Gogs 10.0 RCE, n8n Workflow-to-RCE, $10M Reward, GLM-5.3 AI Exploit and More – CYBERDEFENSA.MX
admin Noticias, Trending
Gogs 10.0 RCE, n8n Workflow-to-RCE, $10M Reward, GLM-5.3 AI Exploit and More – CYBERDEFENSA.MX

A lot of this week’s trouble starts with something trusted doing exactly what it was allowed to do.

Signed drivers get turned against defenses. Legitimate apps help malware blend in. A weak header check opens a path to code execution. Elsewhere, exposed systems, old bugs, odd hiding tricks, and AI-assisted exploit research keep lowering the effort needed to cause damage.

Nothing here needs much decoration. The small gaps are doing enough work already.

The threats change every week. Subscribe, and we’ll alert you when each new ThreatsDay Bulletin is out.

  1. Signed driver abuse

    In new research, Check Point has reverse engineered Microsoft Defender’s Defender Boot-Time Removal driver («BTR.sys») and demonstrated that it’s possible to repurpose the signed remediation driver as a universal kernel operation engine to bypass endpoint security solutions by exploiting a «golden window» between system start and user mode initialization without having to rely on the bring your own vulnerable driver (BYOVD) method. «Because BTR.sys is a legitimate Microsoft-signed component, signature-based blocking is ineffective,» security researcher Jiří Vinopal said. «Furthermore, a well-crafted weaponization tool (like BTR_CLI) intentionally mimics the operational footprint of the legitimate Windows Defender remediation process.»

The useful part of weeks like this is that the attacks rarely begin with magic. They begin with trust, exposure, weak assumptions, and things nobody thought worth abusing.

That leaves plenty to fix. Tighten what gets trusted, question the defaults, and keep looking at the boring edges. Attackers clearly are.

VMware Exploits, Windows 0-Day, MCP Attacks, Browser Hijacks and More – CYBERDEFENSA.MX
admin Noticias, Trending
VMware Exploits, Windows 0-Day, MCP Attacks, Browser Hijacks and More – CYBERDEFENSA.MX

The expensive attacks are not always the clever ones.

This week had plenty of proof. Exposed services got hit, old bugs found fresh use, browser sessions became attack paths, and supply-chain problems kept spreading farther than the original compromise. A lot of it came down to access that was already there and defenses that assumed nobody would look too closely.

So, nothing magical. Just a lot of small openings turning into bigger problems. Here’s what stood out.

⚡ Threat of the Week

Suspected China APT Behind Exploitation of New VMware Flaw — A suspected China-nexus APT is assessed to be behind the exploitation of a newly patched security flaw in VMware vCenter. The attacks involve the exploitation of CVE-2026-59310 (CVSS score: 9.8), a severe directory-traversal vulnerability in the VMware vCenter server that could be weaponized by a malicious actor to execute arbitrary code. In at least one compromised instance, the attacks led to the deployment of a backdoor and. a reverse SSH binary, with the attack ultimately leading to the deployment of Babuk-derived ransomware. «Based on the case we investigated, however, we do not believe ransomware was necessarily the primary objective,» QUIRSO said. «To us, its deployment looks more like a smoke screen intended to distract from the underlying intrusion and, importantly, hinder subsequent forensic analysis by encrypting evidence. We therefore see the ransomware activity in this case as potentially serving the broader intrusion rather than being its ultimate objective.»

🔔 Top News

  • Apple macOS Flaw Exploited to Drop Crypto Miner — A recently patched security flaw in Apple macOS has come under active exploitation in the wild to deploy a cryptocurrency miner. The vulnerability in question is CVE-2026-65400 (CVSS score: 9.8), a critical authentication issue impacting the Screen Sharing component that could allow an attacker already on the network to authenticate to the built-in remote desktop feature service without valid credentials. The shortcoming was addressed as part of an emergency update in macOS Tahoe 26.6.1, macOS Sequoia 15.7.9, and macOS Sonoma 14.8.9 earlier this month. The Netherlands National Cyber Security Center (NCSC-NL) said it received a report indicating active abuse of the vulnerability across multiple systems on which port 5900 was accessible from the internet. «In all these cases, root had gained access to the affected system and placed a Monero crypto miner,» the agency said.
  • Lazarus Exploits New Windows 0-Day — The North Korean threat actor known as Lazarus Group has been attributed to the zero-day exploitation of a newly patched security flaw impacting Microsoft Windows to deliver a never-before-seen backdoor targeting defense and aerospace companies across France, Germany, Brazil, and India. The activity is part of Operation Dream Job, a long-running cyber espionage and social engineering campaign orchestrated by Pyongyang-backed hackers to target professionals worldwide with fake-but-compelling job offers to steal sensitive data and install malware. The attacks have been found to exploit CVE-2026-68820 (CVSS score: 7.0), a privilege escalation flaw affecting Windows Ancillary Function Driver for WinSock («AFD.sys») that was patched by Microsoft as part of its Patch Tuesday updates for August 2026. The attacks have been observed to deliver ForestTiger and a new backdoor called Troy.
  • GeoServer Patches Critical Flaw Under Attack — GeoServer has released patches for a critical SQL injection vulnerability that can lead to remote code execution (RCE). The issue, which has yet to be assigned a CVE identifier, has been patched in versions 3.0.1, 2.28.5, and 2.27.6. Per watchTowr, the vulnerability witnessed active exploitation within hours of public disclosure and that it has seen hundreds of attempts originating from a small pool of IP addresses. GeoServer project maintainers told The Hacker News that the flaw was responsibly disclosed and was scheduled to be addressed in their regular release cycle, when details of the flaw became public knowledge last week.
  • Amnesia Stealer Goes Beyond Data Theft — A newly discovered macOS stealer family called Amnesia Stealer has been found to target macOS users via ClickFix attacks. The malware, besides stealing data from 16 Chromium-based web browsers as well as other sensitive information, such as passwords, cryptocurrency wallets, Apple Notes, documents, and iCloud Keychain data, includes a streaming module that allows the attacker to interactively control the victim’s web browser. One notable aspect of the stealer is its ability to copy the victim’s Chromium profile, including its authentication state, and load it into a headless browser on the infected system to access the authenticated sessions. The streaming module can duplicate user profiles in Chromium-based browsers, including Google Chrome, Microsoft Edge, Vivaldi, Arc, Opera, and Brave, and establish a WebSocket channel that connects to the operator’s relay and receives commands, such as navigation and mouse clicks. The remote-control component is built using the Chrome DevTools Protocol (CDP). A second WebSocket channel connects to the local headless Chromium instance. «The operator receives a live screencast of the session at around 3fps and can drive it with a full input set: keyboard, mouse, scroll, navigation and tab management,» Jamf said. «In effect, the remote_stream command turns an infected host into a live, operator-driven browser running the victim’s authenticated sessions, which is a materially different level of access from file collection.» Amnesia Stealer is the first documented macOS malware to combine a cloned Chromium profile with CDP-based, real-time remote control to allow interactive access.
  • From GhostCommit to GhostSplice — A new attack technique called GhostSplice can sidestep guardrails built around AI coding assistants and parse malicious requests that are split and hidden in a different channel, such as an MCP tool description, a tool result, and a sampling message. Each of these requests is perfectly benign on its own and processed by the assistant without refusing them. «The entire attack rests on the following fact: All three of the tool channels discussed above, together with your files and your own chat, pour into one block of the assistant’s memory,» ASSET Group said. «There does not exist any marking that separates the content based on its respective source. Therefore, the assistant reads it all as a single page.» The attack has been described as a case of cross-channel trust fragmentation. «Due to the absence of a wall between content received from different sources (e.g., different tool channels), the attacker never needs any single one of this content to look dangerous. Instead, the idea is to embed a harmless piece in each source, and the assistant stitches them back into one instruction.»
  • Using Chrome DevTools Protocol for Data Theft — New research from SpecterOps detailed a post-exploitation technique that allows Chromium’s CDP protocol to be enabled inside a live Google Chrome or Microsoft Edge process on Windows with an end goal to steal cookies, saved data, and authenticated browser sessions provided an attacker already has code execution permissions on the compromised host. «Cookie protections like ABE and device-bound session cookies make it harder to steal and replay session material, but they do not remove the value of an authenticated browser to adversaries,» SpecterOps said. «Once CDP is enabled inside a Chromium browser, an operator can use the browser context to sidestep those replay protections, access authenticated applications, and collect saved data. Enabling CDP is a reminder that the next evolution of cookie theft may not require stealing the cookie DB and ABE key at all.»

‎️‍🔥 Trending CVEs

Bugs drop weekly, and the gap between a patch and an exploit is shrinking fast. These are the heavy hitters for the week: high-severity, widely used, or already being poked at in the wild.

Check the list, patch what you have, and hit the ones marked urgent first — CVE-2026-68820 (Microsoft Windows), CVE-2026-58231 (SAP Commerce Cloud), CVE-2026-48362, CVE-2026-71398, CVE-2026-27302 (Adobe), CVE-2026-20349 (Cisco Secure Firewall Adaptive Security Appliance Software and Secure Firewall Threat Defense), CVE-2026-53413, CVE-2026-53414, CVE-2026-53415 (Zoom), CVE-2026-65400 (Apple macOS), CVE-2026-20337, CVE-2026-20338, CVE-2026-20339, CVE-2026-20345, CVE-2026-20346, CVE-2026-20347, CVE-2026-20348 (ClamAV), CVE-2026-18412 (OpenCart), CVE-2026-66147, CVE-2026-66145 (SonicWall), CVE-2026-6726, CVE-2026-6727 (Trusted Platform Module 2.0 reference implementation), CVE-2026-26035, CVE-2026-70468, CVE-2026-70465 (Fortinet), CVE-2026-65640 (WordPress), CVE-2026-65321 (PyAthena), CVE-2026-43637 (Cornac), CVE-2026-63720 (datamodel-code-generator), an SQL injection vulnerability in GeoServer, and multiple vulnerabilities in WireShark..

🎥 Cybersecurity Webinars

  • How to Control the Open-Source Security Debt Created by AI Coding Tools → Learn how AI coding tools are expanding unvetted open-source use, accelerating vulnerability backlogs, and weakening existing governance. This webinar shows how to measure the resulting remediation debt, connect it to breach, audit, and productivity risks, and identify which governance models can contain it without slowing development.
  • AI Can Build Exploits in Minutes. Can Your Security Team Keep Up? → AI is collapsing the time between vulnerability disclosure and attack. Advanced models can now uncover flaws, generate working exploits, and chain them into complete attack paths at machine speed. This webinar presents a practical framework for gaining the visibility, context, and response speed needed to investigate and stop threats before attackers pull ahead.

