Flowise on DanSec Daily

Cybersecurity Brief – 2026-05-31

Sun, 31 May 2026 00:00:00 +0000

Palo Alto Networks confirmed that threat actors are actively exploiting a PAN-OS GlobalProtect authentication bypass vulnerability (CVE-2024-3400), targeting corporate networks to gain unauthorised access ^[1].
A cybercrime group has claimed responsibility for hacking Mike Lindell’s MyPillow, though further details on the breach are limited ^[5].

A local privilege escalation vulnerability, dubbed ‘CIFSwitch’, has been identified in the Linux kernel, allowing attackers to obtain root access by abusing the kernel’s key request mechanism. This flaw affects multiple Linux distributions ^[2].
Exploit code has been published for a critical remote code execution vulnerability in Flowise, which allows attackers to execute arbitrary code on self-hosted servers by tricking users into importing malicious chatflows ^[7].

Russian intelligence operatives are reported to be intensifying efforts to acquire Western technology by creating fake companies, recruiting intermediaries, and deploying cyber spies and hackers to gather information, including data potentially useful for attacks on critical infrastructure ^[6].

Reports indicate a ransomware group has begun physically stealing data in person as part of their operations, marking a shift in tactics beyond traditional digital intrusions ^[5].

Wed, 08 Apr 2026 00:00:00 +0000

Massachusetts Hospital Cyberattack
- Signature Healthcare in Massachusetts experienced a cyberattack resulting in ambulance diversions, cancellation of some services, and pharmacy disruptions.
Snowflake SaaS Integrator Breach
- Over a dozen companies suffered data theft attacks after a SaaS integration provider was breached, with attackers stealing authentication tokens.
Router Hijacking and Espionage by APT28
- The Russia-linked APT28 (Forest Blizzard) compromised MikroTik and TP-Link routers globally, hijacking DNS settings to steal Microsoft 365 and Office authentication tokens.
- An international law enforcement operation disrupted the “FrostArmada” APT28 campaign.
Critical Infrastructure Attacks by Iran-Linked Actors
- Iran-affiliated threat actors targeted internet-exposed programmable logic controllers (PLCs) and SCADA systems in US critical infrastructure sectors, causing operational disruptions.
Doxing, Spyware, and Nonconsensual Abuse
- Widespread abuse in Telegram groups, where individuals are purchasing hacking tools, sharing nonconsensual images, and engaging in doxing and spyware deployment.

Tue, 07 Apr 2026 00:00:00 +0000

Wynn Resorts disclosed that 21,000 employees were affected by the ShinyHunters hack. The company reportedly paid a ransom to prevent data leakage.
Drift Protocol attributed its recent $280M cryptocurrency theft to a six-month, in-person operation where attackers established an operational presence inside the organisation.
Axios, a popular NPM package, was compromised in a supply chain attack involving sophisticated social engineering targeting maintainers. North Korean threat actors are linked to this and similar campaigns against Node.js maintainers.
Guardarian users were targeted via 36 malicious NPM packages impersonating Strapi plugins, enabling shell execution, container escape, and credential harvesting.
The European Commission experienced a significant cyber incident, as noted in Check Point’s threat intelligence report.

Flowise AI Agent Builder is under active exploitation for a CVSS 10.0 remote code execution vulnerability. Over 12,000 instances are exposed.
Fortinet issued an emergency patch for a zero-day authentication bypass flaw (CVE-2026-35616) in FortiClient EMS, which allows unauthenticated remote code execution. CISA has mandated federal agencies patch this vulnerability.
A new GPUBreach attack technique enables privilege escalation and system takeover through Rowhammer-induced bit-flips on GPU GDDR6 memory.
Exploit code for an unpatched Windows privilege escalation zero-day (“BlueHammer”) was leaked, allowing local attackers to gain SYSTEM or administrator privileges.
Automated credential harvesting campaigns are exploiting the React2Shell flaw in vulnerable Next.js applications.
Google DeepMind researchers identified “AI Agent Traps,” a vulnerability that allows attackers to manipulate and exploit AI agents via malicious web content.

China-linked Storm-1175 has been observed exploiting zero-day and n-day vulnerabilities to rapidly deploy Medusa ransomware in high-velocity attacks.
Qilin and Warlock ransomware groups are using the bring-your-own-vulnerable-driver (BYOVD) tactic to disable over 300 endpoint detection and response (EDR) tools during ransomware deployment.
An Iran-linked threat actor is conducting password-spraying attacks against over 300 Israeli and UAE Microsoft 365 organisations.
DPRK-linked actors are using GitHub as command-and-control infrastructure in multi-stage attacks targeting South Korean entities.
North Korean threat actors are targeting Node.js maintainers with social engineering as part of supply chain attacks.
A threat cluster tracked as UAT-10608 is automating credential harvesting by exploiting web-exposed Next.js applications.

There is increased use of AI-assisted tools by threat actors in supply chain attacks, as seen in the PRT-scan campaign targeting GitHub misconfigurations.
Social engineering targeting open-source maintainers is becoming industrialised, with attackers leveraging complex, scalable tactics.
The BYOVD technique remains prevalent among ransomware operators for bypassing security controls.
Open redirects continue to be widely abused in phishing campaigns.
Infostealers are harvesting credentials and session cookies at scale, outpacing traditional breach monitoring capabilities.
Developer workstations are being increasingly targeted as entry points for credential theft and lateral movement.
Shadow AI use in healthcare persists, with medical professionals adopting unsanctioned AI tools.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch the actively exploited Fortinet EMS vulnerability by Friday.
The OWASP GenAI Security Project has updated its risk matrix, now recognising 21 generative AI risks and recommending tailored security approaches for GenAI and agentic AI systems.
German authorities have formally identified two Russian nationals as the leaders of the GandCrab and REvil ransomware operations between 2019 and 2021.
Microsoft has deprecated and removed the Support and Recovery Assistant (SaRA) tool from all supported Windows versions as of March 10.