Security Highlights Of The Week [07/26-3]

SonicWall SMA1000 Zero-Days Hit Remote Access Infrastructure
SonicWall confirmed active exploitation of two SMA1000 vulnerabilities, CVE-2026-15409 and CVE-2026-15410. The chain combines unauthenticated SSRF with code execution paths that can ultimately give attackers root-level control over exposed remote access appliances, making it one of the week’s most urgent edge-device stories.
Source: Help Net Security

Azure Permission Takeover Shows How One Credential Can Become Tenant-Wide Control
Sysdig documented an attack where a single leaked service principal credential turned into full Azure tenant compromise by the next morning. The attacker moved across multiple disconnected permission systems, established persistence on many identities, and seized visibility tooling meant to detect exactly this kind of intrusion.
Source: Sysdig

Hugging Face Discloses AI-Agent-Driven Internal Breach
Hugging Face said an autonomous AI agent system drove an intrusion from malicious dataset execution into internal clusters. The incident is notable not only because of the target, but because it is one of the clearest public examples so far of an end-to-end AI-assisted intrusion moving beyond proof-of-concept discussion.
Source: Hugging Face

AsyncAPI npm Compromise Pushes Multi-Stage Miasma Malware
Multiple official AsyncAPI npm packages were compromised and used to deliver a staged botnet loader tied to the Miasma family. The campaign shows that attackers are still finding ways around review controls by abusing repositories, publishing pipelines, and trusted package namespaces rather than relying on crude install-hook tricks alone.
Source: The Hacker News

Claude for Chrome Flaw Exposes Google Workspace Data
Researchers reported that Anthropic’s Claude for Chrome extension still contains unpatched issues that could let any extension with a content script on claude.ai trigger prompts against Gmail, Docs, and Calendar. In environments where users previously enabled more permissive execution settings, the impact rises from coerced approval to potentially silent enterprise data access.
Source: Manifold

ShinyHunters Tradecraft Shows How OAuth Abuse Becomes SaaS-Scale Access
Microsoft detailed how threat activity associated with ShinyHunters abused OAuth relationships, vishing, and trusted integrations to access SaaS applications such as Salesforce. The key lesson is that compromise can now spread through consent flows and business integrations that look legitimate enough to avoid many conventional login detections.
Source: Microsoft Security

Siemens ROX II Chain Delivers Persistent Root Access in OT Networks
Unit 42 and Siemens published a chained exploit involving three zero-days in Siemens ROX II switches. Together, the vulnerabilities allow privilege escalation and durable root-level access on devices that sit inside industrial control environments, which raises the operational importance well beyond a typical switch advisory.
Source: Unit 42

LegacyHive Adds Another Windows Zero-Day to the Nightmare Eclipse Stream
Nightmare Eclipse released LegacyHive, a local privilege escalation zero-day in the Windows User Profile Service. Even though the proof-of-concept was reportedly modified to make weaponization harder, the recurring public release of working Windows zero-days continues to create real defensive pressure around patch timing and local post-exploitation risk.
Source: SecurityWeek

Fake Coding Tests Hide OtterCookie-Aligned Malware in SVG Images
North Korea-linked operators behind the Contagious Interview cluster were observed using fake job and coding test lures that hid payload stages in SVG flag images. Victims who ran the project faced a multi-stage compromise that included credential theft, crypto wallet theft, remote access, and clipboard hijacking.
Source: The Hacker News

Ghostcommit Shows Prompt Injection Can Be Hidden Inside Images
Researchers demonstrated a pull request attack that hides prompt injection instructions inside a PNG image so AI code reviewers approve the change while missing the malicious logic. The technique matters because it targets a growing blind spot in AI-assisted development, where agents may inspect or process content differently from human reviewers.
Source: BleepingComputer

Chinese Operators Reportedly Used Claude Code and DeepSeek in Live Intrusions
Hunt.io described an intrusion campaign where Claude Code and DeepSeek were used as active parts of the operator workflow rather than as side tools. According to the report, they helped refine bypass methods, rework exploit logic after failure, and generate phishing infrastructure used against government and financial targets in four countries.
Source: Hunt.io

ClickLock Stealer Adds Another Modular macOS Threat to Watch
Group-IB uncovered a previously undocumented modular macOS stealer likely distributed through ClickFix-style pages, compromised WordPress sites, and Telegram infrastructure. The malware reportedly operates without elevated privileges or exploits, which makes the social engineering layer more important than any OS bypass.
Source: Group-IB

ACR Stealer Activity Rises Across Enterprise Environments
Microsoft observed increased ACR Stealer activity using ClickFix lures to steal browser credentials, tokens, and sensitive documents from enterprise systems. The campaigns reinforce how lightweight infostealers continue to be effective entry points for wider account compromise and follow-on cloud abuse.
Source: Microsoft Security

Accenture Confirms Breach After Source Code Theft Claims
Accenture confirmed a breach after a threat actor claimed to have stolen 35 GB of internal data, including source code, keys, and configuration material. Even without full public technical details, the incident stands out because of the type of data allegedly exposed and the risk it creates for downstream misuse.
Source: SecurityWeek

Fairlife Ransomware Incident Disrupts US Dairy Production
Coca-Cola disclosed that a ransomware attack affecting Fairlife disrupted production-related systems and temporarily halted dairy product manufacturing across the United States. It is a strong reminder that cyber incidents continue to move from IT inconvenience into direct operational and supply-chain impact in the physical economy.
Source: BleepingComputer

Security Highlights Of The Week [07/26-2]

Januscape Opens a New VM Escape Path on Both Intel and AMD
Researchers disclosed Januscape, a Linux KVM vulnerability that allows guest-to-host escape on both Intel and AMD systems. Because it affects the shadow MMU path in KVM and was reportedly used as a zero-day in Google’s kvmCTF program, it stands out as one of the most important virtualization flaws of the week.
Source: BleepingComputer

Critical Gitea Flaw Is Already Being Exploited
Researchers warned that attackers are actively exploiting CVE-2026-20896 in Gitea’s reverse-proxy authentication logic. On affected Docker deployments, a single crafted HTTP header can be enough to access internet-facing instances when only a valid username is known.
Source: SecurityWeek

Ubiquiti Ships Broad UniFi Security Fixes After Earlier Weaponization
Ubiquiti released updates for critical flaws across UniFi Connect, Talk, Access, Protect, and UniFi OS. The most notable point is that three UniFi OS bugs had already been flagged by CISA as weaponized in real-world attacks, so this is not a routine patch cycle.
Source: The Hacker News