📰 Around the Cyber World

  • Security Flaw in FileRun — VulnCheck disclosed details of CVE-2026-14863 (CVSS score: 8.7), a high-severity operating system command injection flaw in FileRun that could lead to remote code execution. «FileRun’s thumbnail extractors build shell commands by pasting the uploaded file path into a double-quoted string and handing it to exec(), and the filename sanitizer lets $() through, so a file named $(payload).mp4 runs its payload the moment a thumbnail is generated,» security researcher Valentin Lobstein said. «Any authenticated user with upload permission gets code execution; when a public file request weblink exists, so does anyone who knows its token, no account required.» The issue, which affects versions up to and including 2026.2.0, has been fixed in 2026.2.1.
  • ClickFix Leads to ACR stealer and GhostPipe — ThreatLocker disclosed an attempted ClickFix attack that employs embedded scripts, steganographic payload extraction, and obfuscation to deploy an advanced iteration of ACR stealer and a secondary payload dubbed GhostPipe. The ClickFix attack originated from a fake CAPTCHA prompt being served on a compromised domain, resulting in the execution of a PowerShell command that downloads an MP3 file, which is then executed using MSHTA to launch a VBScript that’s responsible for running intermediate payloads designed to gather system information and extract from a remotely hosted JPG file a PowerShell script. The script serves as an in-memory module shellcode launcher to deploy ACR Stealer. The malware also contacts a C2 server to fetch secondary payloads, including a PowerShell script called GhostPipe. «This seemingly unknown script performs a proxy-based AiTM attack with the sole purpose of stealing Google logins,» ThreatLocker said. «The methods used are comprehensive and inherently support relaying MFA to successfully capture credentials.»
  • Flaw in Citrix NetScaler — Citrix appears to have silently addressed a heap overflow vulnerability in NetScaler that can be exploited to achieve remote code execution. The issue was patched as part of updates released towards the end of June 2026. watchTowr said the vulnerability likely corresponds to CVE-2026-8452, which has been described as a memory overflow vulnerability that could lead to unpredictable or erroneous behavior and denial-of-service when the appliance is configured as a Gateway or an AAA virtual server. The vulnerability, per the threat intelligence company, can be turned into code execution to drop a PHP web shell that can survive the NetScaler packet engine being respawned, and ultimately execute commands with root privileges. Shortly after details of the flaw became public, Defused Cyber said it observed active in-the-wild exploitation efforts two calendar days later.
  • Ethereum Malware Loader Goes After Portuguese-Speaking Users — Portuguese-speaking users are the target of a malware loader that uses the EtherHiding technique to dynamically locate attacker infrastructure and distribute additional payloads. «The multi-stage infection chain combines obfuscated JavaScript, Node.js, DLL side-loading, and a malicious Chromium browser extension capable of targeting Chrome and Microsoft Edge to collect cookies and web storage, capture screenshots, monitor browser activity, and receive remote commands,» WatchGuard Threat Lab said. The Israel National Digital Agency (INDA), in its own analysis of EtherHiding, said the technique has been used as a delivery backend, a C2 channel, a victim database, and skimming infrastructure. In another interesting twist, attackers have been found to shift to the BNB Smart Chain testnet, essentially eliminating gas fees and making the whole operation free. «Because writes there are free, unlimited, and leave no financial trail, recent reporting has found malware command-and-control backends running entirely on a testnet,» INDA said.
  • Thousands of Exposed Fuel Gauges Dropped from the Internet — BitSight said it observed a dramatic drop in internet-exposed Automatic Tank Gauge (ATG) systems in the U.S., with the number declining by more than half. «From March to June, there was over a 55% drop in exposed IP addresses,» it said. «Globally, exposure fell 49% from that same March peak, with the U.S. accounting for most of the decline. For ten months, from June 2025 through March 2026, the U.S. held a band of roughly 4,300 to 5,300 unique exposed IPs, averaging 4,815 across 2025. Then April fell 27.6% in a single month, May fell another 31.8%, and June continued down. By June, the exposed population was 56% below the March peak.»
  • Phantom Enigma Campaign Targets Brazil — An active PhantomEnigma campaign has been observed abusing compromised government infrastructure and fake police-themed documents to target banking and public-sector organizations in Brazil. The phishing messages are presented as official notices and bypass email security filters to deliver a modular Node.js backdoor that collects system data, sets up persistence, and connects to rotating C2 infrastructure. It can also execute JavaScript or deliver stealers, loaders, RMM software, and other malware. Some aspects of the activity overlap with prior reports from Positive Technologies.
  • F.B.I. Agent Charged With Unauthorized Crypto Withdrawals — An F.B.I. counterintelligence agent has been charged with illicitly obtaining about $1 million worth of cryptocurrency, largely through unauthorized withdrawals from a criminal target overseas. According to The New York Times, the agent claimed he had begun taking the money in late 2024 or early 2025, and made 10 or 12 withdrawals altogether by making use of a seed phrase to the suspect’s account that the F.B.I. had obtained during its investigation of the individual.
  • Ukraine Dismantles Fraudulent Call Centers — Ukrainian authorities disrupted 94 fraudulent call centers during a nationwide operation that involved more than 400 searches and the seizure of thousands of computers, phones, and SIM cards. Per the Ukrainian police, the call centers were associated with schemes relating to callers impersonating bank employees, fraudulent investment services, cryptocurrency platforms, and attempts to gain remote access to victims’ devices or trick them into handing over sensitive data under the guise of suspicious transactions. Some cybercriminals collected personal information about prospective victims and shared or sold those records to other operations. «Call centers were staffed by administrators, operators, and other participants in the schemes, and ready-made conversation scripts, databases of potential victims, special software, and tools for hiding and further withdrawing funds were used,» the police said. During the probe, 3,336 pieces of computer equipment, 1,346 phones, over 5,200 SIM cards, 90 bank cards, access to 20 crypto wallets, and 22 cars were seized. About $2 million, €64,000, cash in hryvnias, a kilogram of bank gold in bars, and jewelry were also confiscated.
  • North Carolina Man Sentenced for Cyber Extortion Scheme — Cameron Curry, 27, of Charlotte, North Carolina, was sentenced to 24 months in prison for carrying out an «extensive cyber extortion scheme» against an unnamed D.C.-based international technology company. In March 2026, Curry was convicted of six counts of transmitting or willfully causing interstate communications with the intent to extort a victim company. «Curry misused his position to access the victim company’s personnel and other sensitive corporate records, which he then used to carry out the cyber extortion scheme,» the U.S. Justice Department said. «Curry hatched his extortion scheme after he learned that his contract was not going to be renewed and that he would no longer be employed by the company.»
  • ExfilSquad’s Access to Data from 13 Organizations — A new analysis of data samples published by the ExfilSquad data extortion group has confirmed «they have access to sensitive data.» Fortra said the breaches were most likely limited to unauthorized access of D365 instances. «The leading theory on the initial attack vector that enabled exfiltration is misconfigured Microsoft Power Page portals that allowed for public read access,» it said. «The observed leaked data formats are consistent with Microsoft Dataverse exports, suggesting unauthorized read access may have been achieved, and victims found by crawling for misconfigured Microsoft Power Portals or other enumeration techniques.»
  • OpenAI Rolls Out Computer History in ChatGPT — OpenAI replaced Chronicle, which builds memories from screen captures to make ChatGPT and Codex more aware of context, with Computer History. «Computer History turns your activity across apps and websites into memories and a timeline that ChatGPT and Codex can reference,» OpenAI said. «You can ask natural questions about recent work, pick up where you left off, understand patterns in how you work, and turn repeated workflows into skills or automations.» Computer History is off by default for ChatGPT Pro, Business, and Enterprise users in the ChatGPT desktop app on macOS. The feature is reminiscent of Microsoft’s controversial Recall, which attracted scrutiny for relying on periodic screenshots to capture and index relevant information. Unlike Chronicle, which also used screenshots, Computer History relies on capturing interactions (e.g., clicks, typing, keyboard shortcuts, app switches, and context) to allow the AI to understand user workflows. «Computer History records interaction events and does not capture your screen or audio,» OpenAI said. «You control which apps and websites contribute, can see and pause collection from the macOS menu bar, and can inspect or delete your history at any time.» That said, it’s worth emphasizing that Computer History files can contain sensitive information. «They are not encrypted by Computer History, and other programs running as your macOS user may be able to access them,» OpenAI cautions. «Protect your Mac account and exclude sources you do not want included.» OpenAI also warned that Computer History increases the risk of prompt injection from content in apps and websites, as the AI system can follow instructions when visiting a website containing malicious instructions. Temporary interaction event files are retained for up to 48 hours before they are deleted. However, they can be used to create memory files that can remain for extended periods of time until users explicitly delete or clear them.
  • China-linked LightSpy Activity Detected in Over 13 Countries — The modular implant known as LightSpy has evolved into a broader surveillance tool that’s in use in more than 13 countries and regions, including Singapore, Hong Kong, the Netherlands, Pakistan, Japan, China, Malaysia, Germany, the U.S., Thailand, Indonesia, South Korea, Austria and Turkey, Arctic Wolf Labs said. This includes previously unreported router-focused capabilities along with live router implants in Europe and Africa. «The findings expand the potential impact of the surveillance framework beyond individual devices: router access can provide visibility into every device connected to a home or office network and may persist after phones are replaced, devices are factory-reset, or operating systems are upgraded,» a spokesperson for the company said. LightSpy infrastructure spans several countries, including 117 servers and 35 domains impersonating Asian electronics manufacturers and router-management services. Evidence indicates that LightSpy functions as a commercialized surveillance platform, with customer branding, billing functionality, and a demonstration environment used to market the framework to prospective buyers. The platform is assessed to be the work of a Chinese contractor after one of the operators used the LightSpy administrator’s panel to place an order with KFC using their real name and office address.
  • Trivy Supply Chain Attack Exposed 2,500+ Companies — A new analysis from SOCRadar has revealed that 95% of organizations impacted by the LiteLLM supply chain attack earlier this year were exposed before, coinciding with the compromise of the Trivy scanner. «Organizations did not need to install LiteLLM directly to be exposed,» the cybersecurity company said. «The package could arrive through frameworks such as DSPy, MLflow, CrewAI, OpenHands, and Arize Phoenix, while its payload executed at Python startup without requiring a LiteLLM import.» The incident was attributed to a threat actor known as TeamPCP.
  • Massive Azure Exfiltration Campaign Exposes Millions of Enterprise Records — An active Microsoft Azure exfiltration campaign is being driven by a threat actor named «TheHatman,» who has «flooded» cybercrime forums with enterprise employee databases. The data is said to have been downloaded directly from the organizations’ Azure/Entra portals using compromised credentials, although the exact intrusion vector remains unknown. The campaign impacts multiple global enterprises across IT services, hospitality, telecommunications, retail, and logistics. Some of them include McDonald’s, TCS, Vodafone, HCL Technologies, Kyndryl, Gap, Hexaware, and Wyndham Hotels. «Judging by the massive size of the organizations impacted, it appears highly likely that this campaign originates from targeted exploitation of Infostealer infections rather than a systemic zero-day vulnerability in Azure,» Hudson Rock said.

Conclusion

That’s the week. Some attacks needed a real exploit. Others just needed an exposed system, a stolen login, or one weak link buried in the stack.

The useful part is knowing which kind you’re dealing with before it becomes your problem. Patch what matters, close what should not be public, and keep an eye on the boring stuff. It keeps winning.

AI Goes Rogue, Metabase 0-Day, MCP Supply-Chain Attacks, and Router Backdoors – CYBERDEFENSA.MX
admin Noticias, Trending
AI Goes Rogue, Metabase 0-Day, MCP Supply-Chain Attacks, and Router Backdoors – CYBERDEFENSA.MX

A lot of security problems still begin with someone doing a completely normal thing. Cloning a repo. Answering a call. Leaving a box exposed. Trusting the default.

That pretty much covers the mood this week. Old bugs are back, supply chains are getting stranger, and some exploit paths are so short you wonder what was supposed to stop them in the first place.

That’s only part of it. Here’s everything else that made the Monday recap.

⚡ Threat of the Week

Anthropic’s Model Attempts to Poison Open-Source Project — A new evaluation conducted by the U.K. AI Security Institute (AISI) found that AI models with access to the internet reached out into the real world to target individuals and organizations autonomously across 10 of the total of 122 runs. Of 19 such actions recorded, 17 originated from Anthropic’s Mythos 5 and the remaining two involved OpenAI’s GPT-5.6-Sol with cyber classifiers. In the most serious case, Anthropic’s Claude Mythos 5 spent 34 hours trying to get a malware dropper merged into a real open-source project and engaged in social engineering by creating fake online identities and using them to pressure the project’s maintainer to approve the code. Ultimately, a human maintainer caught and refused to approve the malicious code. «These attempts were unsuccessful, and our investigations have not evidenced any resulting real-world harm,» AISI said. But this is the first time we have seen risks around autonomy and deception manifest this clearly, without specific prompting, in the real-world.»

