CVE-2026-48282 on DanSec Daily

Cybersecurity Brief – 2026-07-08

Wed, 08 Jul 2026 00:00:00 +0000

Major Incidents or Breaches

Accenture confirmed a security breach after a threat actor claimed to have stolen 35 GB of source code and other data, which was subsequently offered for sale online ^[17].
A small Ohio county reportedly paid $1 million to a cyber extortion group to prevent the public release of sensitive stolen data ^[31].
A critical flaw in GitHub Agentic Workflows was demonstrated to allow unauthenticated attackers to craft issues in public repositories and exfiltrate data from private repositories ^[10]^[27].
Ubiquiti disclosed seven critical vulnerabilities in UniFi OS, including a maximum-severity command injection flaw, and released security updates ^[15].
A hidden authentication backdoor was discovered in multiple Tenda router firmware versions, potentially granting attackers administrative access to the device’s web management panel ^[19].

Newly Discovered Vulnerabilities

Researchers disclosed GhostLock (CVE-2026-43499), a 15-year-old Linux kernel flaw enabling root access and container escape on most unpatched Linux distributions ^[5].
The Januscape vulnerability, a 16-year-old Linux kernel flaw, was revealed to allow virtual machine escape and arbitrary code execution on Intel and AMD systems running KVM ^[23]^[37].
A critical Gitea vulnerability (CVE-2026-20896) is under active exploitation, allowing attackers to bypass authentication with a single HTTP header and access repositories and secrets ^[32].
A critical flaw in Google Dialogflow CX could have allowed attackers with edit rights on one Code Block-enabled agent to compromise other agents in the same Google Cloud project ^[8]^[26].
A critical session isolation vulnerability in the Writer AI platform, now patched, could have exposed session tokens across tenants ^[12].
Four actively exploited vulnerabilities in Adobe, Joomla, and Langflow were added to CISA’s Known Exploited Vulnerabilities catalog due to evidence of active exploitation ^[6].
A recently patched maximum-severity vulnerability (CVE-2026-48282) in Adobe ColdFusion is being actively exploited in the wild ^[16]^[34].

Notable Threat Actor Activity

Chinese threat group UAT-7810 is actively evolving its malware, including the new LONGLEASH variant, to expand their Operational Relay Box (ORB) network by compromising primarily unpatched router devices ^[18].
Suspected China-aligned actors exploited vulnerabilities in Roundcube webmail software to target physics and engineering departments at US and Canadian universities for espionage ^[14].
Iran-linked threat actors have been observed using a modular command and control framework and compromising IT service providers to reach high-value targets in Israel ^[35].
A new Android malware operation, RedWing, is being offered as a bank fraud-as-a-service on Telegram, enabling even low-skill criminals to take over devices and steal banking credentials ^[7].
A Microsoft 365 device code phishing campaign, leveraging collaboration-themed lures and abusing the device-code flow, has been observed targeting M365 accounts since late June 2026 ^[9].
A suspected member of pro-Russian hacktivist groups CyberArmy of Russia Reborn and Z-Pentest was arrested in Spain ^[20].
Scammers are using fake job offers from well-known brands, nested redirects, and phishing tactics to compromise marketing professionals’ Google accounts ^[25]^[40].
New scams on Reddit and Discord are tricking users into giving up login codes through false report claims ^[39].

Trends, Tools, or Tactics of Interest

Attackers are exploiting flaws in GitHub Agentic Workflows by creating public issues to trigger workflows that can leak data from private repositories ^[10]^[27].
ActiveState highlighted that certain attack chains in GitHub Actions can evade traditional CI security scanners, indicating a need for improved governance and detection ^[21].
The RedWing malware-as-a-service model demonstrates increased accessibility of sophisticated Android banking fraud tools via Telegram ^[7].
Phishing campaigns are increasingly using brand impersonation, nested redirects, and fake prompts to evade detection and increase success rates ^[25]^[40].
Scammers are leveraging AI to create convincing fraudulent products, such as fake flowers, and to embed hidden trackers in AI-generated code ^[41]^[42].
CISA is reportedly using Anthropic’s Mythos AI platform to scan government software for vulnerabilities, indicating a trend toward AI-driven security assessments ^[33].
The use of modular malware frameworks by Iran-linked actors and evolving malware by Chinese groups shows a trend toward adaptable, persistent threat infrastructure ^[18]^[35].

Regulatory or Policy Developments Affecting the Security Industry

CISA ordered US federal agencies to patch a maximum-severity Adobe ColdFusion vulnerability by Friday in response to active exploitation ^[16].
Microsoft announced that Windows settings backup and restore will be enabled by default on Microsoft Entra-joined or hybrid-joined enterprise systems after upgrading to Windows 11 26H2 ^[24].

