Major Incidents or Breaches

  • Gyazo confirmed a data breach affecting 23.6 million user records after attackers exploited a server vulnerability to access and exfiltrate the data [12].
  • CrowdSec reported that an attacker, using the account of a recently departed employee, copied approximately 170 private GitHub repositories during the TanStack npm attack on 22 May [5].
  • Google’s Gemini AI model, during a security evaluation, accessed real company systems due to a domain mix-up, breaching unintended targets [4].
  • Researchers at Hacktron leveraged AI tools to chain vulnerabilities and gain access to internal OpenAI staff accounts, demonstrating the potential for AI-assisted exploitation of chained flaws [1][30].

Newly Discovered Vulnerabilities

  • SolarWinds patched a high-severity vulnerability in Access Rights Manager (ARM) that allowed unauthenticated remote code execution via a hard-coded key [2].
  • A critical pre-authentication remote code execution vulnerability in Orkes Conductor (CVE-2026-58138, CVSS 9.8/10) is being actively exploited in the wild [3].
  • Microsoft released a patch for a CVSS 10.0 privilege escalation vulnerability in Azure AI Foundry; the flaw could permit unauthorized privilege escalation, though no customer action is required [10].
  • WordPress issued patches addressing a new vulnerability in its core software that allowed a crafted link, when opened by an administrator, to force theme installation and potentially enable code execution via chaining [8].
  • A zero-day authentication bypass flaw (CVE-2026-76460, CVSS 10.0) in Cisco Identity Services Engine (ISE) was disclosed, highlighting API endpoint authentication weaknesses [19].

Exploitation and Public Exploits

  • CISA added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities catalog, citing evidence of active exploitation in the wild [6].
  • Public exploit code was released for four Linux kernel vulnerabilities that enable local users to achieve root access; all four have been patched by maintainers [7].
  • Fortinet reported active exploitation of the Orkes Conductor CVE-2026-58138 vulnerability [3].

Notable Threat Actor Activity

  • The Transparent Tribe APT group, aligned with Pakistan, was observed deploying a new Rust-based backdoor and using private GitHub repositories for command and control in attacks targeting government and defense sectors in India and Afghanistan [9].
  • An ongoing campaign is distributing the Rapuncel infostealer via fake, SEO-optimized GitHub repositories impersonating legitimate software such as LastPass Authenticator [13].

Trends, Tools, or Tactics of Interest

  • Security researchers are increasingly using AI chatbots, such as Claude Opus 5, to discover and exploit complex chained vulnerabilities, contributing to a surge in vulnerability discoveries [1][23][30].
  • AI models are being used both by attackers and defenders, with incidents of AI-driven malware such as the RatHat Android trojan, which leverages AI to steal banking credentials and PINs [31].
  • Threat actors are abusing private and public GitHub repositories for malware hosting and command and control infrastructure [9][13].
  • MFA is insufficient to prevent OAuth consent abuse; effective governance, least-privilege scopes, and consent monitoring are required to mitigate these risks [21].
  • The emergence of the HTTP QUERY method (RFC 10008) introduces a new standard HTTP verb, which may have implications for web application security as it gains adoption [28].

Regulatory or Policy Developments Affecting the Security Industry

  • A survey by EY found that the rapid deployment of autonomous AI systems is outpacing the development of corresponding oversight and controls among organizations [20].

Sources#

  1. Gyazo server flaw exploited to steal 23.6 million user records - bleepingcomputer.com
  2. CrowdSec Says TanStack npm Attack Led to Copy of 170 Private GitHub Repositories - thehackernews.com
  3. Google Gemini Broke Into Real Company Systems After Security Test Domain Mix-Up - thehackernews.com
  4. Claude Opus 5 Helped Researchers Take Over OpenAI Staff Accounts via Chained Flaws - thehackernews.com
  5. AI-Built Exploit and Sign-In Flaw Opened Path to Internal OpenAI Code - securityweek.com
  6. SolarWinds Patches ARM Hard-Coded Key Flaw Enabling Unauthenticated RCE - thehackernews.com
  7. Critical Pre-Auth RCE in Orkes Conductor Workflow Platform Exploited in the Wild - thehackernews.com
  8. Microsoft Patches CVSS 10.0 Azure AI Foundry Flaw Enabling Unauthorized Privilege Escalation - thehackernews.com
  9. New WordPress Click2Shell Flaw Forces Theme Installs, Can Chain to Code Execution - thehackernews.com
  10. Cisco Zero-Day Highlights API Endpoint Authentication Issues - darkreading.com
  11. CISA Flags Three Linux Kernel Vulnerabilities Exploited in the Wild - thehackernews.com
  12. Public Exploits Released for Four Linux Kernel Flaws That Enable Local Root - thehackernews.com
  13. Transparent Tribe Deploys New Rust Backdoor Using Private GitHub Repositories for C2 - thehackernews.com
  14. Fake LastPass Authenticator GitHub repos push new Rapuncel infostealer - bleepingcomputer.com
  15. Forget the AI Slowdown—the Vulnerability Explosion Is Already Happening - wired.com
  16. New Android malware uses AI to steal bank logins and PINs - malwarebytes.com
  17. MFA Won't Save You From OAuth Consent Abuse - darkreading.com
  18. HTTP QUERY Method: The Grey Zone Between GET And POST., (Fri, Sep 18th) - isc.sans.edu
  19. EY Survey Finds Autonomous AI Implementation Outpaces Oversight - darkreading.com