Microsoft Closes the RoguePlanet Defender Zero-Day
Microsoft fixed RoguePlanet, tracked as CVE-2026-50656, through an update to the Microsoft Malware Protection Engine. The flaw allowed attackers to move from a standard user context to SYSTEM, making it highly relevant for post-compromise privilege escalation on Windows systems.
Source: Malwarebytes

Zimbra Urges Immediate Patching for Critical Web Client XSS
Zimbra warned customers to patch a critical stored XSS flaw in the Classic Web Client. The issue can be triggered through a specially crafted email and executes malicious code when the message is opened, which makes it especially dangerous in large mail environments.
Source: BleepingComputer

China-Aligned Cluster Targets Universities Through Roundcube
Proofpoint’s UNK_MassTraction activity is targeting Roundcube servers at US and Canadian universities, especially physics and engineering departments tied to sensitive research. The campaigns use multiple Roundcube n-days to steal credentials, deploy webshells, or load VShell directly into memory while keeping a low detection profile.
Source: Hackread

Fake IT Support Calls on Teams Are Delivering EtherRAT
Attackers are using Microsoft Teams voice calls, phishing emails, and remote management tooling to trick employees into installing EtherRAT. The campaign shows how collaboration platforms are now being used not just for phishing lures, but for live social engineering that creates immediate initial access.
Source: BleepingComputer

Vishing Campaigns Now Target Microsoft Entra Passkey Enrollment
Okta reported that a threat actor tracked as O-UNC-066 is using voice phishing and passkey-themed domains to push victims into fraudulent Microsoft 365 passkey enrollment flows. The campaign is aimed at enterprise targets across multiple sectors and is tied to data extortion rather than simple credential harvesting.
Source: Okta

Rogue Agent Shows How One Permission Could Poison Dialogflow CX
Varonis disclosed Rogue Agent, a Dialogflow CX issue that allowed persistent malicious code injection into conversational agent workflows. The attack could silently exfiltrate conversations and support phishing at scale, highlighting how cloud AI platforms are creating new privilege and trust-boundary problems.
Source: Varonis

HalluSquatting Turns AI Hallucinations Into a Supply Chain Attack Path
Researchers showed that attackers can register package names hallucinated by AI coding assistants and wait for those assistants to fetch or run them automatically. The result is a practical bridge between model hallucination and real code execution on developer machines, especially where agents are allowed to access outside resources with little review.
Source: The Hacker News

KDDI Says More Than 12 Million People Were Impacted by an ISP Platform Breach
Japanese telecom giant KDDI disclosed that a breach affecting a shared email platform exposed email addresses and passwords linked to more than 12 million people. The incident affected multiple ISPs and is one of the larger consumer-facing telecom breaches reported this week.
Source: BleepingComputer

GigaWiper Combines Backdoor Access With Destructive Sabotage Options
Microsoft detailed GigaWiper, a Golang-based backdoor that combines command-and-control capability with wiping, fake ransomware, and broader system sabotage. Its importance lies in how it assembles multiple malware capabilities into one flexible destructive platform rather than relying on a single fixed payload.
Source: Microsoft Security

WP-SHELLSTORM Exposed a Large Webshell Access-Broker Operation
SOCRadar says an exposed Python SimpleHTTPServer revealed the internal toolkit, logs, and target lists of a large WordPress-focused access-brokerage campaign. The exposed operation allegedly targeted more than 1.4 million domains, weaponized 27 CVEs, and maintained thousands of active webshells.
Source: SOCRadar

Talos Tracks UAT-7810 as It Expands ORB Infrastructure
Cisco Talos says UAT-7810 continues building and maintaining operational relay box networks through its LapDogs infrastructure and evolving SHORTLEASH malware. These ORB networks matter because they are designed to support secondary threat actors and provide resilient routing layers for future intrusions against high-value targets.
Source: Cisco Talos

ESET’s H1 2026 Report Shows the AI Skill Ecosystem Becoming a Security Problem of Its Own
ESET’s H1 2026 threat report says attackers are scaling established techniques faster and adapting them to new platforms, especially AI ecosystems. The report highlights nearly 900,000 AI skills analyzed in the first half of the year, including tens of thousands of suspicious and thousands of clearly malicious instances.
Source: ESET

Security Highlights Of The Week [07/26-1]

Cisco Confirms Active Exploitation of Unified CM Flaw
Cisco confirmed that attackers are now exploiting CVE-2026-20230 in Unified Communications Manager. The bug is an unauthenticated SSRF issue that can be triggered remotely with crafted HTTP requests, putting core enterprise telephony infrastructure at risk.
Source: BleepingComputer

FortiBleed Credential Theft Now Linked to Real Ransomware Deployments
SOCRadar linked FortiBleed to INC and Lynx ransomware operations, showing a direct path from FortiGate credential theft to follow-on intrusions. The campaign reportedly scanned over 11,000 FortiGate portals, gained confirmed admin access on hundreds of targets, and has already led to multiple ransomware incidents.
Source: The Hacker News

Over 900 Oracle E-Business Instances Are Exposed to Ongoing Attacks
Researchers warned that more than 900 Oracle E-Business Suite instances are exposed while threat actors actively exploit CVE-2026-46817. The flaw affects Oracle Payments and can allow unauthenticated takeover of vulnerable systems over HTTP.
Source: BleepingComputer

New CitrixBleed Vulnerability Was Exploited Less Than a Day After Disclosure
A new CitrixBleed-like flaw in NetScaler ADC and Gateway, CVE-2026-8451, was exploited almost immediately after public technical details appeared. The issue leaks memory from appliances configured as SAML identity providers, continuing the trend of rapid exploitation against remote access infrastructure.
Source: SecurityWeek

Microsoft SharePoint RCE Added to KEV After Active Exploitation
CISA added CVE-2026-45659 in Microsoft SharePoint Server to the Known Exploited Vulnerabilities catalog. The deserialization flaw is now being actively exploited, reinforcing the continued pressure on on-premises collaboration infrastructure.
Source: CISA

Splunk Enterprise RCE Reached Active Exploitation Status
CVE-2026-20253 in Splunk Enterprise is a critical unauthenticated remote code execution flaw in a PostgreSQL sidecar recovery path exposed through Splunk Web. After public analysis and proof-of-concept release, CISA added the issue to KEV and required rapid remediation.
Source: Zscaler ThreatLabz

BlueHammer Is Being Used in Real Ransomware Attacks
CISA warned that the Microsoft Defender privilege escalation bug known as BlueHammer is now being exploited in ransomware operations. The flaw was publicly disclosed before patching, and attackers appear to be using it to strengthen post-compromise access on Windows hosts.
Source: BleepingComputer