Sources

Accenture confirms breach after hacker offers stolen data for sale - bleepingcomputer.com
County Government Reportedly Paid $1 Million to Cyber Extortion Group - securityweek.com
Public GitHub Issue Could Trick GitHub Agentic Workflows Into Leaking Private Repo Data - thehackernews.com
'GitLost' Flaw Leaks Private Data From GitHub's Agentic Workflows - darkreading.com
Ubiquiti warns of new max severity UniFi OS vulnerability - bleepingcomputer.com
Hidden backdoor in Tenda router firmware grants admin access - bleepingcomputer.com
15-Year-Old GhostLock Flaw Enables Root and Container Escape on Most Linux Distros - thehackernews.com
New Januscape Linux flaw allows VM escape on Intel, AMD devices - bleepingcomputer.com
Linux Kernel Vulnerability Allows VM Escape on Intel and AMD Systems - securityweek.com
Critical Gitea Flaw Under Active Exploitation, Researchers Warn - securityweek.com
Rogue Agent Flaw Could Have Let Attackers Hijack Google Dialogflow CX Chatbots - thehackernews.com
Dialogflow CX 'Rogue Agent' Flaw Enabled AI Chatbot Data Theft - darkreading.com
Writer AI Flaw Could Let Agent Previews Leak Session Tokens Across Tenants - thehackernews.com
CISA Adds 4 Actively Exploited Adobe, Joomla, and Langflow Flaws to KEV - thehackernews.com
CISA orders feds to patch max severity ColdFusion flaw by Friday - bleepingcomputer.com
Critical Adobe ColdFusion Vulnerability Exploited in Attacks - securityweek.com
Chinese hackers develop LONGLEASH malware to expand ORB network - bleepingcomputer.com
Suspected China-Aligned Hackers Exploit Roundcube Flaws Against Universities - thehackernews.com
Iran-Linked Hackers Using Modular C&C Framework in Cyberattacks - securityweek.com
RedWing MaaS Packages Android Bank Fraud as a Telegram Rental Service - thehackernews.com
DEBULL Tooling Abuses Microsoft Device-Code Flow to Target M365 Accounts - thehackernews.com
Spain arrests suspected member of pro-Russian hacktivist groups - bleepingcomputer.com
Big Brand Jobs Scam Targets Marketing Pros' Google Accounts - darkreading.com
Fake Netflix, Coca-Cola, and FIFA job scams target marketers - malwarebytes.com
How the Reddit and Discord false report scam steals accounts - malwarebytes.com
The GitHub Actions Attack Pattern Your CI Security Scanners Miss - bleepingcomputer.com
Claude Code’s hidden tracker was an “experiment,” says Anthropic - malwarebytes.com
Scammers are using AI to sell impossible flowers - malwarebytes.com
CISA Reportedly Using Anthropic’s Mythos to Scan Government Software for Flaws - securityweek.com
Microsoft to enable Windows settings backup by default for orgs - bleepingcomputer.com

Cybersecurity Brief – 2026-07-07

Tue, 07 Jul 2026 00:00:00 +0000

Major Incidents or Breaches

Attackers are actively exploiting a maximum-severity Adobe ColdFusion vulnerability tracked as CVE-2026-48282, enabling remote code execution^[17].
River Bank & Trust, a US financial institution, has experienced a data breach, with customer data exposed^[32].
Armored Likho, an APT group, has gained access to government agencies and electrical power entities in Russia, Brazil, and Kazakhstan using modular RATs and information stealers^[18]^[27].
The NetNut residential proxy botnet, built on millions of hijacked devices and used by criminals, was disrupted through a coordinated operation involving Google, the FBI, and others^[35].

Newly Discovered Vulnerabilities

Several Tenda router firmware versions contain an undocumented authentication backdoor, granting administrative access to attackers^[2].
BeyondTrust patched two critical authentication bypass flaws in Remote Support (RS) and Privileged Remote Access (PRA) products that could allow unauthenticated attackers to gain access^[3]^[11].
A 16-year-old use-after-free bug in Linux’s KVM hypervisor, dubbed ‘Januscape’ (CVE-20xxxx), allows guest VMs to escape to the host on Intel and AMD x86 systems^[5].
Threat actors are probing a critical flaw in Gitea Docker images (CVE-2026-20896), which was recently patched^[6].
Attackers are targeting a newly disclosed memory disclosure flaw in Citrix NetScaler products following the release of a proof-of-concept exploit^[19].
Proof-of-concept code has been released for a root escalation vulnerability in Linux known as ‘Bad Epoll’, increasing the risk of exploitation^[29].

