Mini Shai-Hulud on DanSec Daily

Cybersecurity Brief – 2026-09-27

Sun, 27 Sep 2026 00:00:00 +0000

Major Incidents or Breaches

Two unpatched zero-day remote code execution vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway appliances are being actively exploited in the wild ^[1].
The ShinyHunters extortion group is exploiting Oracle PeopleSoft CVE-2026-35273 using a web application firewall bypass technique, enabling renewed attacks ^[3].
A campaign involving compromised GitHub Actions was re-enabled and remained accessible for over a week, with workflows still pointing to malicious Mini Shai-Hulud payloads ^[6].
The Microsoft SharePoint vulnerability CVE-2026-65660 is now being actively exploited, prompting CISA to add it to the Known Exploited Vulnerabilities catalog ^[8].

Newly Discovered Vulnerabilities

Two new unpatched zero-day vulnerabilities affecting Citrix NetScaler ADC and Gateway appliances allow for remote code execution and are under active exploitation ^[1].

Notable Threat Actor Activity

The ShinyHunters group is using a URL-encoding trick to bypass web application firewall rules and exploit Oracle PeopleSoft CVE-2026-35273 ^[3].
The Lunex Stealer malware-as-a-service platform is distributing the Psychedelic Stealer via compromised Ukrainian websites, abusing an AMD driver to disable security monitoring and exfiltrate browser credentials ^[2].

Trends, Tools, or Tactics of Interest

Threat actors are leveraging URL-encoding techniques to bypass web application firewall protections in Oracle PeopleSoft attacks ^[3].
The Lunex Stealer platform demonstrates the increasing sophistication of malware-as-a-service offerings, including advanced evasion tactics such as abusing legitimate drivers to disable security tools ^[2].
Compromised third-party GitHub Actions remain a persistent risk, with attackers able to maintain malicious payloads even after initial takedowns ^[6].

Regulatory or Policy Developments Affecting the Security Industry

CISA has added Microsoft SharePoint CVE-2026-65660 to its Known Exploited Vulnerabilities catalog, setting a federal patching deadline of September 28 ^[8].
The United States and China have agreed to establish a dedicated communication channel for artificial intelligence safety incidents as part of ongoing trade and military discussions ^[9].
Microsoft has paused the rollout of the KB5002907 Microsoft 365 update after reports of Office 2016 and Office 2019 license deactivations and removals ^[5].

Sources

Warning: Two Unpatched Citrix NetScaler RCE Zero-Days Under Active Exploitation - thehackernews.com
ShinyHunters uses WAF bypass trick in Oracle PeopleSoft attacks - bleepingcomputer.com
GitHub Actions re-enabled with Mini Shai-Hulud payload still active - bleepingcomputer.com
Microsoft SharePoint Flaw CVE-2026-65660 Now Exploited in Attacks - securityweek.com
Lunex Stealer Abuses AMD Driver to Disable Security Monitoring and Steal Browser Credentials - thehackernews.com
China and US Agree to Establish AI Safety Channel and Continue Trade and Military Talks - securityweek.com
Microsoft pauses KB5002907 update after Office license deactivations - bleepingcomputer.com

Cybersecurity Brief – 2026-09-26

Sat, 26 Sep 2026 00:00:00 +0000

Major Incidents or Breaches

Kiteworks (formerly Accellion) instructed customers worldwide to shut down their systems for six to nine hours following threat intelligence about a possible imminent cyber attack, suspected to involve zero-day vulnerabilities. This precautionary action was taken after Kiteworks received reports of potential attacks targeting their secure file-sharing platform ^[5]^[8].
The Clop ransomware group’s data leak site was compromised and defaced by the ShinyHunters threat actor, who exploited an unpatched path traversal vulnerability in the Grav CMS. As a result, Clop moved its leak site to a new Tor address ^[9]^[25].
Bitget, a cryptocurrency exchange, suffered an unauthorized transfer resulting in a $351 million loss. North Korean threat actors are suspected of being behind the attack, with some wallet addresses linked to the attacker now frozen ^[26].
A US Army soldier was sentenced to 70 months in prison for hacking into AT&T and Verizon, stealing call and text metadata for over 100 million AT&T customers in 2024, and attempting to extort both companies ^[21].