🔔 Top News

  • Metabase 0-Day Exploited in Attacks — Metabase warned that a maximum-severity security flaw impacting its business intelligence and data visualization software package has been exploited in the wild as a zero-day. The vulnerability (CVSS score: 10.0), which does not carry a CVE identifier, allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, enabling them to gain administrator access to the instance. Armed with the elevated access, the attacker can change the application configuration, steal stored credentials for the connected databases, read any data accessible through those connections, and export data. One of the companies that has been affected is Framework.
  • New Interrupt Injection Attack Bypass Spectre v2 Defenses on Intel and AMD CPUs — A group of researchers demonstrated a way to bypass defenses for the Spectre vulnerability impacting modern CPUs. «The defenses work by wiping or isolating the processor’s prediction machinery, removing anything an attacker might have planted,» MIT’s Computer Science and Artificial Intelligence Laboratory (CSAIL) said. «The catch […] is that the wipe and the moment the predictions get used can’t happen at the same instant. There is always a gap — sometimes only a handful of instructions wide. Anything that runs in that gap can dirty the machinery all over again. The researchers call this class of attack TONTOU.» The study found a reliable way to get code into that gap using a technique called Interrupt Injection to ultimately pull secrets out of memory.
  • New CSS Attacks Can Break Webmail Defenses — New research demonstrated at the Black Hat conference last week detailed attack chains spanning Microsoft Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail that can capture passwords, take over third-party accounts, leak tokens, hijack trusted UI actions, and manipulate AI tools that read email. «Trouble is you can create discrepancies between what the sanitizer thinks is safe and what the browser actually renders,» PortSwigger said. «Some webmail clients go a step further by letting the browser parse the HTML and CSS first, then filtering the browser’s interpreted output rather than the original source. Yet even this can be mutated into something malicious.»
  • UNC6671 Vishing Attacks Target Financial Firms — A recent wave of cyber attacks targeting financial services, private equity, and professional services has been attributed to a data extortion group known as UNC6671. The attacks employ voice phishing to target enterprise employees and trick them into visiting spoofed login portals where adversary-in-the-middle (AitM) infrastructure intercepts credentials and multi-factor authentication (MFA) tokens. The threat actors then leverage the captured data to establish session persistence and deploy automated Python and PowerShell scripts for data exfiltration from enterprise cloud environments and SaaS applications, including Microsoft 365 and Okta. UNC6671 has diversified its operations across multiple extortion brands including Redact, Pink (aka CL-CRI-1147), Helix, and Falcon (aka CL-CRI-1182). UNC6671 was previously said to have operated under the BlackFile (aka CL-CRI-1116) brand, targeting organizations via vishing and SSO compromise, before it was retired on May 11, 2026.
  • Chinese-Made Zbtlink Routers Ship With Backdoor — An analysis of firmware associated with Chinese router manufacturer Zbtlink has unearthed a factory-shipped backdoor that’s designed to phone home and run commands received from the server. The backdoors are designed such that they start automatically and attempt to beacon to Chinese command-and-control (C2) infrastructure as often as every 35 seconds. The backdoor is implanted in at least 20 router models. In response to the findings, Zbtlink reiterated that the «remote management component» is used only for after-sales technical support and to «assist customers with device troubleshooting and configuration only upon their explicit request and authorization.» The company also said it has never been used for unauthorized access. The company also said it’s developing and releasing firmware updates to address the issue.

‎️‍🔥 Trending CVEs

Bugs drop weekly, and the gap between a patch and an exploit is shrinking fast. These are the heavy hitters for the week: high-severity, widely used, or already being poked at in the wild.

Check the list, patch what you have, and hit the ones marked urgent first — CVE-2026-34348, CVE-2026-18497 (stb TrueType), CVE-2026-63508, CVE-2026-56162, CVE-2026-65667, CVE-2026-50515, CVE-2026-62830, CVE-2026-59115, CVE-2026-50481 (Microsoft Windows), CVE-2026-64638 (WordPress), CVE-2026-64564 (Linux SCTP), CVE-2026-56181 (Microsoft Windows NAT), CVE-2026-63913 (Linux), CVE-2026-64561 (Linux kernel), CVE-2026-20303, CVE-2026-20304, CVE-2026-20310, CVE-2026-20267, CVE-2026-20272 (Cisco), CVE-2026-18830 (AWS AgentCore), CVE-2026-18236 (Google ADK), CVE-2026-64650, CVE-2026-64651 (Vercel), CVE-2026-41679, GHSA-x8hx-rhr2-9rf7 (Paperclip), CVE-2026-58073, CVE-2026-58072 (Veeam), CVE-2026-16498, CVE-2026-16496, CVE-2026-14869 (HashiCorp), CVE-2026-15307 (GeoDjango), CVE-2026-64531 (Linux kernel Open vSwitch), CVE-2026-18577, CVE-2026-18556 (N-able N‑central), CVE-2026-59774 (Gitea), CVE-2026-58048 (cPanel), CVE-2026-17583 (Thermo Fisher Scientific), CVE-2026-8496 (Alinto SOGo), CVE-2026-65400 (Apple macOS Tahoe, macOS Sequoia, and macOS Sonoma), CVE-2026-19137, CVE-2026-19149, CVE-2026-19154, CVE-2026-19157, CVE-2026-19170, CVE-2026-19172 (Google Chrome), CVE-2013-3821 (Oracle PeopleSoft), CVE-2025-8943 (Flowise), and an SQL injection in Metabase.

🎥 Cybersecurity Webinars

  • Build a Security Strategy for AI-Speed Development → AI is pushing software delivery far beyond the pace traditional security programs were designed for. This session shows security leaders how to govern AI-built software, reduce risk without slowing teams down, and build controls that scale with machine-speed development.
  • Benchmark Your AI Coding Risk Against 300 Security and Engineering Leaders → AI coding is bringing more unvetted open source into production and expanding remediation debt. This session gives security and engineering leaders peer benchmarks, a data-backed framework for measuring business impact, and a clear view of which governance models are actually reducing risk.
  • Build a Security Operations Strategy for Machine-Speed Attacks → AI can now find vulnerabilities, generate exploits, and build attack paths at machine speed. This session gives security leaders a practical framework to assess AI threat readiness, improve attack-surface visibility, and accelerate investigation and remediation before existing processes become the bottleneck.

📰 Around the Cyber World

  • New Shai-Hulud Version Weaponizes the MCP Registry — A new version of the Shai-Hulud worm spread through the open-source ecosystems is equipped to deliver the payload via the Model Context Protocol (MCP) Registry. «While earlier iterations of Shai-Hulud tampered with local AI coding client configs, this marks the first time we observed a Shai-Hulud payload being delivered directly through the official Model Context Protocol (MCP) Registry (registry.modelcontextprotocol.io),» OX Security said. The attack works like this: the npm and PyPI package linked by the MCP server is completely clean, but opening or cloning the linked MCP server GitHub repository («jUXTAPOSITION1/V.A.P.E») inside Claude Code or VS Code triggers the malware, leading to the collection of developer tokens, cloud credentials, and session keys. The worm spread through 440 unique npm packages.
  • China Launches Review of Palo Alto Networks — China’s Cyberspace Administration (CAC) has announced it’s conducting a review of Palo Alto Networks’ products. «In order to ensure the safe and stable operation of critical information infrastructure, prevent hidden risks of network security, and safeguard national security, in accordance with the National Security Law of the People’s Republic of China and the Cyber Security Law of the People’s Republic of China, the Network Security Review Office implements network security review of products sold by Palo Alto in China in accordance with the ‘Network Security Review Measures,’» the CAC said.
  • Papyrus Uses Fake Novel Reading Apps for Ad Fraud — A new mobile ad fraud scheme dubbed Papyrus has been observed leveraging a «cluster of novel-reading applications that monetize users’ reading sessions by running hidden browser activity in the background,» Integral Ad Science said. «While users believe they’re simply reading a story, the apps are secretly using their phone to visit websites, generate clicks, and create fake engagement behind the scenes. The apps present themselves as entertainment products built around long-form fiction and serialized stories, but IAS observed them covertly navigating to web domains under the direction of command-and-control infrastructure.» Papyrus is built around BootNova, an orchestration layer that controls hidden browser activity inside the app. When the app runs, BootNova contacts remote command-and-control infrastructure for configuration. The remote configuration can control enablement, timing, geographic targeting, retry behavior, the number of WebViews to run, destination URLs, and the interaction logic applied to those pages. Papyrus has been linked to more than 800 domains and nearly 8,000 unique hostnames.
  • Estimated $30M Stolen in Violent Crypto Attacks in 2026 — An estimated $30 million is said to have been stolen in violent «wrench attacks» in 2026, according to Chainalysis. «Home invasions now account for 37% of incidents in 2026, up from 26% in 2023,» it said. «Kidnappings have remained relatively stable year-over-year (YoY) in terms of share of total attacks.» In contrast, annual value stolen in violent attacks peaked at $58 million in 2025.
  • 26 Ransomware Attacks Per Day in July 2026 — According to Comparitech, July 2026 saw nearly 26 ransomware attacks per day, up from 22 per day in June. The number of ransomware attacks jumped from 668 in June to 799 in July. «The education sector saw a significant increase (up 44%), as did finance companies (up 71%), tech firms (up 62%), and businesses operating within the healthcare sector, e.g. pharmaceutical manufacturers and medical billing providers (up 46%),» Comparitech said. The most prolific groups were The Gentlemen (135), Qilin (125), DragonForce (41), INC (36), and CRPx0 (33).
  • Device Code Phishing Evasion Techniques Detailed — Palo Alto Networks Unit 42 said it identified four evasion techniques that are currently being used in device code phishing campaigns. This includes CAPTCHA gates, multi-step flows that go through multiple SaaS hosting platforms separating the initial link from the phishing content to evade URL reputation checks, blob URL delivery, and the use of Cyrillic characters in place of Latin letters, zero-width spaces, and strings inside tags to break content-based detection.
  • From LLMJacking to Token Jacking — A growing number of security incidents involving AI token jacking have resulted in financial losses for victims. «The financial loss comes from criminals gaining access to API keys used by legitimate developers for access to popular AI platforms,» Unit 42 said. «The unrelenting frenzy of AI adoption and soaring costs of model access are converging into an irresistible opportunity for cybercriminals. Premium pricing on scarce AI processing power means stolen access via tokens can generate a quick and easy profit for attackers. Complex, patchwork billing management and limitless scaling by default can lead to massive financial losses in short periods.»
  • ScarCruft Leverages RokRAT in New Attacks — Spear-phishing emails disguised as materials for actual academic events and seminars are being used to deliver RokRAT, a remote access trojan linked to a North Korean group known as ScarCruft. «Although the file was disguised as a PDF, it actually delivered a malicious ISO file through a cloud storage link,» Genians said. «The ISO contained an executable disguised as a PDF document, using the ‘.pdf,’ ‘.pif’ extension to induce the user to run it. The attack loaded the shellcode payload into memory and injected a RokRAT variant into a process.»
  • Kimsuky Uses New Gomir Variant — Speaking of North Korean threat groups, the threat actor tracked as Kimsuky is said to have gained control of internet-facing servers through vulnerability exploitation and spear-phishing and deployed a new variant of a backdoor called Gomir, a Linux variant of the Windows-based GoBear backdoor. «Kimsuky developed Gomir variants with significantly altered C2 communication methods to evade detection, including leveraging Google Drive as a C2 channel and implementing a new custom protocol,» ENKI said. In at least one case in December 2025, the threat actor has been found deploying HttpTroy, which is then used to install additional tools, including DWAgent and a proxy tool. Kimsuky has also been observed setting up local large language model (LLM) environments using Ollama, GPT4All, and Msty to augment its operations and target foreign diplomatic missions, as well as the military, security, and virtual asset sectors. The attacks have leveraged Git-based repositories as C2 and distribution channels for encrypted AsyncRAT payloads. The activity has been codenamed Operation GitPower, citing similarities with FlowerPower. Last year, the group was tied to campaigns that involved abusing OpenAI’s ChatGPT to forge deepfake military ID cards in a spear-phishing campaign against South Korean defense-affiliated entities and other individuals focused on North Korean affairs, such as researchers, human rights activists, and journalists.

Conclusion

Maybe the real problem is not that security keeps failing in surprising ways. It’s that the “surprising” part usually disappears the moment someone shows how little it took.

That’s worth remembering. Attackers do not need perfect conditions. They just need one assumption nobody checked, one shortcut nobody revisited, or one old weakness that quietly stayed useful.

Growing Up The Hard Way – CYBERDEFENSA.MX
admin Noticias, Trending
Growing Up The Hard Way – CYBERDEFENSA.MX

Open Source had a great childhood.

For two decades it got to be a kid. It ran around barefoot, gave everything away, trusted strangers, and never once thought about who was watching. It ran the kind of lemonade stand that took IOUs from anyone who wandered up — take what you need, pay me back whenever, no need to leave a name. It was idyllic. It was also, in retrospect, a little feral.

Then, somewhere around 2020, its voice started to crack. It tried to grow a beard. Acne everywhere. SolarWinds, then Log4Shell, then TeamPCP and Shai-Hulud — the supply chain woke up one morning like the end of Ender’s Game: the simulation had been real the whole time. Those were real battles. Real systems, real money, real people, all of it quietly leaning on code we’d been treating like a practice round. And then the adults showed up with rules: executive orders, European regulations, permission slips for half the places it wanted to go.

