The Quiet Warning That Didn’t Stop the Bleed

On August 25, 2026, Cosmos Labs dropped a bombshell: a critical flaw in the shared Cosmos EVM module had been actively exploited for nearly a week. Between August 20 and August 25, attackers drained funds from six blockchains running the vulnerable code. The kicker? Cosmos Labs knew about the bug before the first exploit — and knew that every blockchain using the module was exposed.

The vulnerability, tracked as GHSA-7g4w-cg88-2cq2, is rated Critical. But here’s the odd part: it was published without a CVE identifier, without a weakness classification, and without a CVSS score. For a flaw that let attackers siphon tokens across multiple networks, that’s a glaring omission.

What the Cosmos EVM Flaw Actually Does

At its core, the bug lives in how the EVM module handles balances. Specifically, it fails to properly enforce balance checks during certain contract interactions. An attacker could craft a malicious contract that manipulates the accounting logic, effectively allowing them to spend funds they don’t own.

Think of it like a bank teller who trusts the number on a deposit slip without checking the actual cash. The attacker writes a fake slip, walks out with money, and the system never notices until it’s too late.

Affected Versions and the Patch

Cosmos Labs confirmed that all versions below 0.6.2 are vulnerable. The fix landed in version 0.6.2, which was released alongside the advisory. If you’re running anything older, you’re exposed — and given that the exploit was already in the wild, upgrading isn’t optional.

Six Blockchains Hit, but Which Ones?

Cosmos Labs hasn’t named the six affected chains. That’s frustrating for operators and users alike. What we do know is that the exploit window was tight: August 20 to August 25. That’s five days of active draining before the public advisory dropped.

The lack of transparency raises uncomfortable questions. Did Cosmos Labs wait too long to go public? Did they give chain operators a heads-up before the advisory? The advisory itself doesn’t say, and the silence is deafening.

Why the Missing CVE and CVSS Score Matters

Security researchers rely on CVE identifiers and CVSS scores to prioritize patches. Without them, teams have to manually assess the risk — a slow process when every minute counts. The advisory does include a GitHub Security Advisory ID (GHSA-7g4w-cg88-2cq2), which helps, but it’s not the industry standard.

This isn’t just bureaucratic nitpicking. A critical flaw with no CVSS score is like a fire alarm with no volume knob. You know something’s wrong, but you can’t tell how urgent it is.

Lessons for Cosmos Developers and Users

If you’re building on Cosmos, here’s what you need to do right now:

• Upgrade to Cosmos EVM module version 0.6.2 or later immediately. There is no workaround.
• Audit your contracts for any interactions with the EVM module that involve balance transfers or token accounting.
• Monitor your chain’s activity for unusual patterns between August 20 and August 25. If you see anomalies, assume the worst.
• Review the advisory GHSA-7g4w-cg88-2cq2 for technical details and indicators of compromise.

For users holding tokens on Cosmos-based chains, the advice is simpler: stay alert. If your chain was one of the six, you may be entitled to information from the team — but don’t hold your breath for compensation.

The Bigger Picture: Shared Code, Shared Risk

This incident highlights a fundamental tension in the blockchain world. Shared modules like the Cosmos EVM bring efficiency and interoperability, but they also create a single point of failure. One bug in a shared module can compromise dozens of chains at once.

Cosmos Labs’ advisory is a stark reminder that security in the Cosmos ecosystem is only as strong as its weakest link. And right now, that link was the EVM module.

For more on how similar exploits have shaped the ecosystem, check out our coverage of cross-chain bridge security and Cosmos ecosystem vulnerabilities.

Berlin officials confirm extortion attempt after August cyberattack

Berlin’s state government has officially confirmed it is the target of an extortion attempt. The admission comes weeks after hackers compromised the city’s administrative network in August. But officials are drawing a hard line: they won’t pay.

The statement, released by the Senate, also revealed that forensic investigators uncovered additional data outflows. The latest discovery involves the Senate Department for Mobility, Transport, Climate Protection and Environment. That’s a significant expansion of the breach’s scope.