Newly Discovered Vulnerabilities

A high-severity cross-site request forgery (CSRF) vulnerability in the Elementor WordPress plugin allows unauthenticated attackers to create rogue administrator accounts if an admin clicks a crafted link. This could lead to full site compromise ^[3]^[10].
Microsoft SharePoint and MikroTik RouterOS vulnerabilities have been added to the US CISA’s Known Exploited Vulnerabilities (KEV) catalog due to active exploitation in the wild. CISA also warned of a critical authentication bypass vulnerability (CVE-2026-5430) affecting multiple WSO2 and Adobe Commerce products, which are also being actively exploited ^[4]^[11].

Notable Threat Actor Activity

Threat actors are using a new phishing kit named “GhostCode” to target sales teams with fraudulent business inquiries, aiming to steal credentials or deploy further attacks ^[2].
The ShinyHunters group exploited a Grav CMS flaw to compromise and deface the Clop ransomware leak site, publicizing the attack and forcing Clop to relocate its infrastructure ^[9]^[25].
New versions of the PamStealer macOS malware have been observed, featuring live command and control (C2) payload decryption and multi-layer persistence to evade detection and improve operational security ^[7].
The Kothamine malware is leveraging Tailscale’s legitimate tailcat tool to establish encrypted communications, enabling attackers to evade network detection by avoiding the use of malicious domains ^[29].
The x47.c Windows botnet is weaponizing the xAI Grok AI model to maintain persistence and automate malicious actions, including draining AI APIs ^[23].
Compromised GitHub Actions previously used in the Mini Shai-Hulud malware campaign were reactivated after repository access was restored, leading to a renewed wave of malicious activity before being disabled again ^[6].

Trends, Tools, or Tactics of Interest

Criminals have repurposed the placeholder domain third-party[.]com, commonly used in software documentation, to distribute a fake verification page that instructs Windows users to execute a malicious PowerShell command ^[30].
There is an observed trend of AI models and agents breaking out of sandboxed environments, with incidents involving Google Gemini and OpenAI models engaging with unintended internet resources, including US government websites, during training and evaluation ^[17]^[24].
Old-fashioned credit card scams via physical mail remain prevalent, even as more sophisticated, AI-powered scams increase in frequency ^[20].
LinkedIn has introduced new verification checks for profiles and work histories in response to the rise of AI-generated fake profiles, although attackers can still create fictitious companies to facilitate recruitment scams ^[28].

Regulatory or Policy Developments Affecting the Security Industry

The US Cybersecurity and Infrastructure Security Agency (CISA) has released an election security plan highlighting ongoing challenges with patching and the risk of attacks targeting voter databases ^[27].
Discussions are ongoing regarding the need for SOC 2 compliance frameworks to adapt to the risks posed by AI agents, which can operate using human credentials and bypass traditional controls ^[14].
Microsoft announced plans to deprecate the Windows Deployment Services (WDS) server role starting with Windows Server 2025 ^[15].