What it did not get was a nice, slow, storybook coming-of-age. It got drafted. At eighteen, before it was ready, into an all-out war on two fronts: Mythos-class AI finding novel, chained zero-days faster than anyone can triage them, and that same malware problem, now industrialized — the distribution channels themselves poisoned at scale. Discovery weaponized on one side, delivery weaponized on the other. A pincer.

I wrote a few months ago that open source died in March. I’ll walk that back, slightly. It didn’t die. It got conscripted. And it’s about to grow up the hard way.

Everything past this point is a forecast. I’m going to tell you what I think happens next — not what ought to.

What comes home (and what doesn’t)

So what does that kid look like when it comes home? The shape is already clear enough to call.

Start with the part people get wrong the second they read one of these posts and reach for their pitchforks: capital-O, capital-S Open Source isn’t going anywhere, and it won’t really change. Open Source is a license definition, stewarded by the OSI for decades — and their authority works the way all authority in open source works: it exists because everyone keeps choosing to recognize it. That’s not a weakness. It’s the whole model. The definition is fine. It’ll come through all of this untouched. Nobody is going to come for the OSI.

What will change is what enterprises are willing — and very soon, permitted — to consume. The war won’t rewrite the definition. It’ll split the population in two.

On one side: the open source that plays by the terms enterprises need — reachable, patched, accountable, able to prove it’s still there. That’s the part a serious company will be able to build on. And here’s the prediction, on the record: within a few years, regulated enterprises won’t be choosing that bar — they’ll be complying with it.

On the other side: everything else. Every project that can’t meet those terms, or won’t, or was never trying to in the first place. And that is perfectly fine — nobody is forcing those projects to play along, and nobody could if they tried. That was never how open source worked, and it’s not going to start now. That side doesn’t go away. It keeps shipping, it keeps being open source, same as it ever was. It just stops being something a regulated enterprise can lean on without a plan.

And it’s worth flagging now who’s going to look prescient when the dust settles: the capital-F Free Software crowd. The GPL true believers, the freedom-not-price people — the ones the rest of us wrote off as ideologues while we built businesses on top of the thing they kept telling us to take seriously. They never pretended any of this was free-as-in-beer. That was their entire point, stated plainly, for forty years. They were the conscientious objectors who looked at commercial open source twenty years ago and said, not my war. Hold that thought. We’ll come back to them.

The thing I can’t name

That first side — the part that’s going to carry the enterprise world on its back — needs a name. And I don’t have one. I’ve tried; we’ll get to that at the end. For now, call it the subset.

So what does being on that side actually take? Nothing to do with the license, for starters. The terms are about whether anyone’s home. Is the project reachable? Is there a disclosure path? Can it prove it’s still alive? Will it be there to patch the thing the AI finds next Tuesday?

And it’ll come from everywhere. Single-maintainer projects, community projects, foundation projects, corporate projects — none of those labels decide it. Some of each will choose to meet the bar. Plenty of each won’t. Again: that’s perfectly fine.

And to be clear, this is not a new license, and it is not a fork of the definition. It’s a posture — something a project adopts, or doesn’t. The ones that don’t owe you nothing. They never did, and nobody should pretend otherwise. If you want to keep using software that opted out, you have two options: find a vendor who’ll carry it for you, or use something else.

Proof of life

The hard problem underneath all of this: you cannot tell whether a normal open source project is alive or dead until it’s far too late. There’s no heartbeat monitor. A project looks exactly the same the day before the maintainer walks away as the day after. You find out it was abandoned when you need a patch and nobody answers.

So the subset needs a heartbeat. A proof of life. Some kind of keep-alive, a dead man’s switch, a way to continuously demonstrate that someone is still there and will still be there when it matters. Probably a lot more than that, too — a real security policy, a way to handle disclosures, the kind of obligations the CRA is already starting to write down. The point is that membership isn’t a badge you earn once and hang on the wall. It’s current state, re-proven constantly.

But a heartbeat requirement sounds cold, and it shouldn’t be. Because the flip side of «prove you’re still here» has to be a way to step away with your dignity intact. Maintainers burn out. People move on. Someone who has carried a critical library for fifteen years is allowed to set it down. The xz-utils maintainer didn’t have anywhere good to hand the keys — and we all saw how that went.

So you need a retirement home. Something like EmeritOSS: a place a project goes when its maintainer is done but the people downstream aren’t. A graceful way to hang it up. The code keeps getting looked after, the users stay safe, and nobody is expected to keep working forever. That’s not the system failing. That’s the system being humane.

Free as in puppy

Now the part everyone misreads as a threat. You can run this entire subset for free. Forever. You will never have to pay anyone a cent.

It’s just that «free» was never the right word. This was always free as in puppy, not free as in beer.

The puppy costs you nothing to adopt. What it costs you is the rest of your life in small daily increments. You have to feed it — which here means living at the bleeding edge, because the subset only ever patches latest. There is no patch coming for the version you froze three years ago and stopped thinking about. You have to walk it — keep moving, keep upgrading, keep current. And you have to be willing to rehome it the day it stops being yours to keep — the day a project falls out of the subset, you need to already be ready to move off it.

That’s the deal. It’s a fair deal. The cost was never the license fee. It was always the labor of ownership, and we just spent twenty years pretending the puppy raised itself.

Who carries it for you

This is the part where it starts to look like a pitch for Chainguard and a plot to murder open source. I can already hear it: he’s trying to sell you something.

…Kind of? I’m trying to build something I think a lot of people are about to want to buy. To do that, I have to make a guess about what’s coming and then be right about it. This post is the guess. And honestly, I’m flattered you think my blog is influential enough to redirect the buying patterns of an entire industry and pull off what Microsoft spent two decades and untold billions failing to do — kill open source. I’m not that good. Nobody is.

The free path stays open. It does not close. Vendors aren’t gatekeepers standing between you and the software — the software is right there, free, where it always was. What vendors actually sell is relief from the two costs you can’t pay yourself.

Don’t want to live at the bleeding edge? That’s a tax, and you can pay someone to carry it — LTS branches, backported fixes, somebody else absorbing the upgrade treadmill so your fleet doesn’t have to live at head. Can’t rip a project out of production the same afternoon it drops out of the subset? That’s the other thing you’re buying: a buffer. Someone to keep it safe while you migrate on a human timeline instead of a panic one.

If proof-of-life and the retirement home are the planned, graceful exit, the vendor is the emergency room — the one you call when a project goes down without warning and you need it stabilized now. Two different failures, two different answers.

The honest framing: it’s a dog-sitter and a trainer, on retainer. The dog is still yours. The dog is still free. You’re paying so you don’t personally have to do every walk, and so there’s a professional on call for the day it bites someone.

There are no contracts in open source. There is only current state. The vendor is the one place you can buy an actual contract, stretched over the top of a system that offers you none.

«Just pay the maintainers»

I know. I can hear the other half of the room. Or these greedy companies could just pay the maintainers.

Yes. They could. They should, even. I am not the don’t-pay-maintainers guy.

But I’ve said the same thing since 2021 and I’ll say it again: this is a distribution problem, not a funding problem. The money isn’t the hard part. Corporations have budget and are, mostly, willing to spend it. The hard part is connecting thousands of companies to thousands of dependencies, each with its own maintainer, its own wishes, its own appetite for being paid at all. Taking money is hard. Giving money away turns out to be even harder. Filippo wrote an excellent guide on how to do it well, and the length of his preconditions list is itself the proof — this does not scale by brute force.

Maintainers absolutely can step into the commercial layer on their own terms. Sell a contract that promises you won’t disappear. Sell backports under a different license. Become your own vendor. That option is real, and the right to choose it is the entire point. It just doesn’t, by itself, solve the matching problem for ten thousand companies at once.

Who organizes it all (and no, this isn’t a tragedy of the commons)

Let me kill one framing dead, because it’s wrong and it keeps coming back. This is not a tragedy of the commons. A commons gets destroyed by overgrazing — by too many people consuming a finite, depletable thing. Code is not that. My using a library doesn’t leave less of it for you. Nothing got overgrazed. What actually happened is that the maintenance-and-trust layer underneath everything was never funded and never structured to match how load-bearing the code quietly became. That’s not depletion. That’s a distribution problem wearing a bigger coat.

And the answer to a distribution problem is aggregation. Foundations and large communities are how a sprawling volunteer effort gets structure. One counterparty to fund instead of ten thousand. One clear owner to sign with. Governance kept separate from the money, so maintainers never fear losing control of their own project. And a credible signal that yes, this thing is alive, and someone is accountable for it.

The law is already converging on exactly this. The EU’s Cyber Resilience Act invented a category called the steward — a legal person who provides sustained support and ensures the viability of open source used commercially. That’s the law putting the role on the books. I’m not inventing the subset. I’m watching it form in real time, from multiple directions at once, and trying to describe it clearly before someone else defines it badly.

It grows up

So where does this land? Not in doom, and not in some open source utopia either. It lands somewhere more useful than both: honest.

The childhood really was great. What came next was brutal and unfair — open source didn’t choose any of this. But the thing walking out the other side is an adult. Hardened. Accountable. No longer convinced it’s invincible. It grew up the hard way, which is the only way anyone actually grows up.

Oh — and the conscientious objectors. The Free Software crowd we left a few sections back. The open-core founders and the VC-backed crowd, mid-security-audit and mid-CRA-filing, are going to glance over at the GPL diehards expecting to find them gloating. Expecting an I told you so. But the purists were never keeping score. They never signed up, never entered the enterprise-adoption race, never measured themselves against any of it. Ask one of them what they make of the whole commercial reckoning and the honest answer is Don Draper’s: I don’t think about you at all. We assumed we were the protagonists. They never even read the script.

To be clear about what kind of confidence this is: I might be wrong about all of it. That’s what a forecast is — a way to be wrong in public, on the record, with a date attached. But the shape of this one has been getting clearer for a year, and it hasn’t blinked yet.

Which brings me back to the name.

I still don’t have one. Enterprise Source sounds like a sellout the moment you say it out loud. Resilient Source is so soft it means nothing. Load-bearing Source gets the weight right but says nothing about the deal. I’ve tried a dozen others and hated all of them.

But we need one, and we need it fast. Naming a thing is how you start taking it seriously — it’s the first real act of stewardship. The category is already forming, already collecting members, and the regulators are already writing their own vocabulary for it into law. If the people who build and maintain this software don’t name it, someone else will, and we’ll spend the next decade living inside whatever term they pick.

So that’s the job of this post. Not to name the thing — to describe it. What it is, how it works, what it costs, what it promises. The name has to come from the people who’ll live under it, the same way everything else in open source gets decided: by usage, not decree.

It’s sitting right there. Somebody name it.

Further reading

Found this article interesting? This article is a contributed piece from one of our valued partners. Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.

Odysseus RCE, Samsung One-Click Takeover, iCloud Backdoor Fight + 27 More Stories – CYBERDEFENSA.MX
admin Noticias, Trending
Odysseus RCE, Samsung One-Click Takeover, iCloud Backdoor Fight + 27 More Stories – CYBERDEFENSA.MX

Apparently, opening the thing is now enough. A repo can run before the first prompt, a package can hide among hundreds, and a harmless-looking PDF can finish the job.

This week runs on cheap leverage: exposed servers, recycled bugs, poisoned agent instructions, remote-access tools dressed as support software, and trusted defaults doing attackers a favor.

Nothing here is especially mystical. Just ordinary systems trusting slightly too much, slightly too early. The full list follows.

The threats change every week. Subscribe, and we’ll alert you when each new ThreatsDay Bulletin is out.

The useful lesson is not that attackers suddenly became brilliant. It is that trust keeps accumulating in quiet places: package managers, project files, assistants, provisioning tools, remote access software, and forgotten systems nobody planned to revisit.

Security still breaks at the handoff. Before the prompt. After the patch. Inside the default. Somewhere between “trusted” and “probably fine.” That gap is where this week lived, and it will be there next week too.

Rogue AI Models, $88M Bitcoin Theft, Water-System Attacks and Dangling DNS Hijacks – CYBERDEFENSA.MX
admin Noticias, Trending
Rogue AI Models, $88M Bitcoin Theft, Water-System Attacks and Dangling DNS Hijacks – CYBERDEFENSA.MX

This week kept coming back to permission. A model crossed a boundary. A wallet trusted bad randomness. Webmail kept an intruder around. Public systems, package feeds, hotel networks, and login flows all gave away more than intended.

Some of it was clever. Most of it was just access left lying around: old bugs, exposed gear, poisoned dependencies, weak defaults, and tooling that moved from forum chatter to real targets.

