💉 West Pharma Ransomware, 🤖 Cline AI RCE, 📦 Mini Shai-Hulud Escalates, 🔒 Patch Tuesday Clean, 📧 Exim Dead.Letter

The West Pharmaceutical Services ransomware attack is the day's defining story. The company, a critical manufacturer of injectable drug delivery systems, took global systems offline after detecting the intrusion, halting shipping, receiving, and manufacturing with no clear recovery timeline. Data was exfiltrated before encryption, and no group has claimed it. Ransomware is increasingly aimed at operational continuity, and a medical supplier is the highest-consequence target. West Pharmaceutical Services hit by disruptive ransomware attack: global operations halted

Microsoft shipped its first Patch Tuesday with no actively exploited or publicly disclosed zero-days since June 2024, covering 137 vulnerabilities including a Netlogon stack overflow and four Word RCEs reachable through the Preview Pane. The quiet month is a function of disclosure timing, not improved security. More urgent is Exim's Dead.Letter, an unauthenticated use-after-free in the BDAT parsing path of a mail server that handles roughly half the internet's mail; 4.99.3 fixes it. Exim Dead.Letter: unauthenticated RCE in internet-facing mail servers

The Mini Shai-Hulud escalation matters because the malicious packages carried valid provenance signatures. Verification that checks where an update came from said nothing about whether the code inside was safe, and RubyGems suspended new registrations in response. Q1 ransomware reporting confirms ecosystem consolidation: the top ten groups account for 71 percent of victims, with Qilin and The Gentlemen leading. Android's adbd authentication bypass and Ollama's heap leak across 300,000 exposed servers round out a heavy day for remote access.