Major Incidents or Breaches

  • Accenture confirmed a security breach after a threat actor claimed to have stolen 35 GB of source code and other data, which was subsequently offered for sale online [17].
  • A small Ohio county reportedly paid $1 million to a cyber extortion group to prevent the public release of sensitive stolen data [31].
  • A critical flaw in GitHub Agentic Workflows was demonstrated to allow unauthenticated attackers to craft issues in public repositories and exfiltrate data from private repositories [10][27].
  • Ubiquiti disclosed seven critical vulnerabilities in UniFi OS, including a maximum-severity command injection flaw, and released security updates [15].
  • A hidden authentication backdoor was discovered in multiple Tenda router firmware versions, potentially granting attackers administrative access to the device’s web management panel [19].

Newly Discovered Vulnerabilities

  • Researchers disclosed GhostLock (CVE-2026-43499), a 15-year-old Linux kernel flaw enabling root access and container escape on most unpatched Linux distributions [5].
  • The Januscape vulnerability, a 16-year-old Linux kernel flaw, was revealed to allow virtual machine escape and arbitrary code execution on Intel and AMD systems running KVM [23][37].
  • A critical Gitea vulnerability (CVE-2026-20896) is under active exploitation, allowing attackers to bypass authentication with a single HTTP header and access repositories and secrets [32].
  • A critical flaw in Google Dialogflow CX could have allowed attackers with edit rights on one Code Block-enabled agent to compromise other agents in the same Google Cloud project [8][26].
  • A critical session isolation vulnerability in the Writer AI platform, now patched, could have exposed session tokens across tenants [12].
  • Four actively exploited vulnerabilities in Adobe, Joomla, and Langflow were added to CISA’s Known Exploited Vulnerabilities catalog due to evidence of active exploitation [6].
  • A recently patched maximum-severity vulnerability (CVE-2026-48282) in Adobe ColdFusion is being actively exploited in the wild [16][34].

Notable Threat Actor Activity

  • Chinese threat group UAT-7810 is actively evolving its malware, including the new LONGLEASH variant, to expand their Operational Relay Box (ORB) network by compromising primarily unpatched router devices [18].
  • Suspected China-aligned actors exploited vulnerabilities in Roundcube webmail software to target physics and engineering departments at US and Canadian universities for espionage [14].
  • Iran-linked threat actors have been observed using a modular command and control framework and compromising IT service providers to reach high-value targets in Israel [35].
  • A new Android malware operation, RedWing, is being offered as a bank fraud-as-a-service on Telegram, enabling even low-skill criminals to take over devices and steal banking credentials [7].
  • A Microsoft 365 device code phishing campaign, leveraging collaboration-themed lures and abusing the device-code flow, has been observed targeting M365 accounts since late June 2026 [9].
  • A suspected member of pro-Russian hacktivist groups CyberArmy of Russia Reborn and Z-Pentest was arrested in Spain [20].
  • Scammers are using fake job offers from well-known brands, nested redirects, and phishing tactics to compromise marketing professionals’ Google accounts [25][40].
  • New scams on Reddit and Discord are tricking users into giving up login codes through false report claims [39].

Trends, Tools, or Tactics of Interest

  • Attackers are exploiting flaws in GitHub Agentic Workflows by creating public issues to trigger workflows that can leak data from private repositories [10][27].
  • ActiveState highlighted that certain attack chains in GitHub Actions can evade traditional CI security scanners, indicating a need for improved governance and detection [21].
  • The RedWing malware-as-a-service model demonstrates increased accessibility of sophisticated Android banking fraud tools via Telegram [7].
  • Phishing campaigns are increasingly using brand impersonation, nested redirects, and fake prompts to evade detection and increase success rates [25][40].
  • Scammers are leveraging AI to create convincing fraudulent products, such as fake flowers, and to embed hidden trackers in AI-generated code [41][42].
  • CISA is reportedly using Anthropic’s Mythos AI platform to scan government software for vulnerabilities, indicating a trend toward AI-driven security assessments [33].
  • The use of modular malware frameworks by Iran-linked actors and evolving malware by Chinese groups shows a trend toward adaptable, persistent threat infrastructure [18][35].

Regulatory or Policy Developments Affecting the Security Industry

  • CISA ordered US federal agencies to patch a maximum-severity Adobe ColdFusion vulnerability by Friday in response to active exploitation [16].
  • Microsoft announced that Windows settings backup and restore will be enabled by default on Microsoft Entra-joined or hybrid-joined enterprise systems after upgrading to Windows 11 26H2 [24].

Sources#

  1. Accenture confirms breach after hacker offers stolen data for sale - bleepingcomputer.com
  2. County Government Reportedly Paid $1 Million to Cyber Extortion Group - securityweek.com
  3. Public GitHub Issue Could Trick GitHub Agentic Workflows Into Leaking Private Repo Data - thehackernews.com
  4. 'GitLost' Flaw Leaks Private Data From GitHub's Agentic Workflows - darkreading.com
  5. Ubiquiti warns of new max severity UniFi OS vulnerability - bleepingcomputer.com
  6. Hidden backdoor in Tenda router firmware grants admin access - bleepingcomputer.com
  7. 15-Year-Old GhostLock Flaw Enables Root and Container Escape on Most Linux Distros - thehackernews.com
  8. New Januscape Linux flaw allows VM escape on Intel, AMD devices - bleepingcomputer.com
  9. Linux Kernel Vulnerability Allows VM Escape on Intel and AMD Systems - securityweek.com
  10. Critical Gitea Flaw Under Active Exploitation, Researchers Warn - securityweek.com
  11. Rogue Agent Flaw Could Have Let Attackers Hijack Google Dialogflow CX Chatbots - thehackernews.com
  12. Dialogflow CX 'Rogue Agent' Flaw Enabled AI Chatbot Data Theft - darkreading.com
  13. Writer AI Flaw Could Let Agent Previews Leak Session Tokens Across Tenants - thehackernews.com
  14. CISA Adds 4 Actively Exploited Adobe, Joomla, and Langflow Flaws to KEV - thehackernews.com
  15. CISA orders feds to patch max severity ColdFusion flaw by Friday - bleepingcomputer.com
  16. Critical Adobe ColdFusion Vulnerability Exploited in Attacks - securityweek.com
  17. Chinese hackers develop LONGLEASH malware to expand ORB network - bleepingcomputer.com
  18. Suspected China-Aligned Hackers Exploit Roundcube Flaws Against Universities - thehackernews.com
  19. Iran-Linked Hackers Using Modular C&C Framework in Cyberattacks - securityweek.com
  20. RedWing MaaS Packages Android Bank Fraud as a Telegram Rental Service - thehackernews.com
  21. DEBULL Tooling Abuses Microsoft Device-Code Flow to Target M365 Accounts - thehackernews.com
  22. Spain arrests suspected member of pro-Russian hacktivist groups - bleepingcomputer.com
  23. Big Brand Jobs Scam Targets Marketing Pros' Google Accounts - darkreading.com
  24. Fake Netflix, Coca-Cola, and FIFA job scams target marketers - malwarebytes.com
  25. How the Reddit and Discord false report scam steals accounts - malwarebytes.com
  26. The GitHub Actions Attack Pattern Your CI Security Scanners Miss - bleepingcomputer.com
  27. Claude Code’s hidden tracker was an “experiment,” says Anthropic - malwarebytes.com
  28. Scammers are using AI to sell impossible flowers - malwarebytes.com
  29. CISA Reportedly Using Anthropic’s Mythos to Scan Government Software for Flaws - securityweek.com
  30. Microsoft to enable Windows settings backup by default for orgs - bleepingcomputer.com