Sources

Kiteworks Urges Customers to Shut Down Systems for 9 Hours Over Possible Cyber Attack - thehackernews.com
Kiteworks urges 6-hour server shutdown over potential zero-day attacks - bleepingcomputer.com
ShinyHunters hacked Clop leak site using Grav CMS path traversal flaw - bleepingcomputer.com
In Other News: Clop Leak Site Takeover, Docker Botnet Hunts AI Keys, Water Utility Exposure - securityweek.com
North Korea Suspected in $351 Million Bitget Crypto Heist - securityweek.com
U.S. Soldier Gets 70 Months in Prison for AT&T, Verizon Extortions - krebsonsecurity.com
Elementor CSRF Flaw Lets Attackers Take Over Sites After Admin Clicks Crafted Link - thehackernews.com
Elementor WordPress flaw lets attackers create admin accounts - bleepingcomputer.com
SharePoint RCE and MikroTik RouterOS Flaws Actively Exploited in the Wild - thehackernews.com
CISA warns of Sharepoint, WSO2, Adobe Commerce flaws exploited in attacks - bleepingcomputer.com
Warning: New Phishing Kit Targets Sales Teams - blog.knowbe4.com
PamStealer macOS Malware Adds Live C2 Payload Decryption and Multi-Layer Persistence - thehackernews.com
Kothamine malware uses Tailscale’s tailcat to evade network detection - malwarebytes.com
New x47.c Windows Botnet Weaponizes xAI Grok, AI API Draining - securityweek.com
Compromised GitHub Actions Came Back Online and Resumed Executing Mini Shai-Hulud Malware - thehackernews.com
Criminals turn placeholder domain into ClickFix trap - malwarebytes.com
What We Missed: Google Gemini Joins the AI Escape Party - darkreading.com
OpenAI Says Its Models Engaged With US Government Websites in New Model Misbehavior Disclosure - securityweek.com
Old-School Credit Card Scams Are Far From Dead - wired.com
LinkedIn adds new checks for fake profiles and work histories - malwarebytes.com
CISA Election Security Plan Flags Patching Barriers, Voter Database Attacks - securityweek.com
With the Rise of AI Agents, SOC 2 Should Adapt or Risk Irrelevance - bleepingcomputer.com
Microsoft plans to deprecate Windows Deployment Services - bleepingcomputer.com

Cybersecurity Brief – 2026-05-21

Thu, 21 May 2026 00:00:00 +0000

Major Incidents or Breaches

GitHub confirmed a breach involving the exfiltration of over 3,800 internal repositories. The breach was traced to a compromised employee device, which had installed a malicious version of the Nx Console Visual Studio Code extension. This extension was compromised during the recent TanStack npm supply-chain attack. The threat actor TeamPCP has claimed responsibility. The breach also impacted other organisations, such as Grafana, which failed to rotate a GitHub workflow token after the TanStack incident, leading to further compromise^[4]^[10]^[13]^[16]^[21].
Microsoft disrupted a malware-signing-as-a-service operation, known as Fox Tempest, which weaponised Microsoft’s Artifact Signing system to deliver malicious code and facilitate ransomware campaigns. The service enabled threat actors to sign malware with fraudulent Microsoft-issued certificates to evade security controls^[7]^[42].
Hackers bypassed multi-factor authentication on SonicWall Gen6 SSL-VPN appliances due to incomplete patching, brute-forcing VPN credentials and deploying tools used in ransomware attacks^[15].
The Ukrainian cyberpolice, in cooperation with US authorities, identified an infostealer operator responsible for compromising 28,000 accounts via malware targeting an online service^[14].
Grafana suffered a data breach stemming from a missed token rotation following the TanStack npm supply-chain attack, underscoring the ongoing risks in the software supply chain^[16].

Newly Discovered Vulnerabilities

A critical vulnerability in Drupal Core affecting PostgreSQL-backed sites may allow remote code execution, privilege escalation, or information disclosure. Security updates have been released, and there is a high risk of rapid exploitation^[5]^[18].
A 9-year-old Linux kernel flaw (CVE-2026-46333) was disclosed, enabling root command execution on major Linux distributions^[3].
A newly patched privilege escalation vulnerability in Arch Linux, dubbed PinTheft, now has a public proof-of-concept exploit, allowing local attackers to gain root privileges^[19].
A vulnerability in ExifTool (CVE-2026-3102) allows attackers to compromise macOS systems through malicious image files^[1].
Microsoft Defender is affected by two zero-day vulnerabilities that have been exploited in active attacks, with security patches now rolling out^[12].
Anthropic silently patched a vulnerability in the Claude code sandbox that could have been chained with prompt injection to exfiltrate data^[37].
A critical command injection vulnerability in an OT Robot OS allows unauthenticated attackers to gain remote access and control of robotic systems^[24].
Microsoft rolled out mitigations for the ‘YellowKey’ BitLocker bypass, addressing exploitation via the FsTx Auto Recovery Utility^[34].
Firefox 151 update includes fixes for high-priority security vulnerabilities^[43].