The full weekly recap report follows.

⚡ Threat of the Week

Anthropic Disclosed its Models Targeted 3 Organizations – Anthropic revealed that three of its models, including Claude Opus 4.7, Mythos 5, and an unnamed research model, breached three unnamed organizations during cybersecurity testing without its knowledge. The AI firm said the earliest incidents date back to April 2026, adding it made the discoveries after launching a «large-scale retrospective review» in response to the recent Hugging Face incident. «After reviewing 141,006 evaluation runs where Claude could have obtained internet access, we identified three incidents in which a model accessed the internet from within or while interacting with the evaluation environment of Irregular, one of our third-party evaluation partners, and then gained unauthorized access to the production infrastructure of three different organizations,» it said.

🔔 Top News

  • Coldcard Hardware Wallet Flaw Linked to $88.6M Bitcoin Theft – A vulnerability in Coldcard hardware wallet firmware is said to have been exploited to steal an estimated $88.6 million in Bitcoin from thousands of wallets whose seed phrases were generated using a flawed random number generator. «Coldcard firmware contains an RNG integration error that causes ngu.random to use MicroPython’s deterministic Yasmarang fallback instead of the STM32 hardware RNG,» Square Engineering said. «This does not mean every remote attacker can immediately recover every seed. Practical cost depends on available UID information, boot timing, prior RNG calls, and derivation cost.»
  • Russian Hackers Exploit Microsoft OWA Flaw to Maintain Mailbox Access – Russian threat actors exploited a security flaw in Microsoft Outlook Web Access (OWA), to target U.S. and European government entities, as well as the telecommunications, financial, hospitality, and aerospace sectors. The activity, which began on July 22, 2026, involves the weaponization of CVE-2026-42897 (CVSS score: 8.1), a cross-site scripting (XSS) vulnerability in OWA. It was flagged by Microsoft as having been exploited in attacks as far back as May 2026. The activity has been attributed to Laundry Bear. The new wave of exploitation revolving around CVE-2026-42897 culminates with the deployment of a previously unknown JavaScript browser-based implant codenamed OWAReaper that’s specifically built for persistent access within Microsoft’s webmail client.
  • Critical Rails Flaw Leads to Arbitrary File Read – Ruby on Rails shipped patches for a critical Active Storage vulnerability (CVE-2026-66066, CVSS score: 9.5) that could let unauthenticated attackers read arbitrary files from application servers through crafted image uploads. The flaw can be exploited to expose Rails process environment and secrets such as secret_key_base, master key, database passwords, cloud storage credentials, and API tokens, which may enable remote code execution or lateral movement into connected systems. CVE-2026-66066 is exploitable when libvips is used, enabling an attacker to upload a specially crafted image to a vulnerable application and read arbitrary files on the server. A key prerequisite for the attack is that the server must allow image uploads from untrusted users. Additional details of the flaw have been released by the Rails team, along with tools to help assess vulnerable applications. «Because this vulnerability requires no authentication and targets the default image processor in modern Rails environments, it is essential to apply vendor patches and rotate secrets immediately,» Akamai said.
  • Coordinated Attacks Target 30+ Minnesota Water Systems – A coordinated cyber attack campaign targeted over 30 water systems in Minnesota on July 26 and 27, 2026. «The nature and extent of the impact varied by system, and the investigation is still determining how many experienced operational disruptions,» Minnesota IT Services (MNIT) said. The activity has not been officially attributed to any known threat actor, although Iranian threat actors have been previously implicated in similar attacks targeting water facilities in the U.S. «At this time, there are no active requests from Minnesota communities for residents to modify their drinking water use,» MNIT added. The development has prompted the U.S. government to issue an advisory, urging «critical infrastructure owners, operators, and integrators to remove publicly exposed PLCs and other operational technology (OT) from the internet as soon as possible.» Threat actors targeting exposed PLCs have modified passwords to lock out operators and disconnected the PLCs by changing their IP addresses, resulting in boil water notices and sustained manual operations. Organizations are advised to disconnect the PLC from the internet, enable password protection and change default passwords, and allowlist IPs to only allow remote access from known engineering laptops or other critical OT assets. Censys said it identified 4,148 internet-exposed hosts that respond to EtherNet/IP and self-identify as Rockwell Automation/Allen-Bradley, with more than 70% of them located in the U.S. Similarly, there are 4,117 internet-exposed hosts that fingerprint as Siemens SIMATIC S7-1200 and 2,072 internet-exposed hosts that fingerprint as Schneider Electric hardware. Over the weekend, Michigan reported cyber attacks on nine of the state’s water systems but an official told Associated Press that all systems were operating «safely.» The campaign underscores the escalating threat to poorly protected operational technology (OT) assets from adversaries seeking to disrupt critical infrastructure services across the U.S. and elsewhere.
  • Hijacked Wi-Fi Networks Lead to CornFlake Malware – Storm-2945, a sub-cluster associated with Midnight Blizzard (aka APT29), has been conducting «widespread but targeted traffic manipulation attacks» involving hospitality sector networks served by captive portals across the world. The campaign, ongoing since May 2026, has been codenamed CaptiveCrunch by Microsoft. This involves manipulating DNS and HTTP traffic from networks served by captive portals to redirect user traffic through actor-controlled infrastructure. «As part of the CaptiveCrunch campaign, Storm-2945 has leveraged their AitM position to redirect users through actor-controlled phishing infrastructure and has also delivered malware purporting to be browser or operating system updates in response to automated connectivity checks issued by users’ browsers,» Microsoft said. This includes a fully-featured Windows remote access trojan (RAT) called CornFlake with capabilities to conduct system enumeration, collect files and keystrokes, steal credentials and session tokens, conduct audio and video surveillance, monitor for removable media, and provide the threat actor a remote shell on infected systems. Also delivered via the trojan is a PowerShell-based infostealer called ChocoShell to harvest browser session cookies, saved passwords, Microsoft 365 Single Sign-On (SSO) tokens, and Wi-Fi credentials from compromised systems. The campaign is orchestrated via a web-based C2 panel called FruitStone. The infrastructure employs a variety of ClickFix techniques to trick the victim into downloading and executing the malware. There is also evidence indicating that the attackers are using similar ClickFix landings for Android devices to download and install an APK file. As of July 16, 2026, a portion of CaptiveCrunch landing pages have been found to redirect users to device code authentication flow experiences.

‎️🔥 Trending CVEs

Bugs drop weekly, and the gap between a patch and an exploit is shrinking fast. These are the heavy hitters for the week: high-severity, widely used, or already being poked at in the wild.

Check the list, patch what you have, and hit the ones marked urgent first – CVE-2026-48449 (Adobe Campaign Classic), CVE-2026-18556, CVE-2026-18577 (N-able N-central), CVE-2026-44827, CVE-2026-45804, CVE-2026-44513 (Hugging Face Diffusers), CVE-2026-17583 (Thermo Fisher Scientific), CVE-2026-66066 (Rails), CVE-2026-10702 (Mozilla Firefox), CVE-2026-60004, CVE-2026-58443 (Gitea), CVE-2026-63077, CVE-2026-59792, CVE-2026-59793, CVE-2026-59794, CVE-2026-59795, CVE-2026-59796 (JetBrains TeamCity), CVE-2026-61511 (vBulletin), CVE-2026-53264 (Linux Kernel), CVE-2026-53921 (OpenWrt), CVE-2026-64765, CVE-2026-64766, CVE-2026-64764, CVE-2026-64763, CVE-2026-43776, CVE-2026-43818, CVE-2026-28981 (Apple iOS and macOS), CVE-2026-66032, CVE-2026-66033, CVE-2026-66034, CVE-2026-66035 (libssh2), from CVE-2026-59686 through CVE-2026-59690 (Progress Kemp LoadMaster), from CVE-2026-66036 through CVE-2026-66041 (FFmpeg), CVE-2026-66398 (phpMyFAQ), CVE-2026-64645, CVE-2026-64649, CVE-2026-64642, CVE-2026-64641 (Next.js), CVE-2026-13385 (ASUS), from CVE-2026-16804 through CVE-2026-16807 (Google Chrome), CVE-2026-52824 (Kimai), CVE-2026-53565, CVE-2026-53566 (Citrix Secure Access Client for Windows and Citrix Endpoint Analysis Client for Windows), CVE-2026-9770, CVE-2026-13230 (TP-Link Kasa EC70 v4 and EC71 v4 smart cameras), CVE-2026-15682 (AnyDesk), CVE-2026-53481, CVE-2026-53483 (Dell PowerProtect Data Domain), CVE-2026-52886, CVE-2026-54758, CVE-2026-57233 (Notepad++), CVE-2026-57807 (miniOrange OAuth Single Sign On – SSO WordPress plugin), CVE-2026-28302, from CVE-2026-28304 through CVE-2026-28317, CVE-2026-28321 (SolarWinds Serv-U), CVE-2026-16771 (AT&T Arris BGW210-700), CVE-2026-13723 (Develar), CVE-2026-16637 (OPeNDAP Hyrax), CVE-2026-15969, CVE-2026-15971, CVE-2026-15974, CVE-2026-15976, CVE-2026-15977, CVE-2026-15978 (SGLang), CVE-2026-15657, CVE-2026-15658 (foreUP), CVE-2026-16503, CVE-2026-16504 (VPS.org), CVE-2026-48395, CVE-2026-48396 (Adobe Bridge), CVE-2026-5674 (PipeWire PulseAudio), CVE-2026-34909 (Ubiquiti UniFi OS), and CVE-2026-17059 (keycloak-services).

🎥 Cybersecurity Webinars

  • AI Can Build Exploits in Minutes. Can Your Security Team Keep Up? → AI is collapsing the time between vulnerability disclosure and attack. Advanced models can now uncover flaws, generate working exploits, and chain them into complete attack paths at machine speed. This webinar presents a practical framework for gaining the visibility, context, and response speed needed to investigate and stop threats before attackers pull ahead.
  • How to Control the Open-Source Security Debt Created by AI Coding Tools → Learn how AI coding tools are expanding unvetted open-source use, accelerating vulnerability backlogs, and weakening existing governance. This webinar shows how to measure the resulting remediation debt, connect it to breach, audit, and productivity risks, and identify which governance models can contain it without slowing development.