So far, the city has not specified the exact nature of the stolen data. Nor have officials named the attackers. But the message is clear: Berlin will not negotiate.

Why Berlin is refusing to pay the ransom

It’s a decision that carries real consequences. Refusing to pay often means the stolen data gets published online. Yet cybersecurity experts have long argued that giving in to hackers only fuels the cycle.

“Paying ransoms doesn’t guarantee data recovery,” says one Berlin-based IT security analyst familiar with the case. “And it paints a target on your back for future attacks.”

The city’s stance aligns with broader German government policy. Federal authorities have repeatedly discouraged ransom payments to cybercriminals. The logic is straightforward: if everyone pays, the attacks will never stop.

The breach: what we know so far

The August attack hit the city’s state administrative network, a system that handles sensitive data across multiple departments. Initial reports suggested a limited compromise. Now, officials admit the damage may be deeper.

The newly confirmed data outflow from the transport and environment department raises serious questions. That department manages everything from public transit contracts to climate policy documents. If that data lands in the wrong hands, the fallout could be significant.

Forensic teams are still working to determine the full extent of the leak. The city has not provided a timeline for when the investigation might conclude.

What data was stolen?

Officials haven’t disclosed specific details. But based on typical attacks of this nature, the stolen data could include:

• Employee records and internal communications
• Contract documents and vendor information
• Project plans related to transport and environmental initiatives
• Potentially sensitive citizen data

Until the forensic analysis is complete, the full picture remains unclear.

How Berlin is responding to the cyberattack

The city has activated its crisis response protocols. IT teams are working around the clock to secure affected systems and prevent further unauthorized access.

Authorities have also notified the relevant data protection officers. That’s a legal requirement under German and EU regulations when personal data is compromised.

Public communication has been measured. Officials are balancing transparency with operational security. Sharing too much could tip off the attackers or expose additional vulnerabilities.

For residents and businesses that interact with the city’s digital services, the advice is to remain vigilant. Watch for suspicious communications that might reference data obtained from the breach.

The bigger picture: ransomware and public institutions

Berlin is far from alone in facing this dilemma. Public institutions across Germany and Europe have become prime targets for cybercriminals. The attacks are often opportunistic, exploiting known vulnerabilities rather than targeting specific victims.

But public entities face a unique pressure. They hold data on millions of citizens. A leak can expose personal information, financial records, and confidential government operations. The stakes are enormous.

Some cities have paid ransoms in the past, hoping to minimize damage. Others, like Berlin, have chosen to resist. The debate over which approach is more effective continues to divide experts.

What’s certain is that the threat isn’t going away. Municipalities across Germany are now reviewing their own cybersecurity postures, wondering if they could be next.

What happens now for Berlin?

The immediate focus is on damage control. Forensic teams continue their work. Law enforcement and federal cybersecurity agencies are likely involved in the investigation.

Longer term, the city will need to answer tough questions. How did the attackers get in? Were there warning signs that went unheeded? What steps will be taken to prevent a repeat?

Public trust is also on the line. Berlin residents expect their government to protect their data. A breach of this scale tests that confidence.

For now, the city’s position is firm. No ransom. No negotiation. Whether that decision proves wise will depend on what the hackers do next.

The coming weeks will be telling. If the stolen data appears online, the city will face a public relations crisis. If the attackers move on, Berlin’s resolve will have paid off.

Either way, this case is a stark reminder: no institution, however well-funded, is immune to cyber threats. And the choice to pay or not to pay is never easy.

Log4j RCE Scare Resurfaces

Another week, another Log4j nightmare. Security researchers flagged a fresh remote code execution (RCE) scare tied to the infamous logging library. The flaw, which first rocked the internet in December 2021, continues to haunt unpatched systems. This time, attackers are actively exploiting a variant that bypasses earlier mitigations.

If you thought the Log4j saga was over, think again. The vulnerability is now a gift that keeps on giving for cybercriminals. Organizations that failed to apply patches or left legacy components running are the prime targets. The message is blunt: if you haven’t audited your Java-based apps yet, you’re late.

