - McGraw Hill: Leaked 13.5 million user records (100GB of data, including emails, names, and addresses) after exploiting a misconfigured Salesforce environment. McGraw Hill stated core systems remained secure. Industry & Research Developments Meta partnered with PortSwigger to provide Burp Suite Pro licenses to top researchers in its bug bounty program, aiming to enhance vulnerability discovery through advanced tooling. Eligible participants must reach the HackerPlus Silver league on Meta’s platform.