Trojanized CVE Proof-of-Concept Repositories Are Targeting Security Researchers
YesWeHack and Sekoia documented an ongoing campaign using malicious exploit repositories to compromise vulnerability researchers and pentesters. The campaign has been active since late 2025 and abuses the trust placed in public proof-of-concept code.
Source: YesWeHack

JADEPUFFER Shows the First Documented Agentic Ransomware Operation
Sysdig described JADEPUFFER as a fully automated extortion workflow driven end-to-end by a large language model. The actor exploited an exposed Langflow instance, adapted during the intrusion, and then pivoted into destructive database extortion without a traditional human operator driving each step.
Source: Sysdig

Vect and TeamPCP Formalize a Supply Chain and Ransomware Partnership
Sophos reported that Vect and TeamPCP are now working together, combining credential theft and supply chain compromise with ransomware deployment. The partnership shows how specialized criminal groups are increasingly linking initial access, data theft, and extortion into one coordinated pipeline.
Source: Sophos

Mustang Panda Targets India’s Government and Energy Sectors with New Tooling
Acronis tracked concurrent Mustang Panda campaigns against Indian government and hydropower targets. The operations used newly identified implants, including ZOHOMURK and MINIRECON, and abused Zoho WorkDrive as part of the intrusion chain.
Source: Acronis TRU

VeilDrop Uses Blogspot to Deliver an In-Memory Stealer Chain
Securonix analyzed VeilDrop, a multi-stage delivery chain that begins with a fake document script and uses Blogspot-hosted payload stages to deploy PureLog Stealer in memory. The campaign leans on trusted cloud infrastructure and layered obfuscation to reduce detection opportunities.
Source: Securonix

Iran-Linked TAG-182 Expands MarkiRAT Surveillance Operations
Recorded Future linked new infrastructure to TAG-182 and its use of MarkiRAT in Iranian surveillance campaigns. The operation appears focused on Iranians inside and outside the country and uses lures such as fake VPNs and download tools distributed through social platforms.
Source: Recorded Future

TONResolver Targets Japan’s Hotel Sector Using Blockchain-Based C2 Updates
Trend Micro described a phishing-led campaign against Japanese Booking.com partner organizations that deploys TONResolver RAT. The malware uses the TON blockchain as a dead drop resolver, giving operators a flexible way to rotate command-and-control endpoints without hardcoding them into the payload.
Source: Trend Micro

LSHIY Password Spray Campaign Made More Than 81 Million Login Attempts
Huntress observed a large automated password spraying campaign against Microsoft Azure CLI workflows originating from infrastructure linked to LSHIY. The activity produced over 81 million login attempts and compromised dozens of Microsoft accounts, including environments that already had Conditional Access in place.
Source: Huntress

Security Highlights Of The Week [06/26-4]]

Ubiquiti Critical Vulnerabilities Are Now Being Exploited in Attacks
CISA warned that threat actors are actively targeting three critical UniFi OS flaws, all rated 10.0. The bugs allow unauthorized changes, file access, and deeper system manipulation on exposed devices, making this one of the most urgent edge infrastructure stories of the week.
Source: SecurityWeek

Cisco Unified CM Flaw Is Now Exploited in the Wild
Attackers are now exploiting CVE-2026-20230 in Cisco Unified Communications Manager. The issue starts as an unauthenticated SSRF flaw, but Cisco has already warned it can be used to write files and later escalate to root on affected systems.
Source: BleepingComputer

CISA Warns Lantronix EDS5000 Vulnerability Is Under Active Exploitation
CISA says CVE-2025-67038 in Lantronix EDS5000 devices is being actively exploited and has ordered rapid remediation. The flaw is a root-level command injection bug in the HTTP RPC module, which makes it especially dangerous for serial-to-IP infrastructure in operational environments.
Source: The Hacker News

PTC Windchill Sees First Confirmed Real-World Exploitation
Security researchers reported the first known in-the-wild exploitation of a PTC Windchill vulnerability. The bug allows unauthenticated remote code execution through crafted requests, and its abuse matters because Windchill sits deep inside product lifecycle and engineering environments.
Source: SecurityWeek

FFmpeg PixelSmash Can Turn a Malicious Media File Into Remote Code Execution
JFrog disclosed CVE-2026-8461, a high-severity flaw in FFmpeg’s MagicYUV decoder that can be exploited for reliable remote code execution. Since FFmpeg is embedded across video players, NAS devices, media servers, and cloud pipelines, the exposure goes far beyond a single application class.
Source: SecurityWeek

Vendor-Signed UEFI Applications Can Be Abused for Secure Boot Bypass
CERT warned that multiple vendor-signed UEFI applications are vulnerable to a Secure Boot bypass resembling a BYOVD style pre-boot attack. If a system trusts the affected certificate chain, an attacker can execute code before the operating system even starts, which raises the impact well beyond a normal post-boot compromise.
Source: CERT/CC

ShapedPlugin Supply Chain Compromise Backdoored Official WordPress Pro Releases
Wordfence reported that attackers compromised ShapedPlugin’s build and distribution pipeline and injected backdoor code into Pro plugin updates delivered through official channels. The case stands out because victims followed normal licensing and update practices and were still exposed through the vendor’s own update system.
Source: Wordfence

Mini Shai-Hulud Expanded Again Through LeoPlatform npm and Go Ecosystem Compromises
Socket tracked a new wave of the Miasma and Mini Shai-Hulud campaign affecting LeoPlatform and RStreams npm packages, GitHub Actions workflows, and a related Go module compromise. The operation continues to combine install-time execution, Bun-staged malware, CI secret theft, and AI assistant persistence into a broader developer ecosystem threat.
Source: Socket

Klue Salesforce Incident Has Now Hit BeyondTrust and LastPass
SecurityWeek reported that both BeyondTrust and LastPass were affected through the Klue incident, where a threat actor used a compromised legacy credential to generate OAuth tokens and access linked Salesforce environments. The story reinforces how third-party SaaS integrations can become a breach path into multiple downstream organizations at once.
Source: SecurityWeek

FortiBleed Shows a Large Russian Credential Harvesting Operation Against Fortinet Devices
SOCRadar’s analysis traces FortiBleed from mass reconnaissance and credential sourcing to passive sniffers, offline cracking, and targeted exfiltration. The investigation expanded from one exposed directory to more than 260 operation servers, suggesting a mature and persistent access-brokering pipeline built around Fortinet environments.
Source: SOCRadar