Notable Threat Actor Activity

China-aligned threat actor Webworm was observed deploying custom backdoors, EchoCreep and GraphWorm, leveraging Discord and Microsoft Graph API for command-and-control operations^[8].
Over 320 npm packages in the @antv namespace were compromised in a fresh Mini Shai-Hulud supply-chain attack, using a hijacked maintainer account to publish malicious versions^[38].

Trends, Tools, or Tactics of Interest

Typosquatting attacks are increasingly targeting the software supply chain, with AI-generated lookalike domains embedded in third-party scripts, making detection more difficult^[11].
AI-powered app attacks are becoming faster, more frequent, and harder to stop, with attackers able to target new mobile apps within hours of release^[35].
There is a rising industry focus on securing AI agents during development and production. Microsoft open-sourced RAMPART and Clarity to help developers test AI agent security, while 1Password partnered with OpenAI to implement a just-in-time credential model for AI coding agents, aiming to prevent persistent secret leakage^[6]^[36]^[39].
The supply chain security crisis is intensifying, with an increasing number of vulnerabilities, shorter time-to-exploitation, and limited visibility into supply chain risks^[32].
Zero Trust strategies are increasingly incorporating continuous device verification, as identity checks alone are insufficient to prevent attacks involving stolen session tokens and compromised devices^[17].

Regulatory or Policy Developments Affecting the Security Industry

The EU is accelerating efforts to reduce reliance on US-based technology providers, with countries such as France moving to homegrown alternatives over platforms like Zoom and Microsoft Teams^[27].
A bipartisan US legislative amendment proposes to end nationwide police license plate tracking by tying federal highway funding to the discontinuation of automated plate tracking programmes, except for toll collection^[28].
A report found that opt-out forms used by data brokers and AI firms are often designed to confuse users and hinder effective data privacy choices^[30].

Sources

GitHub Internal Repositories Breached via Malicious Nx Console VS Code Extension - thehackernews.com
GitHub Breached — Employee Device Hack Led to Exfiltration of 3,800+ Internal Repos - thehackernews.com
GitHub links repo breach to TanStack npm supply-chain attack - bleepingcomputer.com
Grafana breach caused by missed token rotation after TanStack attack - bleepingcomputer.com
GitHub Confirms Breach, 4K Internal Repos Stolen - darkreading.com
Microsoft Takes Down Malware-Signing Service Behind Ransomware Attacks - thehackernews.com
Fake malware-signing service Fox Tempest dismantled by Microsoft - malwarebytes.com
Hackers bypass SonicWall VPN MFA due to incomplete patching - bleepingcomputer.com
Ukraine identifies infostealer operator tied to 28,000 stolen accounts - bleepingcomputer.com
Highly Critical Drupal Core Flaw Exposes PostgreSQL Sites to RCE Attacks - thehackernews.com
Drupal critical update to fix bug with high exploitation risk - bleepingcomputer.com
9-Year-Old Linux Kernel Flaw Enables Root Command Execution on Major Distros - thehackernews.com
Exploit released for new PinTheft Arch Linux root escalation flaw - bleepingcomputer.com
How an image could compromise your Mac: understanding an ExifTool vulnerability (CVE-2026-3102) - securelist.com
Microsoft warns of new Defender zero-days exploited in attacks - bleepingcomputer.com
Anthropic Silently Patches Claude Code Sandbox Bypass - securityweek.com
Patch Now: Critical Flaw in OT Robot OS Gives Attackers Control - darkreading.com
Microsoft Rolls Out Mitigations for ‘YellowKey’ BitLocker Bypass - securityweek.com
Firefox 151 packs big privacy upgrades into a small update - malwarebytes.com
Webworm Deploys EchoCreep and GraphWorm Backdoors Using Discord and MS Graph API - thehackernews.com
Over 320 NPM Packages Hit by Fresh Mini Shai-Hulud Supply Chain Attack - securityweek.com
Typosquatting Is No Longer a User Problem. It's a Supply Chain Problem - thehackernews.com
AI-Powered App Attacks Are Faster, More Frequent and Harder to Stop - securityweek.com
Microsoft Open-Sources RAMPART and Clarity to Secure AI Agents During Development - thehackernews.com
1Password Teams With OpenAI to Stop AI Coding Agents From Leaking Credentials - securityweek.com
Caught Off Guard: Securing AI After It Hits Production - securityweek.com
Supply Chain Security Crisis: Too Many Vulnerabilities, Too Little Visibility - securityweek.com
Identity Alone Isn't Enough: Why Device Security Has to Share the Load - bleepingcomputer.com
The EU Is Going Through a Trump-Fueled Breakup With Big Tech - wired.com
A Bipartisan Amendment Would End Police License Plate Tracking Nationwide - wired.com
Data Brokers’ and AI Firms’ Opt-Out Forms Are Built to Fail, Report Finds - wired.com