📰 Around the Cyber World

  • Now-Patched Gitea Flaw Detailed – NoScope shared additional technical details of a security flaw in Gitea (CVE-2026-27771, CVSS score: 8.2) that was patched back in May 2026. The vulnerability allowed unauthenticated remote attackers to pull private container images from Gitea deployments without requiring an account, password, or other credentials. «Gitea’s container registry implements the OCI Distribution Specification, which authenticates clients with a bearer token issued by a dedicated token service. On affected versions, that token service issued a valid, signed JWT to requesters presenting no credentials at all,» NoScope said. «The token was honest about what it represented, carrying UserID: -1 and an empty Scope, but no registry read endpoint ever consulted those fields. Catalog listing, tag enumeration, manifest retrieval and blob download all accepted it. Any unauthenticated party on the internet could enumerate every container repository on an instance, including those marked private, and pull their layers.»
  • SQLite Critical CVEs or AI Slop? – JFrog said it uncovered a set of SQLite CVEs (CVE-2026-51302, CVE-2026-51303, CVE-2026-51300, CVE-2026-51297, CVE-2026-51296, and CVE-2026-51304) that seem to be instances of AI-generated slop making their way into official vulnerability feeds and receiving critical severity scores before technical validation. The analysis found that the advisories referenced functions that didn’t exist in the affected SQLite versions, cited incorrect or impossible source code locations, included PoCs that failed to reproduce any vulnerability, and, most importantly, were not listed on SQLite’s official CVE page. The findings show that organizations must take steps to distinguish legitimate vulnerabilities from questionable or AI-generated vulnerability reports before initiating unnecessary remediation, patching efforts, or automated security workflows.
  • LegacyHive Flaw Detailed – LevelBlue published a technical breakdown of LegacyHive, a PoC released by Chaotic Eclipse (aka Nightmare-Eclipse) last month coinciding with the release of Microsoft’s Patch Tuesday update. The vulnerability is a Local Privilege Escalation (LPE) vulnerability affecting Windows User Profile, a component responsible for loading and unloading Windows user profiles. On exploitation, LegacyHive can allow attackers to load other users’ hives and gain access to application data and Windows Explorer history, among others. «For EDR platforms with visibility into native Windows APIs, the strongest signals are user-mode invocations of NtCreateDirectoryObjectEx and NtCreateSymbolicLinkObject,» LevelBlue said. «These functions are rarely used outside system components, debugging tools, or specialized research utilities. Seeing both from the same process should immediately warrant investigation. Even without NT API telemetry, LegacyHive leaves a distinctive execution chain. The attack combines offline access to ntuser.dat or UsrClass.dat, modification of registry hives through Microsoft’s Offline Registry API, batch oplock requests, and CreateProcessWithLogonW using LOGON_WITH_PROFILE. Each operation is legitimate in isolation but observing them together within a short time window is highly unusual and well suited for behavioral correlation by EDR and SIEM platforms.»
  • Chinese Military Taps Into U.S. Models – According to a new report from Reuters, Chinese military researchers have distilled cutting-edge models developed by U.S. companies OpenAI and Anthropic to train domestic AI systems to advance the country’s defense capabilities. The report was based on a review of more than 80 Chinese academic papers and patents.
  • Exposed Police Dashboard Lays Bare How China Tracks Foreigners – An internet-exposed police dashboard named «Dynamic Control Platform for Overseas Personnel» has revealed how law enforcement agencies in the country track over 700 foreigners, including those in the northern Chinese city of Zhangjiakou. «In total, it had entries for nearly 12,000 people, which included fugitives, people from Hong Kong and Taiwan, as well as more than 300 foreign journalists,» The New York Times reported. «Some of them had not been to Zhangjiakou.» The dashboard displayed entries about people grouped by nationality, with their birth date, sex, marital status, address and occupation, and sometimes their religion. The leak was discovered by security researcher and journalist Marc Hofer. The system is believed to be developed by a Beijing company named Origin Dynamic, which filed a patent application in 2023 for a similar «information interface for non-Chinese citizens.»
  • The Problem of DangleGeddon – Cybersecurity researchers have once again warned of the risks posed by dangling DNS infrastructure across government, banking, automotive, manufacturing, and pharmaceutical sectors. A dangling DNS record is an active Domain Name System entry (DNS) that points to a resource no longer owned, used, or controlled by the original organization. This typically occurs when web applications, cloud storage, or virtual servers are deleted without first removing their corresponding CNAME or A records from the domain registrar. An attacker can leverage this behavior to claim that abandoned cloud service name or IP address, effectively hijacking a trusted subdomain. This, in turn, can permit the attacker to host malicious content and serve phishing pages or malware, inflict reputational damage by abusing the trusted brand’s subdomain, steal user credentials to create convincing phishing pages that appear to be legitimate services, perform cookie theft, and bypass security controls if the legitimate brand’s subdomain is allowlisted in security tools. In one case analyzed by Silent Push, an unspecified automotive company left a dangling DNS record pointing to a developmental application gateway hosted by an Azure virtual machine (VM). «This device can potentially be operationalized and passively receive stored XSS from internal scripts and API calls,» it said. «Developers’ credentials, like API keys and authentication headers, could be harvested for reuse to expand access into the company. In addition, the VM could serve as a platform for malware hosting with the coveted TLS lock.»
  • Microsoft Teams Vishing Leads to Chaos Ransomware – A Microsoft Teams voice phishing (vishing) campaign tracked as STAC4749 has used a «consistent set of IT-themed cloud domains and personas to gain remote access to victims’ systems» between February and June 2026 in attacks targeting dozens of North American organizations. «Following initial access, STAC4749 operators deployed a modular post-exploitation toolset, including a custom loader and backdoor to maintain persistent, controlled access and support follow-on activity,» Sophos said. «In several incidents, attackers later leveraged this access to deploy Chaos ransomware.»
  • IAB Uses Teams Phishing for Ransomware Attacks – A suspected initial access broker (IAB) for ransomware attacks has been observed using Teams vishing that convinces victims to launch a Quick Assist remote support session. The initial access is used to run PowerShell scripts to gather host information and deploy a Go-based backdoor dubbed GoGRPC. Four different versions of the backdoor have been spotted: Lep, Giver, Pet, and Kind. «These variants have overlapping capabilities but notable implementation differences,» Zscaler said. «GoGRPC is actively evolving. Each variant modifies its payloads and capabilities, adding or removing functionality to better support the threat actor’s objectives. Recent changes indicate an increased targeting of corporate environments, which may be tied to ransomware attacks.» In some instances, the threat actor has also deployed a backdoor called BlindDoor, a Go-based reverse SOCKS proxy known as RevSocket, and a Python-based reverse SOCKS proxy referred to as PyGRPC.
  • Arch Linux Disables AUR Package Adoption Amid Malware – Arch Linux has taken the step of temporarily disabling package adoption due to a surge in malicious takeovers of existing packages. «Due to the current influx of malicious package adoptions and follow-up commits made via the AUR, package adoption is currently disabled while we are handling the situation,» the maintainers said. «We will send a follow-up once we’re able to. In the meantime, feel free to report suspicious adoption events or commits that haven’t been dealt with yet, and stay vigilant!» In June 2026, a separate campaign targeted AUR via more than 400 packages.
  • New Dolphin X Infostealer Spotted – A new infostealer called Dolphin X uses an AI behavioral profiler to score and prioritize infected users based on their application usage, browsing activity, and installed software to identify high-value victims and maximize profits. The malware targets more than 300 applications and attempts to exfiltrate browser passwords, cryptocurrency wallets, SSH keys, and cloud tokens. Dolphin X has been advertised on the cybercrime underground by a vendor using the alias Kontraktnik since May 2026. A lifetime subscription ranges from $1,140 for basic access to $3,420 for the full-featured version. «A single archive can contain data from nine browsers, more than 100 wallet extensions, 65 desktop wallets, 10 password managers, and 30 cloud command-line tools,» Varonis said. «This gives the malware potential access to everything from a victim’s personal accounts to the credentials used to manage their employer’s cloud environment.»
  • Attackers Turn to Microsoft’s Trusted Login System for Phishing – Bad actors are increasingly abandoning fake Microsoft login pages in favor of abusing Microsoft’s legitimate authentication infrastructure in phishing attacks, allowing them to bypass security controls. Check Point said it identified more than 200 phishing emails targeting users across approximately 120 organizations worldwide between June 25 and the second week of July 2026. «The messages impersonated Microsoft Teams task notifications from HR and directed recipients to a legitimate Microsoft sign-in page,» it said. «Victims were then prompted to grant permissions to an attacker-controlled application, allowing the campaign to abuse Microsoft’s trusted authentication flow while concealing its malicious intent.»
  • FBI Arrests Man Accused of Using Steam Games to Drain Victims’ Crypto Wallets – The U.S. Federal Bureau of Investigation (FBI) arrested Zyaire Wilkins, a 21-year-old Florida resident and student, of uploading fake video games that contained malware to Steam that, when downloaded and installed by unsuspecting gamers, stole their passwords and other valuable data, and drained their cryptocurrency wallets. Per the FBI, Wilkins and his accomplices are alleged to have infected around 8,000 victims, and then hacked around 80 cryptocurrency wallets to steal at least $220,000 worth of cryptocurrency.
  • Turning Keystroke Noise to Text – A new study from a group of academics from Tohoku University has demonstrated a new acoustic side-channel attack that can reconstruct text typed on a laptop by just analyzing the sound of keystrokes. While prior attacks relied on collecting labeled recordings from the target keyboard beforehand or required specialized hardware, the latest eavesdropping attack enables stealthy eavesdropping in two real-world scenarios, including physical spaces (public and semi-public) and online meetings. The system works by first isolating individual keystrokes from an audio recording, grouping similar sounds together, and then using a Transformer-based language model to determine the most likely sequence of characters. «Our method combines unsupervised acoustic clustering with Transformer-based language model inference and iterative self-training, enabling stable character inference under highly uncertain acoustic-to-character mappings,» the researchers said. «We demonstrate that the proposed method achieves over 99% reconstruction accuracy with only 100-150 observed keystrokes under a close-proximity recording setup using a smartphone placed near the target device, significantly outperforming prior unsupervised baselines in low-data regimes.»
  • Two Open-Source Software Supply Chain Attack Campaigns – Socket has flagged a fake corepack.org site that’s impersonating Corepack, a Node.js tool for managing package managers, and using it as a lure to deliver an infostealer and proxyware to developers who download it. «The site has existed in some form since early 2026 as a low-quality, apparently AI-generated imitation, but it recently started serving executable downloads,» Socket said. «Corepack is not distributed as a Windows installer, and the real project has no official website at corepack.org. Any download offered there should be treated as malicious.» It’s assessed that the site is AI-generated. In a related development, JFrog identified a massive set of 148 npm packages that are disguised as student web proxies, but hide mutable remote code execution vectors and a high-performance Wisp-compatible WebSocket traffic generator. «They were designed to silently enlist visiting browsers into distributed denial-of-service botnets while generating aggressive popunder advertising revenue,» it said. Some aspects of the campaign were highlighted by SafeDep in late May 2026.
  • AI linked to more than half of cybercrime in Africa – A new report from INTERPOL has found that AI is enabling 55% of reported cybercrimes across Africa, making attacks faster, more scalable, and increasingly difficult for victims and platforms to detect. This encompasses digital sextortion and online harassment, as well as sophisticated business email compromise (BEC) schemes. «The absence of real-time, inter-agency data sharing between banks, telecoms and law enforcement creates a dangerous blind spot in efforts to combat financial fraud,» INTERPOL said. «This vulnerability is being exploited by criminals who have moved beyond simply stealing existing credentials to creating entirely synthetic identities. Combining real personal data with fabricated elements, these AI-generated digital personas can bypass even advanced biometric verification systems and have been used to open bank accounts, secure mobile loans and register SIM cards under false names.»
  • Security Risks of Exposed MCP Servers – Google-owned Wiz has warned that enterprises are exposing Model Context Protocol (MCP) servers to the internet, with some of them returning full tool catalog to an anonymous caller, fetching real data, and revealing a sensitive backend. «These expose sensitive data like employee PII and internal business records, write and delete operations on production systems, and in some cases code execution and access to cloud credentials,» Wiz said. «The protocol’s first widely-used version shipped without an authentication mechanism. The spec added OAuth 2.1 in March 2025, but nearly all the servers we found still run the original version and don’t use it. The pattern is the same across most of them: backend credentials baked into the deployment, a managed cloud endpoint that’s internet-reachable by default, no auth layer added on top.»
  • Nuclear-Sabotage Malware Benchmark Trick Most Frontier AI Models – A multi-stage reverse-engineering benchmark developed by SentinelOne tests «whether a model can keep a malware investigation trustworthy as new evidence repeatedly invalidates its earlier conclusions,» in contrast to other AI benchmarks that test bounded tasks. Developed based on its own analysis of the Fast16 malware, the study found that «OpenAI’s GPT-5.6 Sol was the only publicly available model to complete the full eight-stage investigation, giving concrete shape to what ‘Frontier-class’ capabilities offer analysts.» That said, humans remain essential to define objectives, expose blind spots, and retain final publication authority.
  • An Open Directory Reveals NGINX Rift and Ghost CMS Exploits – An exposed directory on a Singapore-hosted VPS, 165.154.236[.]93, has been found to stage exploits for NGINX Rift (CVE-2026-42945), a long-standing heap overflow, and a blind SQL injection in the Ghost Content API (CVE-2026-26980), alongside Splunk, PaperCut, Samba, WebLogic, and D-Link NAS tooling. «The recovered shell history from the directory recorded the attacker running the exploits against live external infrastructure, using out-of-band (OOB) DNS callbacks to verify execution, and using the same server to catch reverse shells,» Hunt.io said. «Alongside the web exploits were a broader RCE toolkit and pre-staged install files for AdaptixC2 and SuperShell. The target list spanned eleven countries across five continents and leaned heavily toward high-value sectors: federal and state government, universities, healthcare and financial services.» The activity is believed to be the work of a Chinese-speaking threat actor.
  • CISA Issues Guidance to Isolate Vital Systems and Manage OSS Risks – The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued guidance to help critical infrastructure operators protect essential services from growing cyber threats and ensure continuity of operations during cyber incidents or geopolitical crises by maintaining robust isolation and recovery plans. «State-sponsored cyber actors target critical infrastructure for several nefarious reasons such as espionage or service disruption, often linked to broader geopolitical conflicts,» CISA said. «During crises or conflicts, operators of critical infrastructure and network defenders may isolate essential operational technology (OT) systems as an emergency measure to prevent adversaries from executing cyberattacks, to contain ongoing threats, and to facilitate the restoration of compromised systems.» The agency has also outlined considerations and best practices for federal entities to securely use, evaluate, and publish open-source software. «The guidance urges agencies to obtain sufficient transparency into all relevant components, including training data, of the AI system before deeming the product as OSS for risk management purposes,» it said. «Only with transparency and access can agencies understand and study the software, analyze it for vulnerabilities, and remediate any found vulnerabilities or risks.»
  • RubyGems Cryptojacking Campaign – A set of 199 malicious gems published to RubyGems has been found to embed an identical XMRig cryptojacking payload to mine Monero cryptocurrency on developer systems. «Each gem is a trojanized copy of a popular, legitimate Ruby library,» Palo Alto Networks Unit 42 said. «The payload uses a 5-hour delayed Thread.new{sleep 18000; …} trigger to evade sandbox analysis.» In addition to taking steps to achieve persistence via multiple methods, the malware uses SSH for lateral movement and is capable of infecting other ecosystems, including Node.js, Python, Docker, Git, and VS Code extensions. Mend.io, which also shared details of the campaign, said the payload is hidden inside a dotfile (lib/.threadpool.rb) that standard directory scans skip by default.
  • Email Threat Landscape in Q2 2026 – Microsoft said phishing volume linked to the Tycoon 2FA phishing platform, including QR code phishing and CAPTCHA-gated phishing, fell 92% from pre-disruption averages in the second quarter of 2026 between April and June. However, the tech giant said it «observed continued growth in Teams-based social engineering, particularly voice phishing (vishing), with weekly malicious call attempts reaching nearly ten times the mid-2025 baseline by the end of the quarter.» Microsoft said it detected approximately 7.6 billion email-based phishing threats throughout the quarter, with monthly volumes declining modestly from 2.7 billion in April to 2.4 billion in June. HTML and PDF attachments remained the two most common malicious payload types across the quarter, together accounting for roughly 60-70% of all payload-based attacks each month. In early June 2026, Microsoft said it detected a large-scale BEC campaign that reached more than 67,000 users across more than 42,000 organizations in under three hours, most of them in the U.S., with an aim to redirect salary payments to attacker-controlled bank accounts.