Photo Zip Campaign Targets Hospitality Firms with a Node.js Implant
Microsoft described an active intrusion campaign against hospitality organizations in Europe and Asia using photo-themed ZIP archives and fake image shortcut files. The chain leads to obfuscated PowerShell, a Node.js implant, registry-based persistence, and non-standard C2 communications for long-term access.
Source: Microsoft Security

Edgecution Uses a Malicious Microsoft Edge Extension to Break Out of the Browser
Zscaler linked a new malware delivery method called Edgecution to an initial access broker associated with Payouts King ransomware. By abusing the Chrome native messaging protocol through a rogue Edge extension, the attackers gain direct host access and move beyond the normal browser sandbox model.
Source: Zscaler ThreatLabz

Chinese Cluster CL-STA-1062 Targeted Southeast Asian Governments and Energy Entities
Unit 42 reported that CL-STA-1062 targeted government bodies and state-owned enterprises in Southeast Asia and used a mix of open-source tools and a newly documented backdoor called TinyRCT. The activity fits a sustained regional espionage pattern rather than a short-lived campaign.
Source: Unit 42

AutoJack Shows How One Web Page Can Turn an AI Agent Into a Host-Level Attack Path
Microsoft researchers detailed AutoJack, an exploit chain in AutoGen Studio that lets untrusted web content reach a local MCP WebSocket and spawn processes on the host. Although the affected surface never shipped in the PyPI release, the research is important because it demonstrates a real localhost trust-boundary failure in AI agent tooling.
Source: Microsoft Security

Cordyceps Exposes a Broad CI/CD Exploitation Pattern Across High-Impact Repositories
Novee said it found a systemic class of CI/CD weaknesses across roughly 30,000 high-impact repositories, including exploitable chains involving command injection, broken authentication logic, artifact poisoning, and privilege escalation in GitHub Actions workflows. The significance here is not a single product flaw, but a repeatable supply chain pattern that can scale across major open-source projects.
Source: Novee

Security Highlights Of The Week [06/26-3]

CISA Warns That Nx Console and GitHub Supply Chain Intrusions Are Hitting CI CD Pipelines
CISA said recent developer ecosystem intrusions, including the Nx Console compromise and the Megalodon campaign, show that threat actors are actively abusing CI CD tooling, code extensions, and workflows. The alert matters because it frames these incidents as a broader pattern rather than isolated package compromises.
Source: CISA

GitHub Rotates Enterprise Server Signing Key After Internal Repository Attack
GitHub said it recently detected a cyberattack and began rotating keys, including the GitHub Enterprise Server signing key, out of caution. This is a high impact follow up because the signing key is used to validate GitHub Enterprise Server binaries during manual update workflows.
Source: GitHub

Unfixed Gogs Vulnerability Allows Authenticated Remote Code Execution
Rapid7 disclosed a critical argument injection flaw in Gogs that allows any authenticated user to execute code on the server during a pull request rebase workflow. The vendor had not released a fix at publication time, which makes exposed self hosted Git environments especially risky.
Source: Rapid7

FortiClient EMS Is Being Exploited to Deliver EKZ Infostealer
Arctic Wolf observed attackers exploiting CVE-2026-35616 in FortiClient EMS and pushing a fake Fortinet patch that actually installed the EKZ infostealer. The malware focuses on browser credential theft, which turns an enterprise management weakness into a direct path for credential harvesting at scale.
Source: Arctic Wolf

Carnival Confirms Data Breach Affecting Nearly 6 Million People
Carnival confirmed a large scale data breach affecting nearly 6 million individuals after claims tied to ShinyHunters surfaced earlier in the year. The size of the exposure and the sensitivity of customer information make this one of the most significant breach confirmations in this set.
Source: BleepingComputer

Silent Ransom Group Is Social Engineering Law Firms by Posing as IT Support
The FBI and CISA warned that the Silent Ransom Group, also known as Luna Moth, is targeting law firms with calls and phishing emails while impersonating IT support. The group then uses legitimate remote access tools or even in person access attempts to exfiltrate data and pressure victims into paying.
Source: IC3

JOMANGY Campaign Turns FreePBX Systems Into Toll Fraud Infrastructure
Cyble linked an active FreePBX exploitation campaign to actor INJ3CTOR3 and said the operation deploys self healing webshells that include live toll fraud logic. The scale is notable, with evidence pointing to thousands of scanned IPs and ongoing abuse of victim SIP trunks for direct financial gain.
Source: Cyble

GlassWorm Botnet Was Disrupted After Months of Open Source Ecosystem Abuse
CrowdStrike, Google, and the Shadowserver Foundation disrupted the GlassWorm botnet by simultaneously taking down its command and control channels. The botnet had used blockchain, Google Calendar, BitTorrent, and VPS based infrastructure, showing how resilient its delivery model had become before the takedown.
Source: SecurityWeek

JINX-0164 Targeted Crypto Firms Through Developers and CI CD Infrastructure
Wiz described a financially motivated actor it tracks as JINX-0164 that used recruitment themed social engineering, custom macOS malware, and CI CD targeting against cryptocurrency organizations. The campaign matters because it combined employee laptop compromise with attempts to move into code distribution and development systems.
Source: Wiz

Smishing Operation Across 19 Countries Targeted Government, Postal, and Telecom Brands
Hunt.io traced what began as Romanian impersonation activity into a broader smishing operation spanning 19 countries. The infrastructure targeted government payment portals, postal services, and telecom brands, showing a coordinated cross border fraud ecosystem rather than a local campaign.
Source: Hunt.io

Fake ChatGPT Download Site Is Infecting Windows and Mac Users With Stealers
Malwarebytes warned that a fake site mimicking the ChatGPT desktop app experience is distributing malware to both Windows and macOS users. Windows visitors receive a credential stealing loader, while Mac users are served Odyssey Stealer, showing how attackers continue to weaponize trusted AI brand recognition.
Source: Malwarebytes

GREYVIBE Shows How Russia Nexus Operations Are Integrating AI Into Campaigns
WithSecure linked GREYVIBE to persistent operations targeting Ukraine and Ukraine related entities and said the group leveraged AI during both development and operational phases. That makes it one of the more concrete current examples of state aligned activity using AI beyond generic experimentation.
Source: WithSecure

Phishers Are Abusing Google AppSheet Notifications to Deliver Account Theft Emails
Kaspersky warned that attackers are using Google AppSheet to send phishing messages from legitimate looking Google linked addresses. This makes the emails more convincing and harder for users to distrust, especially because they appear to come from a real platform rather than an obviously fake sender.
Source: Kaspersky

