OpenSSL on DanSec Daily

Cybersecurity Brief – 2026-09-30

Wed, 30 Sep 2026 00:00:00 +0000

Major Incidents or Breaches

Cryptocurrency exchange Bitget suffered a breach resulting in a $387.5 million loss after attackers exploited a zero-day vulnerability in a third-party security product used by the company ^[15].
The French tax administration experienced a data breach in which an attacker used stolen staff credentials to exfiltrate tax data belonging to hundreds of thousands of individuals and businesses. The compromise went undetected for seven weeks ^[9].
The Dutch Institute for Vulnerability Disclosure (DIVD) was breached via an automated AI agent in an attack described as “loud and very, very messy” ^[24].
South Africa’s air traffic control systems were targeted by a cyberattack that deployed a ransomware toolkit on at least one operational network ^[25].
AI coding agents inadvertently exposed more than 13,000 internal company images, including billing records, by uploading screenshots to public GitHub repositories ^[4].

Newly Discovered Vulnerabilities

Multiple critical vulnerabilities have been disclosed and patched in Citrix NetScaler ADC and Gateway products, including CVE-2026-88772 and CVE-2026-88771. These flaws allow pre-authentication code execution and have been actively exploited to gain root access, deploy web shells, steal credentials, and move laterally within victim networks. Government and finance organizations are among those affected ^[6]^[8]^[20]^[30]^[36].
OpenSSL released fixes for a high-severity DTLS flaw that can leak heap memory to the other side of a DTLS connection or cause a crash. WolfSSL also patched several high-severity vulnerabilities ^[7]^[41].
TeamViewer warned users to urgently patch a set of high-severity vulnerabilities in its client and host software ^[14].
A newly disclosed Spectre-v2 Branch Target Reuse (BTR) attack variant enables attackers to recover Linux root password hashes in minutes, bypassing existing mitigations ^[10]^[23].
Apple reported that CVE-2026-86950, an out-of-bounds write vulnerability, is being actively weaponized in targeted attacks ^[26].
WatchGuard issued patches for 15 vulnerabilities in Fireware OS, including code execution, denial of service, authorization, and path traversal bugs ^[35].
Unsloth Studio patched a vulnerability allowing malicious AI models to execute arbitrary Python code during model inspection if the trust_remote_code setting is enabled ^[27].
Chrome and Firefox released updates addressing over 100 vulnerabilities, some of which could allow remote code execution or sandbox escape ^[37].

Notable Threat Actor Activity

Russian state-sponsored group Star Blizzard (also known as APT29) has conducted large-scale phishing campaigns using fake event invitations and the ‘RedFlick’ infection chain to deliver the CosmicPulse backdoor, targeting over 100 organizations ^[11]^[39].
Microsoft observed a China-based actor, dubbed ‘NeedyMantis’, using a previously unidentified malware framework for long-term access in targeted intrusions against telecommunications, universities, medical, and government-related organizations ^[29].
The ShinyHunters extortion group was addressed by the FBI following the arrest of an alleged leader, with the FBI urging remaining members to turn themselves in. ShinyHunters responded defiantly ^[19]^[40].

Trends, Tools, or Tactics of Interest

Social engineering attacks are increasingly leveraging audio and video deepfakes, with 41 percent of CISOs reporting an audio deepfake attack against their organization in the past year and 36 percent reporting deepfake targeting of employees ^[1].
Custom malicious ChatGPT variants promoted via sponsored Google results are being used to lure victims to sites that deploy RAT malware through ClickFix attacks ^[18].
Recent US-focused phishing campaigns targeting C-suite executives have been observed stealing Microsoft 365 sessions and deploying remote monitoring and management (RMM) tools for persistent remote access. The campaigns predominantly targeted technology, manufacturing, government, and consulting sectors ^[5].
Browser-based attacks remain a significant initial vector for breaches, with many attacks contained entirely within browser sessions ^[3].
AI agent security is being addressed with new tools such as KnowBe4’s Agent Risk Manager, which integrates with the Claude Compliance API to monitor and detect AI agent risks in real time ^[2].
Anthropic and other industry voices are raising concerns over liability risks associated with autonomous AI agents, as lawsuits emerge following incidents involving AI-driven attacks ^[33]^[38].

Regulatory or Policy Developments Affecting the Security Industry

Microsoft will implement new protections in Entra ID to block external script injection attacks starting in October ^[13].
Cloudflare announced a public certificate authority designed for post-quantum cryptography, offering automated certificates intended to be resistant to quantum computing threats ^[28].
A group of major technology firms has signed a voluntary accord to self-police AI development, focusing on four key steps and signaling the possibility of future regulation ^[42].
DARPA selected Xint to use AI for identifying vulnerabilities in military messaging apps, with potential commercial applications ^[44].