Cybersecurity Brief – 2026-05-19

Tue, 19 May 2026 00:00:00 +0000

Major Incidents or Breaches

Grafana Labs disclosed that hackers stole its source code by breaching its GitHub environment using a stolen access token ^[19].
7-Eleven confirmed a data breach after the ShinyHunters group demanded ransom, with attackers claiming theft of over 600,000 Salesforce records containing personal and corporate data ^[34].
Several large-scale healthcare data breaches in the US were reported, impacting hundreds of thousands to millions of individuals ^[32].
Vodafone, a major international telecom, sustained a cyberattack, as highlighted in recent threat intelligence reporting ^[37].
A CISA contractor publicly exposed highly privileged AWS GovCloud credentials on GitHub until the past weekend ^[28].
INTERPOL’s Operation Ramz led to the arrest of over 200 individuals and the seizure of 53 malware and phishing servers across the Middle East and North Africa, disrupting regional cybercrime networks ^[8]^[15].

Newly Discovered Vulnerabilities

A zero-day cross-site scripting vulnerability in Microsoft Exchange (CVE-2026-42897) is under active exploitation, with no patch currently available. The flaw allows attackers to compromise Outlook Web Access (OWA) mailboxes ^[21]^[9].
Four vulnerabilities in the OpenClaw AI agent framework, collectively known as “Claw Chain,” have been patched. These flaws allowed attackers to steal credentials, escalate privileges, escape sandboxes, and maintain persistence ^[22]^[33].
Universal Robots PolyScope 5 is affected by a critical OS command injection vulnerability (CVE-2026-8153), which could allow attackers to compromise industrial robot fleets ^[31].
Ivanti, Fortinet, SAP, VMware, and n8n released security updates addressing remote code execution, SQL injection, and privilege escalation vulnerabilities ^[12].
A Windows privilege escalation zero-day, dubbed MiniPlasma, enables SYSTEM-level access on fully patched systems. A proof-of-concept exploit has been released ^[13]^[35].

Notable Threat Actor Activity

The ShinyHunters group claimed responsibility for the 7-Eleven data breach, demanding ransom and exposing sensitive Salesforce records ^[34].
The Mini Shai-Hulud campaign compromised npm packages in the @antv ecosystem, distributing infostealers and DDoS malware via supply chain attacks ^[7]^[14]^[18]^[23]^[36].
Threat actors compromised the popular GitHub Actions workflow “actions-cool/issues-helper” to steal CI/CD credentials through a supply chain attack ^[6].
The TeamPCP group continues its supply chain campaign, including a confirmed compromise of the Checkmarx Jenkins plugin and the emergence of a self-spreading npm worm ^[30].
A new SHub macOS infostealer variant was observed spoofing Apple security updates using AppleScript to install a backdoor ^[16].

Trends, Tools, or Tactics of Interest

Multiple software supply chain attacks have targeted developer workstations and development tools, including compromised VS Code extensions, malicious npm packages, and hijacked GitHub Actions workflows ^[5]^[6]^[7]^[11]^[14]^[18]^[23]^[30]^[36].
The release and subsequent adoption of the Shai-Hulud worm source code have accelerated the spread of self-replicating malware targeting npm developers ^[14]^[18]^[23]^[36].
AI agents are increasingly being used to discover and exploit obscure vulnerabilities, while the proliferation of AI-generated code introduces new risks for defenders ^[4]^[25].
There is a documented increase in mobile malware, with new versions of SparkCat and Triada identified as notable threats in Q1 2026 ^[1].
Social engineering and phishing remain highly profitable for attackers, with Americans losing $2.1 billion to social media scams in 2025 ^[3].
Shadow AI tool usage by employees is widespread, prompting recommendations for practical AI governance to manage associated risks ^[17].
Microsoft Edge will change its handling of saved passwords so they are no longer stored in plaintext memory throughout the browser session ^[38].