Security Highlights Of The Week [06/26-2]

Cisco SD WAN Zero Day Is Being Exploited to Gain Root Access
Cisco warned that attackers are actively exploiting CVE-2026-20245 in Catalyst SD WAN Manager. The flaw is currently unpatched and allows low privileged attackers to escalate to root, which makes it especially dangerous in environments where the platform manages broad network connectivity and policy.
Source: BleepingComputer

ShinyHunters Is Exploiting an Oracle PeopleSoft Zero Day Against Education Targets
Mandiant and Google linked an active compromise and extortion campaign to exploitation of CVE-2026-35273 in Oracle PeopleSoft Environment Management. The activity hit education sector infrastructure before Oracle published its advisory, which makes this a true zero day case with immediate operational relevance.
Source: Google Threat Intelligence

LiteLLM Flaw Has Been Added to KEV After Real World Exploitation
CISA added CVE-2026-42271 in LiteLLM to the KEV catalog after evidence of active exploitation. The issue is a command injection flaw that can be chained into unauthenticated remote code execution in exposed deployments, making it especially important for organizations running self hosted AI gateways.
Source: The Hacker News

Check Point Warns of Active Exploitation of VPN Authentication Bypass
Check Point said CVE-2026-50751 is being actively exploited against Remote Access VPN and Mobile Access deployments that still use the deprecated IKEv1 protocol. By abusing certificate validation logic, an attacker can establish a VPN session without a valid password and bypass normal authentication controls.
Source: Check Point

Everest Forms Vulnerability Has Been Used for Months to Take Over WordPress Sites
Defenders say CVE-2026-3300 in Everest Forms Pro has been exploited in the wild for months for full site takeover. The flaw lets unauthenticated attackers inject PHP code through form fields, which turns a popular plugin on more than 100,000 sites into a direct execution path.
Source: SecurityWeek

GitHub Disabled Microsoft Repositories After Miasma Supply Chain Activity
GitHub removed 73 repositories across Microsoft linked organizations after discovering they contained potentially malicious content tied to the Miasma and Shai Hulud campaign. The incident shows that supply chain abuse is now reaching official repositories tied to major vendors, not only small open source projects.
Source: BleepingComputer

Shai Hulud Miasma Has Expanded Into a New PyPI Wave
Socket identified a coordinated PyPI compromise involving 19 packages and 37 malicious wheel artifacts tied to the Shai Hulud and Miasma cluster. The packages used automatic startup execution, downloaded the Bun runtime, and launched heavily obfuscated JavaScript stealers, showing how the campaign now crosses ecosystems and runtimes with ease.
Source: Socket

VS Code Zero Day Can Steal GitHub Tokens with One Click
Researchers released proof of concept code for a VS Code zero day that can steal GitHub authentication tokens if a user clicks a crafted link. The flaw abuses VS Code webview message handling and can lead to malicious extension installation and token theft through a trusted developer workflow.
Source: BleepingComputer

phpBB Fixed a Critical Authentication Bypass That Can Lead to Full Server Compromise
Researchers disclosed a critical phpBB flaw that can be exploited in the default configuration for authentication bypass and can then lead to remote code execution. Because phpBB remains widely deployed across public forums, the issue stands out as a high impact internet facing risk rather than a niche application bug.
Source: Aikido

OpenSSL Patched a High Severity Vulnerability Found with AI Assistance
OpenSSL fixed CVE-2026-45447, a high severity use after free condition reachable during PKCS#7 or S/MIME signature verification. The issue is notable both because of its remote code execution potential in affected applications and because researchers said AI helped uncover it.
Source: SecurityWeek

Dashlane Says Attackers Copied Encrypted Password Vaults from Some Accounts
Dashlane disclosed that a brute force campaign let an attacker access some customer accounts and copy encrypted vaults. The company said it found no evidence of compromise of its internal systems, but the incident still matters because password managers concentrate highly sensitive data in one place.
Source: Help Net Security

UN World Food Programme Breach Exposed Data from 600,000 Gaza Households
The World Food Programme said its Palestine registration application was breached and beneficiary data from across Gaza was exposed. The affected information included names, ID numbers, phone numbers, and neighborhood level location details, making this one of the most sensitive humanitarian sector breaches in this set.
Source: BleepingComputer

Silent Ransom Group Continues Targeted Social Engineering Against US Law Firms
Mandiant said the group it tracks as UNC3753, also known as Luna Moth and Silent Ransom Group, targeted dozens of legal and professional services organizations between January and May 2026. The actors rely on voice phishing, fake IT support pretexts, and remote management tools to gain access and steal data for extortion.
Source: Google Threat Intelligence

HTTP/2 Bomb Can Crash Major Web Servers from a Single Machine
Researchers disclosed a new denial of service technique called HTTP/2 Bomb that can take down servers in seconds by combining compression amplification with resource retention abuse. The method affects default HTTP/2 configurations in major platforms including NGINX, Apache, Microsoft IIS, Envoy, and Cloudflare Pingora.
Source: BleepingComputer

WhatsApp Says NSO Tried Another Spyware Operation Despite Court Restrictions
WhatsApp said it detected and disrupted a spear phishing attempt linked to NSO Group even though the spyware firm is already under a court order barring it from targeting WhatsApp users. The case keeps NSO in focus and reinforces that commercial spyware activity remains an active threat even after legal action and prior exposure.
Source: SecurityWeek

Security Highlights Of The Week [06/26-1]

Ghost CMS Flaw Was Used to Hijack More Than 700 Sites for ClickFix Attacks
Attackers exploited CVE-2026-26980 in Ghost CMS to inject malicious JavaScript into more than 700 sites and feed ClickFix attack chains. The campaign shows how compromising legitimate sites can give attackers trusted delivery infrastructure for broad social engineering operations.
Source: Cisco SD WAN Zero Day Is Being Exploited to Gain Root Access
Cisco warned that attackers are actively exploiting CVE-2026-20245 in Catalyst SD WAN Manager. The unpatched flaw allows low privileged attackers to escalate to root, which makes it especially dangerous for organizations that rely on SD WAN management planes for broad network control.
Source: BleepingComputer

Palo Alto GlobalProtect VPN Auth Bypass Is Now Exploited in Attacks
Palo Alto Networks says CVE-2026-0257 is now being used in attacks to establish unauthorized VPN connections through GlobalProtect. Because the issue affects a remote access path directly tied to corporate network entry, it creates immediate exposure for internet facing deployments that are not yet updated.
Source: Palo Alto Networks