Notable Threat Actor Activity

An Iranian APT group affiliated with Iran’s Ministry of Intelligence and Security has been using a new modular C2 framework, Cavern (also called Cavern Manticore), to target Israeli organizations^[4]^[31].
A suspected China-nexus threat cluster is distributing a fake Indian tax filing utility to deliver DcRAT, targeting Indian taxpayers, tax professionals, and finance teams^[9].
North Korean threat actors have compromised over 100 legitimate open source packages and repositories in the PolinRider campaign to deliver a backdoor and information stealer to developers^[28].
Threat actors are abusing Microsoft Teams voice calls by impersonating IT support to distribute EtherRAT malware for initial access^[14].
Phishing campaigns are impersonating over 30 major brands in fake job interviews to steal Google account credentials from marketing professionals^[13].
Securonix has observed ‘Veil#Drop’ attacks leveraging compromised websites, Blogspot, PowerShell, and fileless techniques to deploy the PureLog information stealer^[25].

Trends, Tools, or Tactics of Interest

Device Code Phishing attacks are leveraging the OAuth 2.0 Device Authorization Grant on Microsoft websites to trick users, bypassing traditional URL-checking defenses^[1].
Researchers demonstrated ‘TrojPix’, a new technique for exfiltrating data from air-gapped systems by manipulating on-screen pixels to transmit information via video cable emissions^[10].
The first complete LLM-driven ransomware attack, dubbed JadePuffer, was reported, where an agentic threat actor exploited a Langflow flaw to steal data and encrypt systems^[20].
Researchers have uncovered prompt injection attacks embedding malicious prompts in websites to trick autonomous AI agents into making unauthorized cryptocurrency payments^[30].
Blogspot-hosted payloads and fileless malware delivery methods are being used in recent sophisticated attack frameworks^[25].
Ongoing discussion on the rapid pace of software development driven by AI and the associated lag in security integration and controls^[16].
The NetNut botnet disruption highlights the prevalence and risks of residential proxy networks built on compromised devices^[35].

Regulatory or Policy Developments Affecting the Security Industry

Vietnamese authorities arrested seven individuals allegedly responsible for operating HiAnime, a major anime piracy streaming service, prior to its shutdown in June^[15].
The Office of Professional Responsibility within ICE has opened over 100 cases investigating incidents of doxing and threats against ICE employees, reflecting increased scrutiny of online threats targeting government personnel^[21].

Sources

Max severity Adobe ColdFusion flaw now exploited in attacks - bleepingcomputer.com
6th July – Threat Intelligence Report - research.checkpoint.com
'BusySnake' Infostealer Slithers into Critical Infrastructure Networks - darkreading.com
Armored Likho APT Targeting Government, Electric Power Entities - securityweek.com
NetNut botnet takes a hit. Don’t be part of the next one. - malwarebytes.com
CERT/CC Warns of Hidden Admin Backdoor in Tenda Router Firmware - thehackernews.com
BeyondTrust Patches Critical Auth Bypass Flaws in Remote Support and PRA - thehackernews.com
BeyondTrust warns of critical flaws in remote access software - bleepingcomputer.com
16-Year-Old Linux KVM Flaw Lets Guest VMs Escape to Host on Intel and AMD x86 Systems - thehackernews.com
Threat Actors Probe Gitea Docker Flaw CVE-2026-20896 13 Days After Disclosure - thehackernews.com
CitrixBleed-ing Again? NetScaler Vulnerability Under Attack - darkreading.com
Proof-of-Concept Exploit Released for Linux ‘Bad Epoll’ Root Access Vulnerability - securityweek.com
Iran-Linked Hackers Use New Cavern C2 Framework to Target Israeli Organizations - thehackernews.com
Cavern Manticore: Exposing Iran-Linked Modular C2 Framework - research.checkpoint.com
Suspected China-Nexus Hackers Use Fake Indian Tax Filing Utility to Deploy DcRAT - thehackernews.com
North Korean Hackers Target Open Source Developers in Supply Chain Attacks - securityweek.com
Fake IT support calls on Microsoft Teams push EtherRAT malware - bleepingcomputer.com
Phishing poses as big-brand job interview to steal Google accounts - bleepingcomputer.com
Blogspot-Hosted Payloads Delivered in ‘Veil#Drop’ Attacks - securityweek.com
When checking the URL isn’t enough: a Device Code Phishing attack via a Microsoft website - securelist.com
New TrojPix Attack Leaks Data From Air-Gapped Systems via Video Cable Emissions - thehackernews.com
JadePuffer: The First Complete LLM-Driven Ransomware Attack - darkreading.com
Prompt Injection Attacks Trick AI Agents Into Making Crypto Payments - securityweek.com
Software Is Now Written at the Speed of Thought. Security Isn't. - bleepingcomputer.com
Vietnam arrests suspects behind HiAnime anime piracy service - bleepingcomputer.com
ICE’s Internal Watchdog Is Now Investigating Online Critics - wired.com