CVE-2026-1731 on DanSec Daily

Cybersecurity Brief – 2026-04-22

Wed, 22 Apr 2026 00:00:00 +0000

Major Incidents or Breaches

French Government Agency Data Breach: France Titres, responsible for issuing administrative documents, confirmed a breach after a hacker claimed to have stolen citizen data and offered it for sale.
Healthcare Data Breaches in the US: Data breaches were reported by Southern Illinois Dermatology, Saint Anthony Hospital, and North Texas Behavioral Health Authority, collectively affecting approximately 600,000 individuals.
Kelp DAO Crypto Heist: North Korean threat actors are attributed to a $290 million theft from Kelp DAO, exploiting LayerZero’s DVN by compromising RPC endpoints and using DDoS attacks to force failover to malicious infrastructure.
Perforce Server Exposures: Over 1,500 Perforce P4 version control servers were found to be unsecured, exposing sensitive data from major organizations.

Cybersecurity Brief – 2026-02-21

Sat, 21 Feb 2026 00:00:00 +0000

Major Incidents or Breaches

Japanese tech company Advantest disclosed a ransomware attack impacting its corporate network, with ongoing investigation into potential compromise of customer and employee data.
The University of Mississippi Medical Center (UMMC) closed all statewide clinics following a ransomware attack.
A data breach at the French bank registry affected 1.2 million accounts, as confirmed by the French Ministry of Finance.
PayPal notified customers of a data breach caused by a software error in a loan application, which exposed sensitive personal information, including Social Security numbers, for nearly six months.
Age verification vendor Persona was found to have left its frontend exposed, enabling access to extensive identity and watchlist screening processes behind a basic age check.
Attackers leveraged Facebook ads to distribute fake Windows 11 downloads, which delivered password-stealing malware targeting credentials and cryptocurrency wallets.

Newly Discovered Vulnerabilities

A critical remote code execution (RCE) vulnerability (CVE-2026-1731) in BeyondTrust Remote Support and Privileged Remote Access products is being actively exploited, including in ransomware attacks. Threat actors have used the flaw to deploy web shells, backdoors, and exfiltrate data. CISA has updated its Known Exploited Vulnerabilities (KEV) catalog accordingly.
Researchers identified a new toolset used by threat actors to scan for React2Shell exposures, targeting high-value networks for exploitation.
A surge in vulnerabilities affecting industrial control systems (ICS) has been reported, increasing risks to operational technology environments.

Notable Threat Actor Activity

A supply chain attack on the open-source Cline CLI (version 2.3.0) resulted in the deployment of OpenClaw, an autonomous AI agent, onto developer systems.
The ClickFix campaign is abusing compromised legitimate websites to deliver a previously undocumented remote access trojan (MIMICRAT), facilitating remote access and control.
The FBI reported a surge in ATM jackpotting attacks across the US, with over 1,900 incidents since 2020 and $20 million stolen in 2025. The Ploutus malware, active for over a decade, remains a primary tool.
A Ukrainian national was sentenced in the US to five years in prison for facilitating North Korea’s fraudulent IT worker scheme, which involved supplying stolen identities to infiltrate US companies.
Japanese-language phishing campaigns continue to target users, indicating ongoing localized social engineering efforts.

Trends, Tools, or Tactics of Interest

Outbound email security incidents in Microsoft 365 environments remain prevalent, with 91% of organizations affected, primarily due to human error.
Threat actors are increasingly exploiting AI-powered agents and manipulating them to bypass security policies and guardrails, as evidenced by incidents involving Microsoft Copilot and other AI models.
The shift-left approach in software development has led to increased security risks, as speed and automation in CI pipelines often override security checks, according to analysis of public container images.
The use of Facebook ads as a vector for malware distribution is increasing, with attackers disguising malicious payloads as legitimate software downloads.
Latin America’s slow pace of cybersecurity upgrades is creating opportunities for initial access brokers and ransomware gangs.
Metadata in official documents, such as PDF files related to sensitive government projects, continues to expose information about authors and contributors.