Critical Windows Netlogon RCE Is Being Exploited Against Domain Controllers
Belgium’s national cyber authority warned that attackers are exploiting CVE-2026-41089, a critical Windows Netlogon remote code execution flaw patched in May. Since Netlogon sits at the center of domain based authentication, successful exploitation can directly threaten core Windows identity infrastructure.
Source: BleepingComputer

Oracle WebLogic Vulnerability Is Now Exploited in the Wild
CISA warned that CVE-2024-21182 in Oracle WebLogic is being exploited in real attacks nearly two years after Oracle patched it. The case shows how older enterprise flaws with public proof of concept code continue to remain operationally relevant long after a vendor release.
Source: SecurityWeek

Red Hat npm Packages Were Compromised to Steal Developer Credentials
More than 30 packages in Red Hat’s @redhat-cloud-services namespace were backdoored with a new Shai Hulud variant dubbed Miasma. The malware was designed to steal cloud secrets, SSH keys, CI tokens, and developer credentials, turning a trusted enterprise package namespace into a supply chain attack path.
Source: BleepingComputer

VS Code Zero Day Can Steal GitHub Tokens with a Single Click
Researchers released exploit code for a VS Code zero day that can install malicious extensions and steal GitHub OAuth tokens when users are lured into clicking a crafted link. The issue is especially serious because it targets a widely used developer tool and can expose private repositories through trusted workflows.
Source: BleepingComputer

WP Maps Pro Flaw Lets Attackers Create WordPress Admin Accounts
Attackers are actively exploiting CVE-2026-8732 in WP Maps Pro to create full administrator accounts on affected WordPress sites without authentication. The issue is severe because it turns a support feature into a direct path for complete site takeover.
Source: Security Affairs

Critical Flowise Flaw Can Give Attackers Full Server Control
A critical vulnerability in Flowise allows a malicious workflow import to take over a self hosted server when opened by a logged in user. Researchers also warned that the official fix can be bypassed, which keeps the exposure window open for organizations running the platform internally.
Source: Infosecurity Magazine

Dashlane Says Attackers Copied Encrypted Password Vaults from Some Accounts
Dashlane disclosed that a brute force campaign went beyond lockouts and allowed a threat actor to access some user accounts and copy encrypted vaults. Although Dashlane said its internal systems were not compromised, the incident raises the stakes because password managers concentrate highly sensitive data in one place.
Source: Help Net Security

UN World Food Programme Breach Exposed Data from 600,000 Gaza Households
The UN World Food Programme said its Palestine self registration application was breached, exposing beneficiary information from across Gaza. The affected data included names, identification numbers, phone numbers, and location details, making this a major humanitarian sector privacy and safety incident.
Source: BleepingComputer

PCPJack Hijacked 230 Cloud Servers into a Hidden SMTP Relay Network
Hunt.io found exposed operator infrastructure tied to PCPJack and linked the campaign to 230 compromised AWS, GCP, and Azure systems. The operation used Sliver, Chisel, and other tooling to build a covert SMTP relay network that could support large scale spam and follow on abuse.
Source: Hunt.io

Gamaredon Is Hiding Worm Components in NTFS Data Streams
Sekoia observed Gamaredon using alternate data streams in Windows to hide worm components while maintaining long term access inside Ukrainian networks. The technique reduces visible artifacts on disk and fits the group’s long running espionage focus on government, military, and critical infrastructure targets.
Source: Infosecurity Magazine

GoDaddy Found Malware on Nearly 2,000 WordPress Sites Using Steam as C2
GoDaddy researchers found malware on roughly 1,980 WordPress sites that pulled hidden instructions from Steam Community profile comments using invisible Unicode. The campaign stands out because it abuses a legitimate gaming platform as unconventional command and control infrastructure.
Source: Security Affairs

Operation FlutterBridge Is Spreading a New macOS Backdoor Through Malvertising
Unit 42 described an active macOS malvertising campaign called Operation FlutterBridge that delivers a backdoor named FlutterShell. Beyond adware behavior, the malware supports shell execution and file system manipulation, and some variants abuse AI summarization features during data theft flows.
Source: Unit 42

Magecart Attackers Are Using Stripe and Google Tag Manager as Trusted Cover
Sansec found a payment theft campaign that abuses Google Tag Manager and Stripe infrastructure to host both malicious checkout code and stolen card data. By hiding inside domains many stores already trust, the attackers make detection and blocking significantly harder for defenders and merchants alike.
Source: BleepingComputer

Security Highlights Of The Week [05/26-4]

Megalodon Supply Chain Attack Compromised More Than 5,000 GitHub Repositories
Megalodon was one of the most significant developer ecosystem incidents in this batch, with attackers pushing thousands of commits across more than 5,000 public GitHub repositories in only a few hours. The campaign targeted GitHub Actions workflows and aimed to steal every secret available to runners, including cloud keys, SSH material, and OIDC tokens.
Source: InfoStealers

CISA Warns That Nx Console and GitHub Supply Chain Intrusions Are Hitting CI CD Pipelines
CISA said recent developer ecosystem intrusions, including the Nx Console compromise and the Megalodon campaign, show that threat actors are actively abusing CI CD tooling, code extensions, and workflows. The alert matters because it frames these incidents as a broader pattern rather than isolated package compromises.
Source: CISA

GitHub Rotates Enterprise Server Signing Key After Internal Repository Attack
GitHub said it recently detected a cyberattack and began rotating keys, including the GitHub Enterprise Server signing key, out of caution. This is a high impact follow up because the signing key is used to validate GitHub Enterprise Server binaries during manual update workflows.
Source: GitHub

Unfixed Gogs Vulnerability Allows Authenticated Remote Code Execution
Rapid7 disclosed a critical argument injection flaw in Gogs that allows any authenticated user to execute code on the server during a pull request rebase workflow. The vendor had not released a fix at publication time, which makes exposed self hosted Git environments especially risky.
Source: Rapid7

FortiClient EMS Is Being Exploited to Deliver EKZ Infostealer
Arctic Wolf observed attackers exploiting CVE-2026-35616 in FortiClient EMS and pushing a fake Fortinet patch that actually installed the EKZ infostealer. The malware focuses on browser credential theft, which turns an enterprise management weakness into a direct path for credential harvesting at scale.
Source: Arctic Wolf

Ghost CMS Flaw Was Used to Hijack More Than 700 Sites for ClickFix Attacks
Attackers exploited CVE-2026-26980 in Ghost CMS to inject malicious JavaScript into more than 700 sites and feed ClickFix attack chains. The campaign shows how compromising legitimate sites can give attackers trusted delivery infrastructure for broad social engineering operations.
Source: The Hacker News