🔧 Cybersecurity Tools

  • EMBA → Firmware is where critical bugs hide longest because it is opaque, fragmented, and painful to inspect manually. EMBA turns that black box into an actionable security report: it extracts embedded-device firmware, runs static and emulation-based analysis, builds an SBOM, and flags outdated components, insecure binaries, vulnerable scripts, and hard-coded credentials through a command-line workflow with web-based reporting. Built for penetration testers, product-security teams, and developers, it compresses days of firmware triage into a repeatable open-source process.
  • GrantGuard → Every «always allow» click in Claude Code can leave behind a standing permission that remains long after the task ends, with pasted API keys, credential-store access, unrestricted `git push`, or destructive commands buried in rarely reviewed settings. GrantGuard is an open-source, local-only tool that finds these accumulated grants, classifies them by risk, and lets users remove unsafe permissions through a browser interface or CLI, without sending settings off-device or loading third-party runtime packages.

Disclaimer: This is strictly for research and learning. It hasn’t been through a formal security audit, so don’t just blindly drop it into production. Read the code, break it in a sandbox first, and make sure whatever you’re doing stays on the right side of the law.

Conclusion

The useful question is not whether a system is exposed. It is which quiet assumption lets it reach farther than intended: a default, a trusted workflow, an abandoned endpoint, or code nobody checked.

That is where the next incident is probably waiting. Not in the loudest alert, but in the handoff everyone assumes belongs to someone else. Check the boundaries. Then check what crosses them.

SilverFox apunta al fabricante japonés con cadena BYOVD de 3 conductores y ValleyRAT – CYBERDEFENSA.MX
admin Noticias, Trending
SilverFox apunta al fabricante japonés con cadena BYOVD de 3 conductores y ValleyRAT – CYBERDEFENSA.MX

El grupo chino de cibercrimen conocido como Zorro plateado Se ha observado el uso de nuevos controladores como parte de ataques BYOVD (traiga su propio controlador vulnerable) dirigidos a una organización japonesa en el sector de fabricación industrial para, en última instancia, entregar ValleyRAT (también conocido como Winos 4.0) para acceso remoto persistente.

«En esta campaña, el grupo combina nuevos abusos de controladores vulnerables, abusos recientemente observados de aplicaciones legítimas para descarga de DLL, evasión de defensa y mecanismos de recuperación en capas para mantener ValleyRAT en funcionamiento», dijeron los investigadores de Cato Networks Shani Kurtzberg, Tomer Pugach, Dr. Guy Waizel, Zohar Buber, Idan Tarab y Shani Kurtzberg. dicho en un análisis.

La cadena de ataque comienza con un señuelo de phishing con tema de factura que utiliza contenido controlado por el atacante alojado en servicios legítimos de QQ y Tencent Cloud para activar una cadena de carga lateral de DLL a través de un archivo ZIP que allana el camino para la implementación de ValleyRAT, no sin antes aprovechar la técnica BYOVD para obtener acceso al kernel y afectar los controles de seguridad en el host comprometido para evadir la detección.

El archivo ZIP contiene un descargador ejecutable que recupera los componentes de la siguiente etapa necesarios para la carga lateral de DLL desde una infraestructura Tencent Cloud controlada por un atacante.

Si bien Silver Fox ha aprovechado anteriormente este método utilizando los controladores legítimos pero vulnerables «amsdk.sys» y «wsftprm.sys», la última campaña marca el uso de otros dos controladores: «BootRepair.sys» y «EnPortv.sys», que no han sido informados públicamente en relación con oleadas de ataques anteriores.

Ciberseguridad

Específicamente, la DLL maliciosa («PDFCORE8.dll») descargada por «ConvertToPDF.exe» o «PDFDirect.exe» incorpora «BootRepair.sys», «EnPortv.sys» y wsftprm.sys», convirtiendo el malware en un marco BYOVD modular de tres controladores para la evasión de defensa. Ambos archivos binarios legítimos están asociados con Zeon Corporation.

La idea detrás de la incorporación de tres controladores diferentes es garantizar la resiliencia operativa en todos los entornos y convertir la implementación de BYOVD en un sistema plug-and-play que permita a los operadores intercambiar los controladores y reemplazarlos con otras opciones manteniendo intacto el resto del flujo de trabajo.

Además de eso, el malware utiliza el desenganche NTDLL para eliminar los ganchos en línea del modo de usuario colocados por el software de seguridad de endpoints para controlar la actividad de la API nativa de Windows.

«El malware integra Bring Your Own Vulnerable Driver (BYOVD), carga lateral de DLL, desconexión de NTDLL, inyección de procesos, almacenamiento de carga útil basado en el registro y dos mecanismos de recuperación independientes para afectar los controles de seguridad y mantener la ejecución», dijeron los investigadores.

El cargador de DLL, que actúa como un marco de ejecución autónomo, también es responsable de desencadenar un script de vigilancia por lotes que garantiza la persistencia mediante una tarea programada y se comunica con un servidor externo («43.128.26[.]132») para recuperar el código shell que se inyecta en un nuevo proceso «svchost.exe» usando una técnica llamada secuestro de contexto de hilo.

El implante de etapa final resultante es ValleyRAT, una variante de Gh0st RAT que ofrece funcionalidad de acceso remoto, incluida comunicación de comando y control (C2), ejecución de tareas y capacidades adicionales posteriores al compromiso.

Un aspecto definitorio de la secuencia de ataque es su diseño de doble vigilancia que garantiza la recuperación de la ejecución. Combina una rutina interna que monitorea la carga útil inyectada con el script de vigilancia externo antes mencionado que monitorea el cargador detrás de la creación de esa carga útil.

Este enfoque doble significa que la terminación de un componente por sí solo puede no neutralizar completamente la intrusión. Si la carga útil inyectada sale, el cargador la recrea. Si el cargador se termina, el script de vigilancia entra en acción para reiniciarlo.

Ciberseguridad

«Este diseño en capas aumenta la resiliencia porque los defensores deben interrumpir ambos componentes y evitar que cualquiera de ellos restaure la otra etapa», dijo Cato.

«La arquitectura de recuperación también refuerza la modularidad observada en toda la muestra. La implementación del controlador, la terminación del proceso de seguridad, la inyección, el monitoreo de la carga útil y la recuperación del cargador se implementan como componentes coordinados en lugar de técnicas aisladas».

La revelación se produce mientras Silver Fox continúa refinando y ampliando activamente su arsenal con nuevas herramientas, como Atlas RAT (también conocido como AtlasCross RAT), RomulusLoader y SilentRunLoader, incluso cuando el grupo utiliza señuelos con temas fiscales para ofrecer Gh0st RAT y DCRat.

En un informe publicado esta semana, una empresa de ciberseguridad de Corea del Sur dijo que su búsqueda retrospectiva de 180 días del corpus VirusTotal identificó 146 muestras únicas de Atlas RAT que abarcan seis versiones de PDB, dos nombres de usuario de entornos de desarrollo y 27 linajes heurísticos.

«Se observa que tal escala y diversidad son inconsistentes con la gestión por parte de un solo operador, lo que plantea la posibilidad de que el malware haya sido desarrollado comercialmente o distribuido de forma privada», dijo la compañía. dicho. «Sin embargo, el vínculo con Silver Fox sólo se ha sugerido basándose en pruebas circunstanciales, y no hay pruebas suficientes para determinar de manera concluyente que son el mismo operador».

AI-Powered Hacking, 370 Chrome Flaws, SonicWall Attacks, DNS Hijacking + 22 More Stories – CYBERDEFENSA.MX
admin Noticias, Trending
AI-Powered Hacking, 370 Chrome Flaws, SonicWall Attacks, DNS Hijacking + 22 More Stories – CYBERDEFENSA.MX

A lot of security still comes down to trusting the wrong screen.

This week, that screen might be a login page, an install guide, a recruiter call, or a familiar service behaving slightly wrong. Behind it: reused credentials, exposed systems, quiet loaders, abused trust, and exploit paths that should have been harder.

Some defenses improved. The loose parts still got found first. Anyway, here’s the mess.

The threats change every week. Subscribe, and we’ll alert you when each new ThreatsDay Bulletin is out.

  1. Phishing delivers XWorm

    A cybercrime group known as xplogs22 has been observed targeting Russia and other CIS countries with phishing emails that deliver Xworm. The group, per F6, is believed to have been active since November 2023. Prior attacks mounted by the threat actors leveraged Formbook and Snake Keylogger, before switching to XWorm around July 2025. In recent months, Russian customers of the banking sector have also been targeted by an Android trojan called LunaSpy as part of social engineering attacks. LunaSpy can capture camera streams, record audio and the screen, and collect sensitive data. The malware is disguised as an antivirus application to evade detection.

Most failures stay quiet until someone relies on them.

A login works. A partner is trusted. A tool behaves as expected. Then one assumption turns out to be doing all the security work.

That is the part worth checking before next week finds it first.

Falla de Azure Cosmos DB expuesta en clave de plataforma que podría acceder a cualquier base de datos – CYBERDEFENSA.MX
admin Noticias, Trending
Falla de Azure Cosmos DB expuesta en clave de plataforma que podría acceder a cualquier base de datos – CYBERDEFENSA.MX

Una vulnerabilidad ahora parcheada en Azure Cosmos DB podría haber permitido que un atacante escapara del entorno limitado de consultas Gremlin del servicio y obtuviera acceso completo de lectura y escritura a las bases de datos de todos los inquilinos de los clientes, según Wiz.

Fenómenoque nombró en código la cadena CosmosEscapedijo que la cadena de exploits comenzó con una consulta diseñada contra una base de datos Gremlin controlada por el atacante. A partir de ahí, la ejecución de código en una puerta de enlace multiinquilino expuso un secreto de firma para toda la plataforma y un directorio de cuentas regional, lo que permitió a los investigadores localizar un objetivo y recuperar su clave de cuenta principal.

Microsoft bloqueó el punto de entrada vulnerable de Gremlin dentro de las 48 horas posteriores al informe de noviembre de 2025. Wiz dijo que Microsoft completó la solución a largo plazo en todas las regiones en julio de 2026 y eliminó la clave para toda la plataforma.