Sources

Bitget hacked via zero-day in third-party security products - bleepingcomputer.com
French Tax Data Theft Using Stolen Staff Passwords Went Undetected for Seven Weeks - thehackernews.com
Automated AI agent used to breach cybersecurity nonprofit DIVD - bleepingcomputer.com
South Africa Seeks Help After Cyberattack Targets Air Traffic Control - darkreading.com
AI Coding Agents Exposed 13,000 Internal Images, Including Billing Records, on GitHub - thehackernews.com
Attackers Exploit NetScaler Flaw for Root Access, Deploy WHIPSHOT and SLAPSHOT - thehackernews.com
Citrix NetScaler CVE-2026-88772 Exploit Details Show Pre-Auth Path to Shellcode Execution - thehackernews.com
Hackers exploit Citrix NetScaler zero-day to deploy web shells - bleepingcomputer.com
Dual NetScaler Zero-Days Trigger Chaos for Citrix Customers - darkreading.com
Government, Finance Orgs Targeted in Weeks-Long NetScaler Zero-Day Attacks - securityweek.com
OpenSSL Fixes High-Severity DTLS Flaw That Can Leak Heap Memory Unencrypted - thehackernews.com
High-Severity Vulnerabilities Patched in OpenSSL, WolfSSL - securityweek.com
TeamViewer urges users to patch severe flaws “as soon as possible” - bleepingcomputer.com
New Spectre-v2 BTR Attack Leaks Linux Memory Despite Existing Defenses - thehackernews.com
New Spectre v2 attack variant leaks Linux root password hash in minutes - bleepingcomputer.com
Apple Zero-Day Vulnerability Weaponized in Targeted Attacks - darkreading.com
WatchGuard Patches Critical Fireware OS Code Injection Vulnerability - securityweek.com
Unsloth Studio Flaw Turns Routine Model Inspection Into Code Execution - darkreading.com
Chrome, Firefox Updates Patch Over 100 Vulnerabilities - securityweek.com
Russia's Star Blizzard Targets 100+ Organizations With Fake Event Invites to Deliver Backdoor - thehackernews.com
Russian APT Star Blizzard Uses ‘RedFlick’ Infection Chain in Recent Attacks - securityweek.com
'NeedyMantis' Provides Long-Term Access to Compromised Networks - darkreading.com
FBI tells ShinyHunters members to turn themselves in after recent arrest - bleepingcomputer.com
ShinyHunters Defiant After FBI Calls on Members to Come Forward - securityweek.com
Report: Social Engineering Attacks Are Increasingly Using Audio and Video Deepfakes - blog.knowbe4.com
Custom ChatGPTs push ClickFix attacks to deploy RAT malware - bleepingcomputer.com
US-Focused CSuite Phishing Steals Microsoft 365 Sessions and Deploys RMM Tools for Remote Access - thehackernews.com
Know Your Enemy: Browser-Based Attack Techniques in 2026 - thehackernews.com
Govern Claude AI with KnowBe4’s Agent Risk Manager - blog.knowbe4.com
OpenAI Gets Sued Over the Hugging Face Hack - wired.com
Anthropic Flags AI Agent Liability Risks as OpenAI Faces Hacking Lawsuit - securityweek.com
Microsoft to block Entra ID script injection attacks starting October - bleepingcomputer.com
Cloudflare Announces Public Certificate Authority for the Post-Quantum Web - darkreading.com
Trump Says Top Tech Firms Have Signed Accord to ‘Self-Police’ AI Development - securityweek.com
DARPA Selects Xint to Use AI in Securing Military Messaging Apps - securityweek.com

Cybersecurity Brief – 2026-07-21

Tue, 21 Jul 2026 00:00:00 +0000

Major Incidents or Breaches

Hugging Face disclosed a breach of its production infrastructure by an autonomous AI agent, resulting in the compromise of internal datasets and service credentials ^[19]^[39].
Estée Lauder reported a data breach after attackers exploited a flaw in Oracle E-Business Suite used for HR operations ^[12].
Ernst & Young suffered a data breach via a third-party management platform, leading to the theft of names, addresses, Social Security numbers, credit/debit card numbers, and other sensitive information ^[36]^[40].
Healthcare company Abbott is investigating two cyber incidents following extortion claims by groups ShinyHunters and ShadowByt3$ involving alleged theft of large volumes of patient data, though the claims have not been independently verified ^[42].
The Ostium trading platform lost $23.75 million in cryptocurrency after an attacker compromised off-chain infrastructure responsible for price feeds ^[14].

Newly Discovered Vulnerabilities

A critical vulnerability (CVE-2026-6875) in the ServiceNow AI Platform is being actively exploited for unauthenticated code execution ^[2]^[22].
Two zero-day vulnerabilities (CVE-2026-15409 and CVE-2026-15410) in SonicWall SMA1000 devices were exploited for weeks to deploy custom malware before patches were released ^[13]^[33].
A new heap-based buffer overflow vulnerability (CVE-2026-14266) in 7-Zip allows attackers to execute code via crafted XZ archives during extraction ^[9].
The “WP2Shell” vulnerability (CVE-2026-63030), in combination with CVE-2026-60137, is being widely exploited for remote takeover of WordPress sites ^[23]^[31].
Researchers have demonstrated sandbox escapes in AI developer tools Cursor, Codex, Gemini CLI, and Antigravity, allowing malicious code execution by tricking trusted host tools ^[15].
A zero-day privilege escalation flaw in Windows “LegacyHive” has been addressed with free unofficial patches ^[11].
OpenSSL fixed a denial-of-service vulnerability (“HollowByte”) that allowed attackers to exhaust server memory via malicious payloads ^[34].

Notable Threat Actor Activity

Russian intelligence services have hijacked internet-connected security cameras across NATO states and Ukraine to monitor military logistics ^[7].
The JadePuffer autonomous AI agent has upgraded to deploy the EncForge ransomware, which targets AI assets such as training datasets and model checkpoints in Langflow environments ^[1]^[16].
A Russian-speaking hacker used Google Gemini CLI to control a botnet of eight dental clinic PCs, leveraging AI-driven automation ^[10].
The FakeGit campaign has established nearly 7,600 malicious GitHub repositories, with over 800 masquerading as AI-related projects to distribute SmartLoader malware ^[3].
New malware dubbed HollowGraph uses Microsoft 365 calendar events dated far in the future as a covert command-and-control channel and for exfiltrating stolen files ^[5]^[17].
An exposed server revealed a comprehensive AI-assisted phishing toolkit used in a WebDAV malware campaign, including lure templates, filename spoofing, and builder tools ^[4].
Attackers are combining multiple evasion tactics in BEC phishing, including fileless techniques and loaders with low detection rates to deploy RATs and stealers ^[26].
Fake games are being used to spread stealers via the Ren’Py loader, MSBuild, and EtherHiding techniques, ultimately delivering Amatera Stealer ^[43].
Scams related to the recent release of “The Odyssey” movie are distributing malware disguised as movie files and fake browser errors ^[41].