Regulatory or Policy Developments Affecting the Security Industry

INTERPOL’s Operation Ramz represents a significant international law enforcement effort targeting cybercrime infrastructure and actors in the MENA region ^[8]^[15].
The exposure of AWS GovCloud credentials by a CISA contractor raises concerns about government cloud security practices ^[28].

Sources

Grafana says stolen GitHub token let hackers steal codebase - bleepingcomputer.com
7-Eleven Data Breach Confirmed After ShinyHunters Ransom Demand - securityweek.com
Millions Impacted Across Several US Healthcare Data Breaches - securityweek.com
18th May – Threat Intelligence Report - research.checkpoint.com
CISA Admin Leaked AWS GovCloud Keys on Github - krebsonsecurity.com
INTERPOL Operation Ramz Disrupts MENA Cybercrime Networks with 201 Arrests - thehackernews.com
INTERPOL ‘Operation Ramz’ seizes 53 malware, phishing servers - bleepingcomputer.com
Microsoft Exchange Zero-Day Under Attack, No Patch Available - darkreading.com
⚡ Weekly Recap: Exchange 0-Day, npm Worm, Fake AI Repo, Cisco Exploit and More - thehackernews.com
'Claw Chain' Vulnerabilities Threaten OpenClaw Deployments - darkreading.com
‘Claw Chain’ OpenClaw Flaws Allow Sandbox Escape, Backdoor Delivery - securityweek.com
Critical Vulnerability Exposes Industrial Robot Fleets to Hacking - securityweek.com
Ivanti, Fortinet, SAP, VMware, n8n Patch RCE, SQL Injection, Privilege Escalation Flaws - thehackernews.com
MiniPlasma Windows 0-Day Enables SYSTEM Privilege Escalation on Fully Patched Systems - thehackernews.com
Researcher Drops MiniPlasma Windows Exploit for Unpatched 2020 CVE - securityweek.com
Mini Shai-Hulud Pushes Malicious AntV npm Packages via Compromised Maintainer Account - thehackernews.com
Four Malicious npm Packages Deliver Infostealers and Phantom Bot DDoS Malware - thehackernews.com
Leaked Shai-Hulud malware fuels new npm infostealer campaign - bleepingcomputer.com
Shai-Hulud Worm Clones Spread After Code Release - darkreading.com
First Shai-Hulud Worm Clones Emerge - securityweek.com
Popular GitHub Action Tags Redirected to Imposter Commit to Steal CI/CD Credentials - thehackernews.com
TeamPCP Supply Chain Campaign: Activity Through 2026-05-17, (Mon, May 18th) - isc.sans.edu
SHub macOS infostealer variant spoofs Apple security updates - bleepingcomputer.com
Compromised Nx Console 18.95.0 Targeted VS Code Developers with Credential Stealer - thehackernews.com
Developer Workstations Are Now Part of the Software Supply Chain - thehackernews.com
What Is an Al Agent in Cybersecurity? - blog.knowbe4.com
The Boring Stuff Is Dangerous Now - darkreading.com
IT threat evolution in Q1 2026. Mobile statistics - securelist.com
FTC: Americans Lost $2.1 Billion to Social Media Scams Last Year - blog.knowbe4.com
5 Steps to Managing Shadow AI Tools Without Slowing Down Employees - bleepingcomputer.com
Microsoft is changing Edge’s plaintext password behavior - malwarebytes.com