Regulatory or Policy Developments Affecting the Security Industry

Insurers and regulators are placing increased emphasis on identity posture when assessing cyber risk, with “identity cyber scores” emerging as a new metric influencing cyber insurance policies.
The European Parliament has enacted a ban on certain uses of AI, reflecting a growing regulatory focus on artificial intelligence in security contexts.
The US Department of Homeland Security is pursuing a unified biometric search platform for faces and fingerprints, while reducing centralized privacy reviews and limits on facial recognition technology.
NIST announced a breakthrough in quantum technology with the development of a chip capable of producing single photons, potentially broadening access to quantum key distribution (QKD) for organizations.

Cybersecurity Brief – 2026-02-14

Sat, 14 Feb 2026 00:00:00 +0000

Major Incidents or Breaches

Dutch telecommunications provider Odido disclosed a data breach impacting 6 million customers, with hackers stealing personal information including names, addresses, and phone numbers from a customer contact system.
South Korea fined luxury brands Louis Vuitton, Christian Dior Couture, and Tiffany a combined $25 million for failing to implement adequate security measures, which resulted in unauthorized access and data breaches.
Researchers identified malicious Google Chrome extensions stealing data associated with Meta Business Suite and Facebook Business Manager; a total of 30 credential-stealing Chrome extensions have been uncovered.
Threat actors are abusing Claude LLM artifacts and Google Ads in ClickFix campaigns to deliver infostealer malware to macOS users.
Fake online shops are targeting fans of the Winter Olympics 2026, with nearly 20 fraudulent sites identified selling counterfeit merchandise.

Newly Discovered Vulnerabilities

Researchers observed active exploitation of CVE-2026-1731, a critical unauthenticated remote code execution vulnerability (CVSS 9.9) affecting BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) products. Exploitation began within 24 hours of public PoC release.
CISA flagged a critical Microsoft Configuration Manager (SCCM) vulnerability, patched in October 2024, as being exploited in the wild.
Chrome version 145 patched 11 vulnerabilities, including three high-severity flaws.
CISA warned of active exploitation of vulnerabilities in SolarWinds and Notepad++ products, including a SolarWinds flaw likely exploited as a zero-day since December 2025.

Notable Threat Actor Activity

North Korean threat actors are targeting software developers, particularly those with JavaScript and Python skills, using fake job recruiter campaigns. These campaigns employ social engineering and malicious coding challenges, often related to cryptocurrency, to deliver malware.
Google Threat Intelligence Group attributed malware attacks using the CANFAIL family to a previously undocumented Russian threat actor, targeting Ukrainian organizations.
Several state-sponsored actors from China, Iran, Russia, and North Korea are conducting coordinated cyber operations against the defense industrial base sector. Espionage groups have exploited at least two dozen zero-days in edge devices to infiltrate defense contractors.
A previously unknown threat actor, tracked as UAT-9921, is using a new modular malware framework called VoidLink to target technology and financial services sectors.

Trends, Tools, or Tactics of Interest

Threat actors are exploiting Windows drivers to carry out BYOVD (Bring Your Own Vulnerable Driver) attacks, terminating security processes in targeted networks.
AI agents are increasingly being deployed in coordinated, autonomous “swarms,” amplifying organizational attack surfaces and security complexity.
Integration of external IP-based threat intelligence (e.g., Criminal IP) into SIEM and SOAR platforms like IBM QRadar is enhancing automated detection and response workflows.
Threat actors are leveraging widely used platforms (such as Google Ads and Chrome extensions) for malware delivery and credential theft.
npm completed a major authentication overhaul in December 2025 to harden its supply chain in response to previous incidents.

Regulatory or Policy Developments Affecting the Security Industry

CISA announced new town halls to engage stakeholders on cyber incident reporting requirements for critical infrastructure.
Check Point acquired three Israeli cybersecurity firms-Cyata, Cyclops, and Rotate-reflecting ongoing consolidation in the cybersecurity sector.
South Korean regulatory action against major luxury brands for data protection failures underscores increased enforcement of data security obligations.
The US government (CISA) has issued new directives for federal agencies to secure systems against actively exploited vulnerabilities, including those in Microsoft Configuration Manager.