Trends, Tools, or Tactics of Interest

There is an increasing trend of threat actors targeting AI infrastructure, including the use of autonomous AI agents for attacks and ransomware targeting AI datasets and models ^[1]^[16]^[19]^[39].
Attackers are exploiting vulnerabilities in widely used AI developer tools and platforms, with sandbox escapes and supply chain attacks observed ^[15]^[3].
Use of legitimate cloud and productivity services for stealthy command-and-control, as seen in HollowGraph’s abuse of Microsoft 365 calendar features ^[5]^[17].
Open-source security tools powered by AI are being developed, such as Capital One’s VulnHunter, which identifies exploitable code flaws and recommends remediations ^[38].
The adoption of AI in security operations is rising, with new platforms and evaluation frameworks emerging for AI-driven SOCs ^[18]^[32]^[24].
BEC phishing campaigns are increasingly leveraging fileless malware and low-detection loaders to bypass traditional defences ^[26].

Regulatory or Policy Developments Affecting the Security Industry

The American Civil Liberties Union (ACLU) released a toolkit for attorneys in Massachusetts to uncover and challenge state surveillance technologies, including facial recognition and AI-generated police reports ^[28].

Sources

Hugging Face warns an autonomous AI agent hacked its network - bleepingcomputer.com
Hugging Face Hacked in Autonomous AI Attack - securityweek.com
Estée Lauder discloses data breach via Oracle E-Business flaw - bleepingcomputer.com
Ernst & Young Data Breach Affects Personal, Financial Information - securityweek.com
20th July – Threat Intelligence Report - research.checkpoint.com
Healthcare giant Abbott probes two cyber incidents amid extortion claims - malwarebytes.com
Hackers steal $23.7 million in crypto from Ostium in off-chain attack - bleepingcomputer.com
Critical ServiceNow AI Platform Flaw Exploited for Unauthenticated Code Execution - thehackernews.com
Critical ServiceNow code execution flaw now exploited in attacks - bleepingcomputer.com
SonicWall SMA1000 flaws exploited as zero-days to push custom malware - bleepingcomputer.com
SonicWall Zero-Days Exploited to Deliver Custom Malware for Weeks Before Patch - securityweek.com
New 7-Zip Vulnerability Could Let Crafted XZ Archives Run Code During Extraction - thehackernews.com
'WP2Shell' Opens Millions of WordPress Sites to Remote Takeover - darkreading.com
WordPress Exploitation Underway (CVE-2026-63030), (Mon, Jul 20th) - isc.sans.edu
Cursor, Codex, Gemini CLI, Antigravity hit by sandbox escapes - bleepingcomputer.com
Windows LegacyHive zero-day flaw gets free, unofficial patches - bleepingcomputer.com
OpenSSL Silently Fixes ‘HollowByte’ DoS Vulnerability - securityweek.com
Russian Intelligence Hacks IP Cameras to Spy on Military Logistics Across NATO States and Ukraine - thehackernews.com
New ENCFORGE Ransomware Targets AI Model Files in Langflow RCE Attack - thehackernews.com
JadePuffer agentic attacks now target AI model data with ransomware - bleepingcomputer.com
Russian-Speaking Hacker Uses Google Gemini CLI to Control Botnet of Eight Dental Clinic PCs - thehackernews.com
FakeGit Campaign Uses 7,600 GitHub Repositories to Spread SmartLoader Malware - thehackernews.com
HollowGraph Malware Hides C2 and Stolen Files in Microsoft 365 Events Dated 2050 - thehackernews.com
New HollowGraph malware uses Microsoft Graph for stealthy C2 comms - bleepingcomputer.com
Exposed Server Reveals AI-Assisted Phishing Toolkit Behind WebDAV Malware Campaign - thehackernews.com
Attackers Combo Up Evasion Tactics for BEC Phishing - darkreading.com
Fake games spread stealers with RenPy Loader, MSBuild and EtherHiding - malwarebytes.com
The Odyssey piracy scams appear within hours of the movie’s release - malwarebytes.com
Capital One Open Sources AI-Powered ‘VulnHunter’ Security Tool - securityweek.com
An AI SOC Evaluation Guide for Security Leaders - bleepingcomputer.com
Neo Emerges From Stealth With $100M to Control and Secure Enterprise AI Software - securityweek.com
Remediating Vulnerabilities With LLMs: Inside Ivanti's Automation Push - darkreading.com
The ACLU Is Arming Lawyers to Expose State Surveillance Secrets - wired.com

Cybersecurity Brief – 2026-07-18

Sat, 18 Jul 2026 00:00:00 +0000

Major Incidents or Breaches

Abbott Laboratories is investigating two separate cybersecurity incidents, confirming unauthorized access to internal legacy Exact Sciences systems in its Cancer Diagnostics business, amid extortion claims. The company is also probing a second, unrelated cyber event ^[12].
Ernst & Young disclosed a data breach after IT personnel’s use of a compromised third-party support ticket system resulted in customer data exposure ^[14].
The Japanese frozen food company Nichirei experienced a cyberattack that forced system disconnection on July 13, disrupting operations. Restoration efforts are underway ^[29].
DigiCert’s April 2026 security incident has been attributed to a threat activity cluster known as CylindricalCanine, specifically a subgroup called GoldenEyeDog, which stole code-signing certificates ^[5].