Carnival Confirms Data Breach Affecting Nearly 6 Million People
Carnival confirmed a large scale data breach affecting nearly 6 million individuals after claims tied to ShinyHunters surfaced earlier in the year. The size of the exposure and the sensitivity of customer information make this one of the most significant breach confirmations in this set.
Source: BleepingComputer

Silent Ransom Group Is Social Engineering Law Firms by Posing as IT Support
The FBI and CISA warned that the Silent Ransom Group, also known as Luna Moth, is targeting law firms with calls and phishing emails while impersonating IT support. The group then uses legitimate remote access tools or even in person access attempts to exfiltrate data and pressure victims into paying.
Source: IC3

JOMANGY Campaign Turns FreePBX Systems Into Toll Fraud Infrastructure
Cyble linked an active FreePBX exploitation campaign to actor INJ3CTOR3 and said the operation deploys self healing webshells that include live toll fraud logic. The scale is notable, with evidence pointing to thousands of scanned IPs and ongoing abuse of victim SIP trunks for direct financial gain.
Source: Cyble

GlassWorm Botnet Was Disrupted After Months of Open Source Ecosystem Abuse
CrowdStrike, Google, and the Shadowserver Foundation disrupted the GlassWorm botnet by simultaneously taking down its command and control channels. The botnet had used blockchain, Google Calendar, BitTorrent, and VPS based infrastructure, showing how resilient its delivery model had become before the takedown.
Source: SecurityWeek

JINX-0164 Targeted Crypto Firms Through Developers and CI CD Infrastructure
Wiz described a financially motivated actor it tracks as JINX-0164 that used recruitment themed social engineering, custom macOS malware, and CI CD targeting against cryptocurrency organizations. The campaign matters because it combined employee laptop compromise with attempts to move into code distribution and development systems.
Source: Wiz

Smishing Operation Across 19 Countries Targeted Government, Postal, and Telecom Brands
Hunt.io traced what began as Romanian impersonation activity into a broader smishing operation spanning 19 countries. The infrastructure targeted government payment portals, postal services, and telecom brands, showing a coordinated cross border fraud ecosystem rather than a local campaign.
Source: Hunt.io

Fake ChatGPT Download Site Is Infecting Windows and Mac Users With Stealers
Malwarebytes warned that a fake site mimicking the ChatGPT desktop app experience is distributing malware to both Windows and macOS users. Windows visitors receive a credential stealing loader, while Mac users are served Odyssey Stealer, showing how attackers continue to weaponize trusted AI brand recognition.
Source: Malwarebytes

GREYVIBE Shows How Russia Nexus Operations Are Integrating AI Into Campaigns
WithSecure linked GREYVIBE to persistent operations targeting Ukraine and Ukraine related entities and said the group leveraged AI during both development and operational phases. That makes it one of the more concrete current examples of state aligned activity using AI beyond generic experimentation.
Source: WithSecure

Phishers Are Abusing Google AppSheet Notifications to Deliver Account Theft Emails
Kaspersky warned that attackers are using Google AppSheet to send phishing messages from legitimate looking Google linked addresses. This makes the emails more convincing and harder for users to distrust, especially because they appear to come from a real platform rather than an obviously fake sender.
Source: Kaspersky

Security Highlights Of The Week [05/26-3]

PAN-OS Zero Day Under Active Exploitation Grants Root Access on Firewalls
Palo Alto Networks confirmed active exploitation of CVE-2026-0300 in the PAN-OS Captive Portal. The flaw allows unauthenticated remote code execution with root privileges on exposed firewalls, making it one of the most urgent perimeter risks in this cycle.
Source: Palo Alto Networks

Cisco SD-WAN Authentication Bypass Is Being Exploited in the Wild
Cisco Talos reported ongoing exploitation of CVE-2026-20182 in Catalyst SD-WAN controllers. Successful abuse lets a remote attacker bypass authentication and obtain administrative privileges, and the flaw has already been added to CISA’s KEV catalog.
Source: Cisco Talos

Critical cPanel Flaw Weaponized Against Government and MSP Networks
Threat actors were observed exploiting CVE-2026-41940 in cPanel and WHM shortly after disclosure. The activity targeted government, military, hosting, and managed service provider environments, showing rapid operationalization of the authentication bypass bug.
Source: The Hacker News

DigiCert Revokes Fraudulently Issued Certificates After Internal Portal Breach
DigiCert revoked certificates obtained after attackers compromised support systems and pivoted into an internal portal used in certificate workflows. The incident matters because it involved EV code signing certificates and directly affected trust in software signing and issuance processes.
Source: SecurityWeek

Copy Fail Linux Root Flaw Moves Into Real World Exploitation
CVE-2026-31431, known as Copy Fail, moved from disclosure to confirmed in the wild exploitation and was added to CISA’s KEV list. The bug affects major Linux distributions and can let a local attacker escalate privileges to root.
Source: SecurityWeek

NGINX CVE-2026-42945 Is Already Being Exploited
Attackers are targeting CVE-2026-42945, a heap buffer overflow in NGINX’s rewrite module, only days after public disclosure. The flaw can crash worker processes and, in certain configurations, may enable remote code execution on internet facing systems.
Source: The Hacker News

Mini Shai Hulud Hits More Than 320 npm Packages
A fresh Mini Shai Hulud supply chain campaign impacted more than 320 npm packages, along with GitHub Actions and a VS Code extension. The compromise propagated through trusted maintainer access and downstream dependencies, expanding the blast radius across developer and CI environments.
Source: SecurityWeek

GitHub Confirms Breach of 3,800 Repositories via Malicious VS Code Extension
GitHub said roughly 3,800 internal repositories were accessed after an employee device was compromised through a trojanized VS Code extension. The case highlights how developer tooling remains a direct path into high value internal code environments.
Source: BleepingComputer

OpenAI Confirms Internal Impact From the TanStack Supply Chain Attack
OpenAI disclosed that two employee devices were affected in the broader TanStack and Mini Shai Hulud campaign. The company said it found no evidence of impact to customer data, production systems, intellectual property, or deployed software, but still rotated certificates as a precaution.
Source: OpenAI

Checkmarx Jenkins AST Plugin Compromised in a Supply Chain Attack
Checkmarx warned that a malicious version of its Jenkins AST plugin was published to the Jenkins Marketplace. Because the plugin is used directly inside build and scanning pipelines, the incident placed developer credentials and CI workflows at risk.
Source: SecurityWeek