Security teams are urged to recheck their inventory. A single forgotten instance could be the entry point for a full-scale breach. The Log4j RCE scare is a stark reminder that old vulnerabilities never really die—they just wait.

Minimus Shutdown: What It Means

In a quieter corner of the web, the Minimus service has shut down. For those unfamiliar, Minimus was a niche tool favored by privacy enthusiasts and researchers. Its sudden closure leaves a gap, but the details remain murky. The operators cited unspecified reasons, sparking speculation about legal pressure or financial strain.

The shutdown is a blow to users who relied on its unique features. Alternatives exist, but none offer the exact combination that made Minimus popular. It’s a reminder that even small services can vanish overnight, taking user trust and data with them.

For now, the community is scrambling to archive what it can. Some are already migrating to self-hosted solutions. The Minimus shutdown may be a footnote in the broader security landscape, but its impact on its niche audience is real.

Iranian Hacker Sanctions: A Coordinated Crackdown

Governments are tightening the screws on Iranian cyber operatives. New sanctions target individuals linked to state-sponsored hacking campaigns. The moves come after a series of attacks on critical infrastructure and diplomatic targets. Officials say the sanctions aim to disrupt funding and signal that such activities won’t be tolerated.

The sanctioned individuals are accused of working for the Islamic Revolutionary Guard Corps (IRGC). Their alleged activities include phishing, malware deployment, and data exfiltration. The sanctions freeze assets and ban transactions, but enforcement remains a challenge across borders.

This isn’t the first time Iranian hackers have faced sanctions, but the scope is broader. Experts note that while punitive measures help, they don’t stop the attacks. The real defense, they argue, lies in robust cyber hygiene and international cooperation.

Manchester Airports Group Cyberattack

UK’s Manchester Airports Group (MAG) fell victim to a cyberattack that disrupted operations. The group, which runs several major airports, reported service interruptions but kept flights running. The nature of the attack wasn’t immediately clear, but initial reports suggest a ransomware or DDoS incident.

Passengers faced delays and confusion as systems went offline. The group’s IT team worked to restore services, but the incident highlighted the vulnerability of critical transport infrastructure. It’s a stark example of how cyber threats can have physical-world consequences.

This attack follows a worrying trend of targeting airports and logistics hubs. The industry is increasingly on high alert, but the pace of attacks often outstrips defenses. For now, MAG is cooperating with authorities to investigate the breach.

Carhartt Breach: The Data Was Partly Fake

Remember the Carhartt data breach? Turns out, some of the leaked data was bogus. Security researchers discovered that the stolen records contained fake entries, possibly planted by the attackers to mislead or by someone testing the leak’s authenticity. The revelation complicates the response for affected users.

The mix of real and fake data means victims can’t be sure if their information is actually compromised. This uncertainty is a nightmare for identity protection services. Experts advise users to assume the worst and monitor their accounts, rather than dismissing the breach as a false alarm.

Carhartt has remained tight-lipped about the incident, but the company is likely working with law enforcement. For the rest of us, it’s a lesson in skepticism: not every leak is what it appears to be.

U.S. Bank Responds to Ransomware Gang’s Claims

U.S. Bank found itself in the crosshairs of a ransomware gang’s PR stunt. The group claimed to have breached the bank and threatened to release stolen data. But U.S. Bank pushed back, stating the claims are exaggerated or outright false. The bank says it found no evidence of a significant breach.

This cat-and-mouse game is common in the ransomware world. Gangs often name-drop big targets to gain notoriety, even when they lack real access. U.S. Bank’s response is a reminder that not all ransomware claims are credible.

Still, the incident underscores the reputational damage these threats can cause. Even a baseless claim can shake customer confidence and force costly investigations. For now, U.S. Bank is urging customers to stay vigilant and report any suspicious activity.

Final Thoughts

This week’s stories may not have dominated headlines, but they’re worth your attention. From the persistent Log4j RCE scare to the Minimus shutdown and Iranian hacker sanctions, the cybersecurity landscape remains volatile. Each incident offers a lesson in preparedness and resilience.

For more on related topics, check out our coverage of ransomware attack response strategies and critical infrastructure security best practices. Stay safe out there.