Newly Discovered Vulnerabilities

Two critical vulnerabilities in WordPress Core, now assigned CVE IDs, allow unauthenticated attackers to execute arbitrary code. A working proof-of-concept has been published, and a persistent-object-cache condition has been identified ^[1].
The HollowByte vulnerability in OpenSSL allows unauthenticated attackers to trigger a denial-of-service by sending an 11-byte TLS request, causing the server to allocate up to 131 KB of memory per request until the process restarts. This affects glibc-based systems ^[2]^[13].
A zero-day exploit named LegacyHive has been released, enabling privilege escalation to administrator level on fully updated Windows systems ^[16].
A security flaw in Shark robot vacuums exposes device cameras, home mapping data, and Wi-Fi passwords, potentially allowing remote access to multiple vacuums if one is compromised ^[31].
Two zero-day vulnerabilities in SonicWall’s Secure Mobile Access (SMA) appliances have been exploited by threat actors to gain root-level access ^[19].

Notable Threat Actor Activity

Seven malicious npm packages targeting the Vite frontend ecosystem have been discovered using blockchain-based command and control to deliver a remote access trojan, forming part of a software supply chain attack ^[3].
The NadMesh botnet, written in Go, is actively scanning for exposed AI services to harvest cloud credentials and Kubernetes tokens, with operators claiming to have collected thousands of AWS keys ^[4].
North Korean threat actors associated with the Contagious Interview campaign are using steganography in SVG files to deliver malware via fake coding tests, aligning with OtterCookie activity ^[6].
The ACR Stealer infostealer is leveraging ClickFix-themed lures to exfiltrate browser credentials, session tokens, PDFs, Microsoft 365 documents, and OneDrive files from enterprise networks ^[10].
The newly identified GoSerpent malware has been deployed in espionage operations against Southeast Asian governments and diplomats since late 2025 ^[11].
Inc Ransomware operators have exploited SonicWall SMA zero-days in recent attacks ^[19].

Trends, Tools, or Tactics of Interest

Cybercriminals are increasingly seeking “clean” residential proxies and pairing them with advanced browser fingerprinting techniques to evade detection in carding operations ^[15].
Steganography in SVG images is being used by North Korean threat actors to conceal malware in recruitment-themed phishing campaigns ^[6].
Agentic defense strategies, including automated threat detection and remediation, are being incorporated into cloud security platforms to counter AI-driven attacks ^[22]^[26].
The use of blockchain-based command and control infrastructure is emerging in supply chain attacks, as seen in the malicious Vite npm package campaign ^[3].

Regulatory or Policy Developments Affecting the Security Industry

The European Commission has ordered Google to provide rival AI assistants with access to Android’s camera, microphone, on-screen content, and wake word capabilities, matching those available to Gemini ^[7].
Microsoft announced that Windows Server 2022 will reach the end of mainstream support in October 2026, transitioning to extended support with continued security updates for five years ^[17].
The Pentagon’s suspension of CMMC Phase 2 pauses third-party audits but does not remove the legal requirement for defense contractors to protect Controlled Unclassified Information (CUI) ^[28].
San Francisco’s City Attorney has issued cease-and-desist letters to Apple and Google demanding the removal of 13 AI-powered “nudify” face-swap apps from their app stores, citing concerns about misuse targeting women and girls ^[23].

Sources

Abbott probes two cyber incidents amid extortion claims - bleepingcomputer.com
Ernst & Young discloses data breach after support system hack - bleepingcomputer.com
Cyberattack Disrupts Operations of Japanese Frozen Food Giant Nichirei - securityweek.com
GoldenEyeDog Subgroup Linked to DigiCert Breach and Code-Signing Certificate Theft - thehackernews.com
New wp2shell WordPress Core Flaw Lets Unauthenticated Attackers Run Code - thehackernews.com
OpenSSL HollowByte Flaw Could Freeze Server Memory with 11-Byte TLS Requests - thehackernews.com
HollowByte DDoS flaw bloats OpenSSL server memory with 11-byte payload - bleepingcomputer.com
New Windows LegacyHive zero-day gives hackers admin privileges - bleepingcomputer.com
Shark vacuum flaw exposes cameras, home maps and Wi-Fi passwords - malwarebytes.com
Inc Ransomware Exploits SonicWall SMA Zero-Days - darkreading.com
Seven Malicious Vite npm Packages Use Blockchain C2 to Deliver a RAT - thehackernews.com
New NadMesh Botnet Hunts Exposed AI Services for Cloud Keys and Kubernetes Tokens - thehackernews.com
Fake Coding Tests Deliver OtterCookie-Aligned Malware Hidden in SVG Flag Images - thehackernews.com
ACR Stealer Uses ClickFix Lures to Steal Browser Tokens and Microsoft 365 Files - thehackernews.com
New GoSerpent Malware Targets Southeast Asian Governments and Diplomats for Espionage - thehackernews.com
Inside the Search for "Clean" Residential Proxies for Carding - bleepingcomputer.com
Google Bets 'Agentic Defense' Strategy Can Outpace Attackers - darkreading.com
Podcast: Broken Governance, Agentic AI, and the MindStone Agent Exclusive - securityweek.com
E.U. Orders Google to Open Android Mic, Camera and Screen to Rival AI Assistants - thehackernews.com
Windows Server 2022 reach end of mainstream support in 90 days - bleepingcomputer.com
Industry Reactions to Pentagon Suspending CMMC Phase 2: Feedback Friday - securityweek.com
San Francisco Demands Apple and Google Delete AI ‘Nudify’ Apps From App Stores - wired.com