DAEMON Tools Lite Supply Chain Attack Confirmed by Vendor
DAEMON Tools confirmed unauthorized interference in its build environment after compromised installers were distributed from the official site. Signed installation packages from a trusted vendor were turned into malware delivery mechanisms, making this a clear software supply chain incident.
Source: DAEMON Tools

JDownloader Website Hacked to Deliver Python RAT Installers
The official JDownloader site was compromised and redirected users to malicious Windows and Linux installers, with the Windows variant dropping a Python based RAT. The incident shows that software download portals remain highly attractive targets for attacker controlled replacement payloads.
Source: BleepingComputer

Instructure Reaches Agreement After Canvas Data Theft Incident
Instructure said it reached an agreement with the actor behind the Canvas breach in an attempt to prevent publication of stolen data. The incident remains important because of the scale of affected schools and universities and the sensitivity of the exposed education related information.
Source: The Hacker News

Drupal Critical SQL Injection Flaw Is Now Being Targeted in Attacks
Drupal warned that attackers are attempting to exploit CVE-2026-9082, a highly critical SQL injection issue affecting PostgreSQL backed sites. The project had already cautioned that exploitation could begin within hours or days, and those attack attempts have now materialized.
Source: BleepingComputer

Critical Ollama Bug Could Expose 300,000 Deployments to Secret Theft
Researchers warned that a critical unauthenticated flaw in Ollama could expose prompts, messages, API keys, tokens, and other sensitive heap data from roughly 300,000 deployments. Since Ollama is widely used as a self hosted AI inference engine, the issue has direct enterprise impact beyond test environments.
Source: SecurityWeek

Security Highlights Of The Week [05/26-2]

PAN-OS Zero-Day Under Active Exploitation Grants Root Access on Firewalls
Palo Alto Networks says CVE-2026-0300 in the PAN-OS Captive Portal is being actively exploited and allows unauthenticated remote code execution with root privileges. Because it affects internet-facing firewalls, it is one of the most urgent issues in this week’s set.
Source: Palo Alto Networks

Cisco SD-WAN Authentication Bypass Is Under Active Exploitation
Cisco Talos reported ongoing exploitation of CVE-2026-20182 in Catalyst SD-WAN controllers, where attackers can bypass authentication and obtain administrative privileges. CISA has already added the flaw to KEV, which confirms real operational risk beyond theory.
Source: Cisco Talos

Critical cPanel Vulnerability Weaponized Against Government and MSP Networks
Threat actors were observed exploiting CVE-2026-41940 in cPanel and WHM shortly after disclosure, with activity spanning government, military, hosting, and MSP environments. The flaw enables authentication bypass and elevated control of exposed control panels.
Source: The Hacker News

DigiCert Revokes Fraudulently Issued Certificates After Support Portal Hack
DigiCert revoked certificates obtained after attackers compromised support systems and pivoted into an internal portal used for certificate handling. The incident is especially important because it involved EV code signing certificates and trust in the certificate issuance process itself.
Source: SecurityWeek

Copy Fail Linux Root Bug Moves Into Real-World Exploitation
CVE-2026-31431, known as Copy Fail, has moved from public disclosure to confirmed in-the-wild exploitation and was added to CISA’s KEV catalog. The flaw affects major Linux distributions and allows local privilege escalation to root.
Source: SecurityWeek

DAEMON Tools Lite Supply Chain Attack Confirmed by Vendor
DAEMON Tools confirmed unauthorized interference in its infrastructure after trojanized installers were distributed from the legitimate site. This is a direct supply chain compromise because trusted, signed installer packages were turned into malware delivery vehicles.
Source: DAEMON Tools

Official SAP npm Packages Compromised in TeamPCP Supply Chain Campaign
Multiple official SAP CAP and Cloud MTA npm packages were compromised with malicious install-time behavior designed to steal credentials and abuse developer environments. Because these packages sit inside normal CI/CD workflows, the impact extends beyond a single workstation compromise.
Source: Socket

Checkmarx Jenkins AST Plugin Compromised in Supply Chain Attack
Checkmarx warned that a malicious version of its Jenkins AST plugin was published to the Jenkins Marketplace as part of a supply chain attack. The issue matters because the plugin is designed to sit directly in security scanning and build pipelines.
Source: SecurityWeek

OpenAI Confirms Impact From the TanStack Supply Chain Attack
OpenAI said two employee devices were affected in the broader TanStack and Mini Shai Hulud campaign, prompting certificate rotation and repository credential response actions. The company said it found no evidence of impact to customer data, production systems, or deployed software.
Source: OpenAI

Instructure Reaches Agreement After Canvas Data Theft Incident
Instructure said it reached an agreement with the actor behind the Canvas breach in an effort to prevent publication of stolen data tied to thousands of schools and universities. The case remains significant because of the scale of affected education environments and the sensitivity of the exposed data.
Source: The Hacker News

JDownloader Site Hacked to Serve Python RAT Installers
The official JDownloader website was compromised and pointed users to malicious Windows and Linux installers, with the Windows payload deploying a Python based remote access trojan. It is another reminder that download portals remain a high-value target for supply chain abuse.
Source: BleepingComputer

Breeze Cache WordPress Plugin Is Under Active Exploitation
Attackers are actively exploiting a critical arbitrary file upload flaw in the Breeze Cache plugin for WordPress. With hundreds of thousands of active installations and remote code execution potential, the issue quickly moved from disclosure to broad attack traffic.
Source: Wordfence

Burst Statistics Flaw Could Let Attackers Fully Impersonate WordPress Admins
A critical authentication bypass in the Burst Statistics plugin can let unauthenticated attackers impersonate an administrator during REST API requests if they know a valid admin username. In a worst case scenario, that can be enough to create a new administrator account without prior access.
Source: Wordfence

Critical Ollama Bug Could Expose 300,000 AI Deployments to Secret Theft
Security researchers warned that a critical unauthenticated vulnerability in Ollama could expose prompts, messages, API keys, and other sensitive heap data from roughly 300,000 deployments. Since Ollama is widely used as a self-hosted inference engine, the finding has direct enterprise AI relevance.
Source: SecurityWeek

NGINX Rift Revives an 18-Year-Old Bug With Potential RCE Impact
Researchers disclosed memory corruption issues in NGINX, including a critical heap overflow in the rewrite module that can lead to denial of service and, in some configurations, remote code execution. The issue stands out because of NGINX’s internet-facing role and the age and reach of the vulnerable logic.
Source: depthfirst

Security News