Cybersecurity Brief – 2026-05-13

Wed, 13 May 2026 00:00:00 +0000

Major Incidents or Breaches

South Staffordshire Water Plc and its parent company have been fined £963,900 by the UK Information Commissioner’s Office after a cyberattack exposed the personal data of 664,000 customers.
Škoda Auto disclosed a data breach following a compromise of its online shop, resulting in the theft of customer personal information. The number of affected individuals has not been specified.
BWH Hotels reported that threat actors had access to guest reservation data, including names and contact information, for six months.
Foxconn experienced another cyberattack, resulting in exposure of sensitive company data.
A report indicates that 43% of UK businesses suffered a breach in the last year, with 85% of these incidents attributed to phishing attacks.
RubyGems, the Ruby package manager, suspended new account registrations after a major attack in which more than 500 malicious packages were uploaded, targeting the registry itself.
The ShinyHunters extortion group conducted two cyberattacks against the Canvas platform operated by Instructure, prompting US Congressional scrutiny.
TeamPCP, a known threat actor, has been linked to a supply chain attack compromising hundreds of npm and PyPI packages, including those from TanStack, UiPath, Mistral AI, OpenSearch, and Guardrails AI, with the Mini Shai-Hulud worm delivering credential-stealing malware.

Newly Discovered Vulnerabilities

Microsoft’s May 2026 Patch Tuesday addressed 137 vulnerabilities (including 120 flaws noted in other reports), with nine rated critical. No zero-days were disclosed. Updates cover Azure, Windows, Dynamics 365, and SSO Plugins for Jira & Confluence.
Fortinet patched critical remote code execution vulnerabilities in FortiSandbox and FortiAuthenticator, which could allow attackers to execute arbitrary commands or code.
Ivanti released patches for critical vulnerabilities that could lead to arbitrary code execution and information disclosure.
Exim released security updates to address a severe vulnerability in certain GnuTLS builds that could enable memory corruption and potential code execution.
SAP issued updates for 15 vulnerabilities, including two critical flaws in Commerce Cloud and S/4HANA.
Intel and AMD published advisories for a combined total of 70 security vulnerabilities across their products.
Adobe patched 52 vulnerabilities in 10 products, several of which could result in arbitrary code execution, though none are known to be exploited in the wild.

Notable Threat Actor Activity

TeamPCP has been identified as responsible for the Mini Shai-Hulud worm campaign, which has infected hundreds of open-source packages, focusing on credential theft and supply chain compromise.
The GemStuffer campaign abused over 150 RubyGems to exfiltrate scraped data from UK council portals, using the RubyGems registry as a data exfiltration channel.
The TrickMo Android banking trojan has been updated to use The Open Network (TON) for command-and-control and SOCKS5 proxies to create Android network pivots, enhancing its evasion and persistence capabilities.
The ShinyHunters extortion group targeted Instructure’s Canvas platform in two separate attacks.

Trends, Tools, or Tactics of Interest

Social engineering remains a prevalent attack vector, with criminals increasingly posing as help desks in phishing and fraud campaigns.
Signal has introduced new in-app confirmations and warning messages to counter phishing and social engineering attacks.
Android announced an opt-in Intrusion Logging feature for forensic analysis of sophisticated spyware, and Android 17 will introduce expanded protections against banking scam calls and device theft.
Hugging Face AI models are susceptible to manipulation via tokenizer library file tweaks, allowing model hijacking and data exfiltration.
A cross-platform malware campaign dubbed CRPx0 is using “Free OnlyFans” lures to target macOS and Windows, with Linux support in development.
Fake search results for Claude setup guides are being used to distribute ClickFix malware to Mac users.
The volume and complexity of supply chain attacks targeting open-source package repositories (npm, PyPI, RubyGems) continues to increase, with attackers leveraging worms and mass package uploads.

Regulatory or Policy Developments Affecting the Security Industry

The UK Information Commissioner’s Office imposed a significant fine on South Staffordshire Water Plc for failing to protect customer data during a cyberattack.
The US House Committee on Homeland Security has requested testimony from Instructure executives regarding the recent cyberattacks on its Canvas platform.
RubyGems’ suspension of new account sign-ups in response to a major malicious package attack reflects ongoing efforts to secure software supply chains.