Cybersecurity Brief – 2026-06-10

Wed, 10 Jun 2026 00:00:00 +0000

Major Incidents or Breaches

Microsoft confirmed that 73 of its open-source GitHub repositories were compromised to inject password-stealing malware as part of a supply chain attack linked to the Miasma worm. Some repositories remain offline as the investigation continues, and the incident disrupted continuous integration pipelines for several Microsoft projects ^[11]^[27]^[31].
ServiceNow disclosed a security incident where attackers exploited an unauthenticated API flaw, enabling unauthorized access to customer data. The vulnerability had reportedly been known since April and has since been patched ^[6]^[20]^[43].
Two Russia-aligned threat actor campaigns continue to exploit a WinRAR vulnerability (CVE-2025-8088), patched last July, to deploy information stealers and conduct cyberespionage against Ukrainian government and military organizations ^[12]^[32].

Newly Discovered Vulnerabilities

Microsoft released a record 206 security fixes during the June 2026 Patch Tuesday, including three zero-day vulnerabilities. Notable among these are privilege escalation flaws in Microsoft Defender (“RoguePlanet”), YellowKey, GreenPlasma, and MiniPlasma, as well as critical remote code execution vulnerabilities across its software portfolio ^[4]^[7]^[16]^[19]^[24]^[29]^[38]^[41]^[47].
Google released patches for 74 Chrome vulnerabilities, including a high-severity V8 zero-day (CVE-2026-11645) that is being actively exploited in the wild ^[14].
Veeam patched a critical remote code execution flaw (CVE-2026-44963) in its Backup & Replication software, which allowed authenticated domain users to execute code remotely on affected servers ^[10]^[28].
Ivanti fixed two critical vulnerabilities in its Sentry secure mobile gateway, including a maximum-severity flaw enabling remote code execution as root, and Fortinet patched remotely exploitable OS command injection vulnerabilities ^[17]^[44].
SAP addressed 15 vulnerabilities in its June patch release, including four critical-severity flaws in NetWeaver and Commerce Cloud ^[22].
Adobe patched 123 vulnerabilities, nearly half of which could allow arbitrary code execution, primarily affecting Experience Manager ^[48].
OpenSSL addressed 18 vulnerabilities in its latest release, including high-severity issues, several of which were potentially discovered through AI-assisted analysis ^[50].
Six vulnerabilities were disclosed in protobuf.js, exposing Node.js applications to remote code execution and denial of service ^[8].
Microsoft Exchange was found vulnerable to email spoofing via the “Ghost-Sender” attack in hybrid environments using third-party mail servers or spam filters ^[30].

Notable Threat Actor Activity

Russia-aligned groups are actively exploiting a WinRAR vulnerability to deliver stealers and conduct espionage against Ukrainian targets, leveraging a flaw that has been patched for nearly a year ^[12]^[32].

Trends, Tools, or Tactics of Interest

The use of AI in cybersecurity is accelerating both vulnerability discovery and exploit development, contributing to the record number of vulnerabilities patched this month. AI-driven models such as Claude Mythos have demonstrated the ability to rapidly create working exploits for recently disclosed vulnerabilities, potentially shortening the window between disclosure and exploitation ^[29]^[37]^[49]^[51].
Anthropic released two versions of its new AI model: Claude Mythos 5, available to trusted cybersecurity partners with fewer restrictions, and Claude Fable 5, a public release with built-in cyberattack safeguards ^[5]^[18]^[37]^[49].
University of Toronto researchers demonstrated a proof-of-concept self-replicating AI worm using locally hosted open-weight LLMs to autonomously propagate and conduct network attacks ^[13].
Automated pentesting tools may miss critical vulnerabilities over time, highlighting the need for expert-driven assessments to supplement automation ^[3].
Phishing campaigns are increasingly leveraging real hotel reservation details to target travelers, indicating an evolution in social engineering tactics ^[2].
Simulation testing revealed that the OpenClaw AI email agent is susceptible to phishing attacks, leaking user data under conditions that commonly compromise human users ^[21].

Regulatory or Policy Developments Affecting the Security Industry

Microsoft released extended security updates for Windows 10 (KB5094127) and cumulative updates for Windows 11 (KB5094126, KB5093998), addressing vulnerabilities and adding new security features ^[23]^[25].
Organizations are advised to apply vendor-supplied mitigations or discontinue use of vulnerable Arista EOS devices, as no patch will be issued for an exploited vulnerability ^[46].

