Canadian Hacker Jailed, Zero-Day PoCs Released, ATM Sentences

Aubrey Cottle, 39, of Oshawa, Ontario, was sentenced to 18 months in prison in a case tied to an intrusion of a Texas Republican Party server in September 2021. Court records show he pleaded guilty to charges that include defacing the party website, exfiltrating data and publishing the stolen information online.

A security researcher using the handle “Bikini” published proof-of-concept code for dozens of zero-day vulnerabilities affecting multiple open-source projects. The researcher named affected software including FFmpeg, Gogs, Gitea, Ghidra, 7-Zip, OpenVPN and VLC. Nine of the reported defects have been assigned CVE identifiers. The researcher said the issues were found using fuzzing techniques aided by large language models.

Security teams and project maintainers have been urged to review the published proofs and apply patches or mitigations where available. The public release of working exploit code for unpatched flaws raises the likelihood that others will adapt the proofs into weaponized exploits, particularly for widely used multimedia, version-control and networking components.

In a separate criminal case, U.S. authorities sentenced Carlos Javier Padron, 36, and Arnoldo Cabrera Torrealba, 37, both Venezuelan nationals, to 78 months in prison each for their roles in an ATM jackpotting scheme. Court records indicate they were members of a group that built and deployed a variant of the Ploutus malware to ATMs across the United States, enabling unauthorized cash withdrawals. The pair were ordered to pay $1.5 million in joint restitution. Authorities have charged 96 other defendants in connection with the broader operation.

Ploutus is a family of ATM malware that has been used in multiple campaigns to cause machines to dispense cash without valid bank cards. Investigators reported the variant used by the group allowed operators to trigger cash disbursements remotely after compromising machines.

No direct quotations were available from court filings, the researcher, or project teams in the initial reports.