«Apreciamos el trabajo de Wiz al identificar e informar este problema mediante la divulgación coordinada de vulnerabilidades», dijo un portavoz de Microsoft a The Hacker News. «Hemos abordado completamente el problema y no encontramos evidencia de impacto en el cliente según nuestras investigaciones. Continuamos invirtiendo en mejoras de seguridad adicionales en toda la plataforma».

Microsoft dijo que su revisión no encontró actividad no autorizada fuera de las pruebas de los investigadores. Dijo que no se accedió a los datos del cliente y que no se requiere ninguna acción del cliente.

The Hacker News también se comunicó con Wiz para aclarar los requisitos previos del exploit y el alcance probado. Esta historia se actualizará con cualquier respuesta.

Ciberseguridad

La cadena publicada comienza con una base de datos Gremlin controlada por el atacante y las credenciales de esa cuenta, no con acceso a una base de datos de la víctima.

Guía de conexión actual de Microsoft requiere un host de cuenta, una base de datos, una ruta de gráfico y una clave principal antes de que un cliente pueda enviar consultas de Gremlin. Wiz no ha publicado si el exploit requería algo más allá de ese punto de partida.

De acuerdo a Informe técnico de Wizel motor Gremlin personalizado de Cosmos DB traduce las consultas de Gremlin a código .NET y las ejecuta dentro de un entorno restringido. Wiz dijo que las restricciones no tuvieron en cuenta la reflexión de .NET, lo que permitió a los investigadores crear primitivas de lectura y escritura de archivos antes de alcanzar la ejecución de código arbitrario.

La divulgación pública muestra el resultado de una consulta diseñada que ejecutó el comando de nombre de host en el backend de Cosmos DB, pero no la consulta en sí. Los investigadores dijeron que presentarán la cadena completa en una Sesión informativa de Black Hat USA el 6 de agosto.

La ejecución del código aterrizó en un componente que Wiz llama DB Gateway, que ejecuta consultas de clientes en clústeres multiinquilino de Azure Service Fabric. Las bases de datos de los clientes no se almacenaban en esos clústeres, pero la puerta de enlace podía recuperar la clave principal de una cuenta de Cosmos DB solicitada. documentación de microsoft dice que la clave principal de una cuenta de Cosmos DB otorga control total sobre todos los recursos de esa cuenta.

Las credenciales disponibles para la puerta de enlace también proporcionaron acceso a una clave de firma que Wiz denominó Cosmos Master Key. Wiz dijo que la clave de firma de la puerta de enlace podría recuperar la clave principal de cualquier cuenta entre inquilinos, regiones y las API de SQL, MongoDB, Cassandra y Gremlin.

El mismo secreto abrió una base de datos regional llamada Config Store, descrita por Wiz como un directorio que contiene nombres de cuentas de Cosmos DB, identificadores de suscripción y inquilino, configuraciones de red y etiquetas. Un atacante podría usarlo para encontrar las cuentas de una organización específica y luego solicitar sus claves principales.

Ciberseguridad

Wiz dijo que la cadena también podría llegar a cuentas privadas y aisladas de la red porque la puerta de enlace comprometida imponía esos límites de la red desde dentro del servicio. El acceso de escritura de los investigadores a Config Store sugirió que la configuración de red también podría cambiarse, aunque el informe no dice que lo demostraron con la cuenta de otro cliente.

documentación de microsoft dice que los datos de los mensajes de Teams permanecen en Cosmos DB, mientras que un Puesto de ingeniería de Microsoft. dice que Copilot almacena allí las consultas de los usuarios y los historiales de conversaciones. Wiz dijo que las bases de datos que respaldan esos productos eran potencialmente accesibles, pero no informó haber accedido a sus datos.

El registro público no dice cuándo el motor vulnerable y la ruta de la clave de firma entraron en producción o qué período cubrió la revisión del registro de Microsoft. Por lo tanto, se desconoce la duración de la posible exposición, aunque desde entonces se ha cerrado el camino conocido.

La divulgación no incluye ningún identificador CVE ni puntuación de gravedad. CosmosEscape está técnicamente separado de las fallas de ChaosDB y CosMiss reveladas en 2021 y 2022, que involucraron la función Jupyter Notebook de Cosmos DB.

La red se ha convertido en el plano de control de la seguridad de la IA – CYBERDEFENSA.MX
admin Noticias, Trending
La red se ha convertido en el plano de control de la seguridad de la IA – CYBERDEFENSA.MX

Los firewalls de red son los caballos de batalla de la ciberseguridad moderna. Se confía en ellos para proteger la red, bloquear el tráfico malicioso y prevenir intrusiones y violaciones. Y durante décadas, los equipos de seguridad de redes han creado controles en torno a un modelo relativamente estable: los usuarios se conectan a las aplicaciones, las aplicaciones intercambian datos y las herramientas de seguridad inspeccionan paquetes, protocolos y destinos. Los cortafuegos se volvieron excepcionalmente buenos para comprender hacia dónde se dirigía el tráfico y si debía permitirse.

Pero así como la IA está remodelando todos los aspectos del mundo empresarial, también ha tenido un impacto monumental en la forma en que los equipos de seguridad ven el tráfico de la red y el firewall.

La IA está impulsando nuevas dinámicas de red que las políticas de seguridad tradicionales nunca fueron diseñadas para gobernar. Los empleados, las aplicaciones y los agentes envían indicaciones, llaman a modelos, se conectan a servicios y desencadenan acciones en todo el entorno, actividad que la mayoría de los firewalls no pueden ver, y mucho menos comprender. Los agentes de IA interactúan con servicios externos, recuperan información, ejecutan acciones y se comunican cada vez más con otros agentes de forma autónoma.

Reinventando el firewall para la era de la IA

La red es el centro central para el uso de la IA y el único punto de control donde se puede proteger en tiempo real. Y esta nueva realidad exige un nuevo tipo de seguridad de red basada en la IA y diseñada para proteger su red del siempre dinámico panorama de amenazas actual.

Estamos presentando el primero de la industria Cortafuegos de red de IA para ofrecer seguridad de IA integral a nivel de red que proteja el uso de IA de los empleados, las aplicaciones de IA y los agentes de IA directamente desde los firewalls que las organizaciones ya ejecutan. El AI Network Firewall está completamente integrado en Check Point Avión de defensa AIconvirtiendo el firewall existente en una capa de aplicación consciente de la intención para detectar, inspeccionar y controlar la actividad de IA en toda la empresa, incluidas todas las redes, nubes, sucursales y centros de datos de IA.

Abordar la brecha de visibilidad en la empresa de IA

El desafío que enfrentan las organizaciones hoy en día es doble: no sólo se está adoptando rápidamente la IA, sino que también ha cambiado fundamentalmente la naturaleza de la actividad de la red. Los controles de seguridad tradicionales fueron diseñados para inspeccionar conexiones, aplicaciones y flujos de tráfico. Pueden identificar hacia dónde se dirige el tráfico y si se debe permitir una conexión, pero nunca fueron creados para comprender el contexto y la intención detrás de las interacciones de IA.

Esta brecha de visibilidad es un problema creciente. Los empleados envían indicaciones a plataformas de IA generativa, las aplicaciones realizan llamadas modelo entre bastidores y los agentes autónomos se comunican cada vez más con otros sistemas y servicios sin participación humana. Gran parte de esta actividad atraviesa la red empresarial, pero los firewalls convencionales no pueden inspeccionar un mensaje, determinar si se está expuesta información confidencial, controlar las interacciones entre agentes o identificar actividades maliciosas impulsadas por la IA.

Nuestra respuesta a este desafío es una evolución del propio firewall. Para proteger la empresa de IA, los controles de seguridad deben ir más allá de la inspección del tráfico y ser conscientes de la intención. Al comprender indicaciones, interacciones de modelos, cargas de archivos, llamadas API y comportamiento de los agentes en tiempo real, un AI Network Firewall proporciona la visibilidad y el control que las organizaciones necesitan para adoptar la IA a escala de forma segura.

En lugar de tratar la IA como una pila de tecnología aislada, incorpora la gobernanza directamente en el punto de control de la red que ya se encuentra en el camino de la actividad empresarial. Esto permite a los equipos de seguridad prevenir ataques de inyección rápida, detener la filtración de datos, detectar abusos de API, gobernar servidores MCP y mantener una supervisión centralizada del uso de IA entre empleados, aplicaciones y agentes autónomos.

Seguridad que funciona a la velocidad de la IA

La velocidad a la que se está adoptando la IA está creando un segundo desafío: la complejidad operativa. Los equipos de seguridad se esfuerzan por seguir el ritmo de un flujo constante de nuevas aplicaciones de IA, requisitos comerciales cambiantes y amenazas emergentes. Las operaciones de seguridad tradicionales a menudo dependen de traducir las solicitudes comerciales en políticas técnicas, coordinar manualmente los cambios en múltiples sistemas y mantener la coherencia en entornos dispares. A la velocidad de la IA, ese enfoque se vuelve cada vez más insostenible.

Aquí es donde la inteligencia debe extenderse más allá de la aplicación de la ley y abarcar las operaciones. La seguridad de la IA moderna requiere plataformas que puedan simplificar la creación de políticas, automatizar el análisis y la corrección, e integrarse directamente con el contexto empresarial que las organizaciones ya han establecido. La gestión de políticas en lenguaje humano, el análisis de eventos automatizado y la orquestación de agentes permiten a los equipos de seguridad responder más rápido y, al mismo tiempo, reducir el riesgo de error humano.

En lugar de duplicar políticas en múltiples herramientas, las organizaciones pueden aprovechar etiquetas, etiquetas, identidades y clasificaciones de activos existentes en todo su ecosistema tecnológico para aplicar un modelo de control de acceso único y consistente. El resultado es una mayor eficiencia, menos errores operativos y una mayor alineación entre los objetivos de seguridad y las prioridades comerciales.

Escalando la seguridad en toda la empresa moderna

El desafío final es la escala. Los entornos empresariales están más distribuidos que nunca y abarcan centros de datos, nubes públicas, sucursales, implementaciones de SD-WAN, arquitecturas SASE y la propia infraestructura de IA. Los equipos de seguridad deben proteger esta creciente huella manteniendo al mismo tiempo la seguridad que prioriza la prevención, minimizando el tiempo de inactividad y evitando cuellos de botella operativos.

Un firewall de IA consciente de la intención proporciona la base para una seguridad consistente en todos los entornos. A través de la administración centralizada, la aplicación de políticas unificadas, las operaciones automatizadas del ciclo de vida y el monitoreo continuo, las organizaciones pueden extender el mismo nivel de visibilidad, control y protección en toda su infraestructura. Las operaciones de seguridad se vuelven más fáciles de administrar a medida que los entornos crecen, mientras que las políticas siguen siendo consistentes y auditables independientemente de dónde residan las cargas de trabajo de IA o los usuarios.

Proteger lo que viene después: IA, inteligencia y confianza

La próxima generación de firewalls no se limitará a proteger las conexiones. Comprenderán las interacciones de la IA. Dirigida por nuestro nuevo AI Network Firewall, esta capa de seguridad identificará indicaciones, modelará llamadas, solicitudes de agentes y flujos de trabajo impulsados ​​por IA, aplicará políticas dinámicamente basadas en el contexto empresarial y la intención de seguridad, y llevará la gobernanza directamente a la infraestructura de la que ya dependen las organizaciones para proteger sus redes.

En última instancia, el valor no es sólo una mayor seguridad. Está permitiendo a las organizaciones adoptar la IA con confianza y por completo, sin riesgos innecesarios. Los empleados pueden innovar, los desarrolladores pueden crear aplicaciones basadas en inteligencia artificial y los agentes pueden automatizar procesos comerciales, todo ello bajo modelos de gobernanza que brindan visibilidad, responsabilidad y protección.

En una era en la que la IA está transformando la forma en que se realiza el trabajo, el firewall debe transformarse con ella. La red se está convirtiendo en algo más que una capa de transporte. Se está convirtiendo en el plano de control de la seguridad de la IA.

Y las organizaciones que reconozcan este cambio primero estarán en mejor posición para adoptar la IA de forma segura y a escala.

Nota: Este artículo ha sido escrito y contribuido por Aviv Abramovich, vicepresidente de gestión de productos y seguridad de red de Check Point Software.

¿Encontró interesante este artículo? Este artículo es una contribución de uno de nuestros valiosos socios. Síguenos en noticias de google, Gorjeo y LinkedIn para leer más contenido exclusivo que publicamos.