Sources

Microsoft Restores Some GitHub Repos, Keeps Others Offline as Miasma Probe Continues - thehackernews.com
GitHub disables Microsoft repos pushing password-stealing malware - bleepingcomputer.com
Miasma Supply Chain Worm Burrows Into 73 Microsoft Repositories - darkreading.com
ServiceNow Flaw Exploited to Gain Unauthorized Access to Customer Instances - thehackernews.com
ServiceNow discloses security incident exposing customer data - bleepingcomputer.com
ServiceNow Patches Vulnerability Exploited Against Some Customers - securityweek.com
WinRAR Flaw Exploited by Russia-Aligned Groups to Deploy Stealers in Ukraine - thehackernews.com
Russian Attackers Weaponize WinRAR Flaw Against Ukrainian Orgs - darkreading.com
Microsoft Patches Record 206 Flaws, Including Three Zero-Days and Critical RCE Bugs - thehackernews.com
Microsoft Defender RoguePlanet Zero-Day Grants SYSTEM Access on Updated Windows - thehackernews.com
Microsoft patches YellowKey, GreenPlasma, MiniPlasma zero-days - bleepingcomputer.com
Microsoft Defender 'RoguePlanet' zero-day grants SYSTEM privileges - bleepingcomputer.com
Microsoft June 2026 Patch Tuesday fixes 3 zero-day, 200 flaws - bleepingcomputer.com
Blame AI: Patch Tuesday Hits Record 206 CVEs - darkreading.com
A Record-Breaking Patch Tuesday for June 2026 - krebsonsecurity.com
Microsoft June 2026 Patch Tuesday, (Tue, Jun 9th) - isc.sans.edu
Microsoft Patches 200 Vulnerabilities - securityweek.com
Chrome V8 Zero-Day CVE-2026-11645 Exploited in the Wild - Patch Now - thehackernews.com
Veeam Backup & Replication RCE Flaw Lets Domain Users Run Remote Code - thehackernews.com
New Veeam vulnerability exposes backup servers to RCE attacks - bleepingcomputer.com
Ivanti: Max severity Sentry flaw allows code execution as root - bleepingcomputer.com
Critical Vulnerabilities Patched in Fortinet, Ivanti Products - securityweek.com
SAP fixes critical flaws in NetWeaver and Commerce Cloud - bleepingcomputer.com
Adobe Patches 123 Vulnerabilities - securityweek.com
OpenSSL Patches High-Severity Vulnerability Found With AI - securityweek.com
Six Proto6 Vulnerabilities in protobuf.js Expose Node.js Apps to RCE and DoS - thehackernews.com
Microsoft Exchange Flaw Lets Attackers Spoof Any Email Address - darkreading.com
Anthropic Offers Mythos Upgrade for Cyber Partners and a ‘Safe’ Version for the Rest of You - wired.com
Anthropic Launches Claude Fable 5: Mythos-Class AI With Cybersecurity Guardrails - securityweek.com
Claude Mythos Turns N-Days Into N-Hours With Rapid Exploit Creation - securityweek.com
Anthropic Releases Claude Fable 5, Its Most Powerful AI Yet, With Cyber Safeguards - thehackernews.com
Anthropic rolls out Claude Fable 5, but it's available for a limited time - bleepingcomputer.com
Researchers Build Self-Replicating AI Worm That Operates Entirely on Local, Open-Weight Models - thehackernews.com
Your Automated Pentest Looks Clean. See What It Missed in This Expert Webinar - thehackernews.com
CyberheistNews Vol 16 #23 Now Phishing Attacks Use Real Hotel Reservations to Target Travelers - blog.knowbe4.com
OpenClaw AI agent found falling for phishing attacks, spills user data - bleepingcomputer.com
Microsoft releases Windows 10 KB5094127 extended security update - bleepingcomputer.com
Windows 11 KB5094126 & KB5093998 cumulative updates released - bleepingcomputer.com
No Patch Planned for Exploited Arista EOS Vulnerability - securityweek.com

Cybersecurity Brief – 2026-04-09

Thu, 09 Apr 2026 00:00:00 +0000

Major Incidents or Breaches

Bitcoin Depot Hack
- Bitcoin Depot, a major Bitcoin ATM operator, reported a breach in which attackers stole approximately $3.665 million from its crypto wallets. Attackers gained access to credentials and transferred over 50 bitcoins out of company wallets.
Massachusetts Hospital Cyberattack
- Signature Healthcare in Massachusetts experienced a cyberattack that forced ambulance diversions, cancellation of some services, and disruption of pharmacy operations.
Zendesk Ticket Theft by UNC6783
- Threat actor UNC6783 compromised business process outsourcing (BPO) providers to steal corporate Zendesk support tickets from high-value companies across multiple sectors.
Magento E-commerce Card Skimming Campaign
- Nearly 100 online stores running the Magento platform were impacted by a campaign embedding credit card-stealing code within a pixel-sized SVG image.
TeamPCP Supply Chain Attack Update
- TeamPCP supply chain campaign update reveals Cisco source code was stolen via a breach linked to the Trivy security scanner. Google GTIG tracks the group as UNC6780.

Cybersecurity Brief – 2026-02-20

Fri, 20 Feb 2026 00:00:00 +0000

Major Incidents and Breaches

The French Ministry of Economy reported unauthorized access to the national bank account registry (FICOBA), exposing 1.2 million bank accounts.
Blockchain-based lender Figure confirmed a data breach after threat actor ShinyHunters leaked over 2GB of data, compromising nearly 1 million user records.
German rail operator Deutsche Bahn experienced a large-scale DDoS attack that disrupted information and booking systems for several hours.
Abu Dhabi Finance Week inadvertently exposed VIP passport details due to unprotected cloud storage.
Intimate products company Tenga suffered a phishing attack, potentially exposing US customer data.
A Nigerian national was sentenced to eight years in prison for hacking tax preparation firms in Massachusetts and filing fraudulent tax returns worth over $8.1 million.

Newly Discovered Vulnerabilities

Microsoft patched CVE-2026-26119, a privilege escalation vulnerability in Windows Admin Center.
A critical vulnerability in Grandstream GXP1600 series VoIP phones allows unauthenticated remote attackers to gain root privileges and eavesdrop on communications.
The US Cybersecurity and Infrastructure Security Agency (CISA) ordered federal agencies to patch a maximum-severity, actively exploited Dell vulnerability within three days.
OpenClaw, following a supply chain attack via a malicious npm package (Cline v2.3.0), continues to face security and misconfiguration issues despite recent patches.
Ivanti zero-day vulnerabilities have seen a surge in exploitation, with attacks traced back to July 2025, including shell access, reconnaissance, and malware delivery.
Foxit PDF software and OpenSSL both reported new remote code execution vulnerabilities, with active exploitation noted in the wild.

Notable Threat Actor Activity

The CRESCENTHARVEST campaign is targeting supporters of Iran’s protests with remote access trojan (RAT) malware for information theft and espionage.
ShinyHunters leaked user data stolen from Figure, a blockchain lender.
A supply chain attack injected the OpenClaw backdoor into Cline npm package, downloaded over 4,000 times.
Threat actors are targeting Microsoft Entra accounts in technology, manufacturing, and financial sectors using combined device code phishing and vishing to abuse OAuth 2.0 Device Authorization Grant.
INTERPOL’s Operation Red Card 2.0 resulted in 651 arrests and the recovery of $4.3 million, targeting online scams, investment fraud, mobile money scams, and fake loan applications across 16 African countries.

Trends, Tools, and Tactics of Interest

AI-assisted social engineering attacks remain the top initial access vector, with reports of a 1200% surge in AI-driven fraud during December 2025. Threat actors are leveraging AI for bot deployment, phishing, and identity fraud.
The PromptSpy Android malware is the first known mobile malware to leverage generative AI (Google Gemini) at runtime for persistence and adaptation across devices.
The Massiv Android banking trojan, disguised as IPTV apps, is actively targeting users in southern Europe with device takeover and financial theft capabilities.
The Arkanix Stealer, written in C++ and Python, has been distributed as malware-as-a-service (MaaS) with a referral program, targeting a wide range of user data.
Infostealer dumps are increasingly linking stolen credentials to real-world identities, correlating usernames, cookies, and behavioural data across personal and enterprise accounts.
The Starkiller phishing kit, available as phishing-as-a-service (PhaaS), bypasses multi-factor authentication (MFA) by live-proxying legitimate login sites.
AI-generated passwords have been found to be highly predictable and less secure compared to traditional random password generation methods.
IoT security risks continue due to reused passwords, lack of network segmentation, and poor sanitisation processes, increasing the attack surface.
Google blocked over 1.75 million Play Store app submissions in 2025 and prevented more than 255,000 apps from obtaining excessive access to sensitive user data.

Regulatory or Policy Developments

Texas filed a lawsuit against TP-Link, alleging deceptive marketing of its routers as secure while allowing exploitation of firmware vulnerabilities by Chinese state-backed hackers.
CISA issued an emergency directive for federal agencies to patch an actively exploited Dell vulnerability within three days.
Three former Google engineers were indicted in the US for allegedly stealing trade secrets and transferring them to Iran.

Cybersecurity Brief – 2026-01-28

Wed, 28 Jan 2026 00:00:00 +0000

Major Incidents or Breaches

Nike is investigating a potential data breach after the World Leaks ransomware/extortion group published 1.4 TB of allegedly stolen corporate files, including 188,347 highly sensitive documents.
SoundCloud has suffered a data breach impacting 29.8 million accounts, with hackers stealing personal and contact information.
Over 100 organizations have been targeted in a phishing campaign attributed to ShinyHunters, with domains set up to impersonate brands such as Atlassian, Canva, Epic Games, HubSpot, Moderna, ZoomInfo, and WeWork.
Over 6,000 SmarterMail servers are exposed online and likely vulnerable to automated hijacking attacks exploiting a critical authentication bypass vulnerability.
Multiple threat actors, including state-sponsored and financially motivated groups, continue to exploit the CVE-2025-8088 WinRAR path traversal vulnerability for initial access and malware delivery.
Chrome and Edge browser extensions marketed as ChatGPT enhancement tools have been found stealing ChatGPT session data, granting threat actors access to user information.

Newly Discovered Vulnerabilities

Microsoft released emergency out-of-band patches for Office zero-day vulnerability CVE-2026-21509, which is actively exploited to bypass security features through malicious Office files.
Fortinet patched a critical authentication bypass vulnerability in FortiOS/FortiCloud SSO (CVE-2026-24858) after reports of active exploitation in the wild.
A critical remote code execution vulnerability has been disclosed in Grist-Core, an open-source spreadsheet-database platform, exploitable via spreadsheet formulas.
A critical sandbox escape flaw (CVE-2026-22709) was found in the vm2 Node.js library, allowing arbitrary code execution on host systems.
OpenSSL patched 12 vulnerabilities, including a high-severity remote code execution flaw.
‘PackageGate’ vulnerabilities in the JavaScript ecosystem allow bypassing NPM supply chain attack protections, leading to arbitrary code execution.
A critical Telnet server flaw exposes legacy and IoT systems to unauthenticated remote access and shell control.
Linux vulnerabilities are being actively exploited, enabling attackers to obtain root privileges or bypass authentication via Telnet.

Notable Threat Actor Activity

The HoneyMyte (aka Mustang Panda/Bronze President) APT group has updated its CoolClient backdoor and is deploying multiple infostealers, including three browser data stealer variants and clipboard monitoring tools, in recent campaigns.
China-aligned APT actors have been using a JScript-based command-and-control (C2) framework called PeckBirdy since 2023 to target multiple environments.
Pakistan-linked threat actors have conducted two cyber campaigns against Indian government entities using previously undocumented techniques.
The ShinyHunters group is running a large-scale phishing campaign targeting over 100 organizations with credential harvesting domains.
The World Leaks ransomware/extortion group claims responsibility for the Nike data breach and has published stolen data to pressure the victim.
Multiple threat actors continue to exploit the WinRAR CVE-2025-8088 vulnerability for initial access and malware deployment.
The ‘Stanley’ malware-as-a-service toolkit enables malicious Chrome extensions to overlay phishing content on legitimate websites without altering the visible URL.
A new ransomware strain, ‘Sicarii’, has emerged, featuring poor code quality and a possible false-flag Hebrew identity, and currently cannot be decrypted.

Trends, Tools, or Tactics of Interest

Attackers are increasingly weaponizing trusted Remote Monitoring and Management (RMM) tools to establish persistent backdoor access in victim networks.
Recent phishing campaigns are leveraging fake CAPTCHAs, Microsoft App-V scripts, and trusted web services to distribute infostealers (ClickFix-style attacks).
Modern ransomware operations are shifting from pure encryption to psychological extortion, leveraging stolen data and exposure threats to increase pressure on victims.
AI-generated data degradation (“model collapse”) is raising concerns about accuracy, malicious activity propagation, and PII protection in zero-trust environments.
Browser extensions are being used as undetectable phishing vectors, with malicious overlays on legitimate sites while maintaining the original URL.
Supply chain vulnerabilities in JavaScript/NPM environments remain a critical risk, with new bypass techniques emerging.
The exposure and exploitation of legacy protocols such as Telnet continue to present significant attack surfaces, especially in IoT and OT environments.

Regulatory or Policy Developments Affecting the Security Industry

Meta (WhatsApp) has introduced a ‘Strict Account Settings’ security mode to protect high-risk users from spyware and advanced cyber attacks, similar to Apple’s Lockdown Mode.
Criticism has been raised regarding MITRE’s management of the CVE vulnerability database, with calls to transfer oversight to the private sector for improved efficiency.
TikTok has narrowly avoided a US ban by forming a new American joint venture, impacting data governance and regulatory oversight for the platform in the US.

Cybersecurity Brief – 2025-10-02

Thu, 02 Oct 2025 00:00:00 +0000

Major Incidents or Breaches

Motility Software Solutions suffered a ransomware attack exposing sensitive data of 766,000 dealership software clients.
WestJet confirmed that a cyberattack compromised personal information, including passport and ID documents, of 1.2 million customers.
Allianz Life announced that a July data breach impacted nearly 1.5 million individuals.
Adobe disclosed an ingestion bug in its Analytics platform that resulted in customer tracking data being exposed to other tenants for approximately one day.
Executives at multiple companies received extortion emails from the Clop ransomware group, claiming theft of sensitive data from Oracle E-Business Suite systems.
Unknown threat actors have exploited Milesight industrial cellular routers since at least February 2022 to send smishing SMS messages targeting European users.

Newly Discovered Vulnerabilities

A critical vulnerability in Red Hat OpenShift AI could allow attackers to escalate privileges and gain full control over hybrid cloud infrastructure under specific conditions.
A high-severity flaw in One Identity OneLogin IAM allowed attackers to use API keys to steal OpenID Connect (OIDC) secrets and impersonate applications.
OpenSSL patched three vulnerabilities that could allow private key recovery, code execution, and denial-of-service attacks.
Google’s Gemini AI suite contained vulnerabilities permitting attackers to embed malicious instructions in user web activity.
A bug in classic Outlook causes the client to crash on launch, with resolution only available via Microsoft Exchange Online support.
A newly demonstrated attack, dubbed “WireTap” or “Battering RAM,” enables attackers with physical access to extract Intel SGX ECDSA keys and break confidential computing protections on Intel and AMD processors via DDR4 memory-bus interposers.
Broadcom failed to disclose zero-day exploitation of a VMware vulnerability affecting Aria Operations and VMware Tools, which could allow privilege escalation on virtual machines.

Notable Threat Actor Activity

The Clop ransomware group is conducting a new extortion campaign targeting Oracle E-Business Suite users.
A previously undocumented Android banking trojan, “Klopatra,” has infected over 3,000 devices, mainly in Spain and Italy, using hidden VNC for remote control.
Chinese APT “Phantom Taurus” is targeting organisations with the Net-Star malware, focusing on espionage and using infrastructure linked to other Chinese APTs but employing distinct TTPs.
Threat group UNC6040 (ShinyHunters) has been observed using advanced social engineering tactics to breach Salesforce environments.
The Rhadamanthys malware, a complex multi-modular stealer sold on underground markets since 2022, has received notable updates.

Trends, Tools, or Tactics of Interest

Bitdefender’s 2025 Cybersecurity Assessment Report highlights increased pressure to conceal breaches, expanding attack surfaces, and rising misperceptions around AI security.
Attackers are leveraging industrial IoT devices (Milesight routers) to conduct large-scale smishing campaigns.
The Klopatra Android malware uses hidden VNC for hands-on device control, indicating a trend towards more interactive mobile banking attacks.
Research demonstrates that confidential computing protections (Intel SGX, AMD SEV) can be bypassed with low-cost hardware if physical access is obtained.
“Burp AI” is being adopted by security professionals for automated vulnerability scanning in bug bounty workflows.
Google Drive for desktop is rolling out AI-powered ransomware detection that pauses file syncing upon detecting an attack.
AmCache forensic artifact analysis is highlighted as valuable for incident investigations, with new command-line tools available for data extraction.
Undead (unsupported) operating systems, especially with Windows 10 reaching end-of-life, are set to significantly increase the vulnerable attack surface in enterprise environments.

Regulatory or Policy Developments Affecting the Security Industry

KnowBe4 is pursuing ISO 42001 certification for AI governance as it integrates more AI into its human risk management platform.
F-Droid project warns it may cease operations due to Google’s new developer identity verification requirements.
NIST published Special Publication 1334, offering guidance on mitigating USB-borne threats in industrial control system (ICS) and OT environments.
CISA reiterates that microsegmentation is foundational, not optional, for zero trust architectures, and highlights modern, automated approaches to implementation.
Microsoft will begin automatic installation of Microsoft 365 companion apps on Windows 11 devices with existing Microsoft 365 desktop clients later this month.