wolfSSL on DanSec Daily

Cybersecurity Brief – 2026-09-30

Wed, 30 Sep 2026 00:00:00 +0000

Major Incidents or Breaches

Cryptocurrency exchange Bitget suffered a breach resulting in a $387.5 million loss after attackers exploited a zero-day vulnerability in a third-party security product used by the company ^[15].
The French tax administration experienced a data breach in which an attacker used stolen staff credentials to exfiltrate tax data belonging to hundreds of thousands of individuals and businesses. The compromise went undetected for seven weeks ^[9].
The Dutch Institute for Vulnerability Disclosure (DIVD) was breached via an automated AI agent in an attack described as “loud and very, very messy” ^[24].
South Africa’s air traffic control systems were targeted by a cyberattack that deployed a ransomware toolkit on at least one operational network ^[25].
AI coding agents inadvertently exposed more than 13,000 internal company images, including billing records, by uploading screenshots to public GitHub repositories ^[4].

Newly Discovered Vulnerabilities

Multiple critical vulnerabilities have been disclosed and patched in Citrix NetScaler ADC and Gateway products, including CVE-2026-88772 and CVE-2026-88771. These flaws allow pre-authentication code execution and have been actively exploited to gain root access, deploy web shells, steal credentials, and move laterally within victim networks. Government and finance organizations are among those affected ^[6]^[8]^[20]^[30]^[36].
OpenSSL released fixes for a high-severity DTLS flaw that can leak heap memory to the other side of a DTLS connection or cause a crash. WolfSSL also patched several high-severity vulnerabilities ^[7]^[41].
TeamViewer warned users to urgently patch a set of high-severity vulnerabilities in its client and host software ^[14].
A newly disclosed Spectre-v2 Branch Target Reuse (BTR) attack variant enables attackers to recover Linux root password hashes in minutes, bypassing existing mitigations ^[10]^[23].
Apple reported that CVE-2026-86950, an out-of-bounds write vulnerability, is being actively weaponized in targeted attacks ^[26].
WatchGuard issued patches for 15 vulnerabilities in Fireware OS, including code execution, denial of service, authorization, and path traversal bugs ^[35].
Unsloth Studio patched a vulnerability allowing malicious AI models to execute arbitrary Python code during model inspection if the trust_remote_code setting is enabled ^[27].
Chrome and Firefox released updates addressing over 100 vulnerabilities, some of which could allow remote code execution or sandbox escape ^[37].

Notable Threat Actor Activity

Russian state-sponsored group Star Blizzard (also known as APT29) has conducted large-scale phishing campaigns using fake event invitations and the ‘RedFlick’ infection chain to deliver the CosmicPulse backdoor, targeting over 100 organizations ^[11]^[39].
Microsoft observed a China-based actor, dubbed ‘NeedyMantis’, using a previously unidentified malware framework for long-term access in targeted intrusions against telecommunications, universities, medical, and government-related organizations ^[29].
The ShinyHunters extortion group was addressed by the FBI following the arrest of an alleged leader, with the FBI urging remaining members to turn themselves in. ShinyHunters responded defiantly ^[19]^[40].

Trends, Tools, or Tactics of Interest

Social engineering attacks are increasingly leveraging audio and video deepfakes, with 41 percent of CISOs reporting an audio deepfake attack against their organization in the past year and 36 percent reporting deepfake targeting of employees ^[1].
Custom malicious ChatGPT variants promoted via sponsored Google results are being used to lure victims to sites that deploy RAT malware through ClickFix attacks ^[18].
Recent US-focused phishing campaigns targeting C-suite executives have been observed stealing Microsoft 365 sessions and deploying remote monitoring and management (RMM) tools for persistent remote access. The campaigns predominantly targeted technology, manufacturing, government, and consulting sectors ^[5].
Browser-based attacks remain a significant initial vector for breaches, with many attacks contained entirely within browser sessions ^[3].
AI agent security is being addressed with new tools such as KnowBe4’s Agent Risk Manager, which integrates with the Claude Compliance API to monitor and detect AI agent risks in real time ^[2].
Anthropic and other industry voices are raising concerns over liability risks associated with autonomous AI agents, as lawsuits emerge following incidents involving AI-driven attacks ^[33]^[38].

Regulatory or Policy Developments Affecting the Security Industry

Microsoft will implement new protections in Entra ID to block external script injection attacks starting in October ^[13].
Cloudflare announced a public certificate authority designed for post-quantum cryptography, offering automated certificates intended to be resistant to quantum computing threats ^[28].
A group of major technology firms has signed a voluntary accord to self-police AI development, focusing on four key steps and signaling the possibility of future regulation ^[42].
DARPA selected Xint to use AI for identifying vulnerabilities in military messaging apps, with potential commercial applications ^[44].

Sources

Bitget hacked via zero-day in third-party security products - bleepingcomputer.com
French Tax Data Theft Using Stolen Staff Passwords Went Undetected for Seven Weeks - thehackernews.com
Automated AI agent used to breach cybersecurity nonprofit DIVD - bleepingcomputer.com
South Africa Seeks Help After Cyberattack Targets Air Traffic Control - darkreading.com
AI Coding Agents Exposed 13,000 Internal Images, Including Billing Records, on GitHub - thehackernews.com
Attackers Exploit NetScaler Flaw for Root Access, Deploy WHIPSHOT and SLAPSHOT - thehackernews.com
Citrix NetScaler CVE-2026-88772 Exploit Details Show Pre-Auth Path to Shellcode Execution - thehackernews.com
Hackers exploit Citrix NetScaler zero-day to deploy web shells - bleepingcomputer.com
Dual NetScaler Zero-Days Trigger Chaos for Citrix Customers - darkreading.com
Government, Finance Orgs Targeted in Weeks-Long NetScaler Zero-Day Attacks - securityweek.com
OpenSSL Fixes High-Severity DTLS Flaw That Can Leak Heap Memory Unencrypted - thehackernews.com
High-Severity Vulnerabilities Patched in OpenSSL, WolfSSL - securityweek.com
TeamViewer urges users to patch severe flaws “as soon as possible” - bleepingcomputer.com
New Spectre-v2 BTR Attack Leaks Linux Memory Despite Existing Defenses - thehackernews.com
New Spectre v2 attack variant leaks Linux root password hash in minutes - bleepingcomputer.com
Apple Zero-Day Vulnerability Weaponized in Targeted Attacks - darkreading.com
WatchGuard Patches Critical Fireware OS Code Injection Vulnerability - securityweek.com
Unsloth Studio Flaw Turns Routine Model Inspection Into Code Execution - darkreading.com
Chrome, Firefox Updates Patch Over 100 Vulnerabilities - securityweek.com
Russia's Star Blizzard Targets 100+ Organizations With Fake Event Invites to Deliver Backdoor - thehackernews.com
Russian APT Star Blizzard Uses ‘RedFlick’ Infection Chain in Recent Attacks - securityweek.com
'NeedyMantis' Provides Long-Term Access to Compromised Networks - darkreading.com
FBI tells ShinyHunters members to turn themselves in after recent arrest - bleepingcomputer.com
ShinyHunters Defiant After FBI Calls on Members to Come Forward - securityweek.com
Report: Social Engineering Attacks Are Increasingly Using Audio and Video Deepfakes - blog.knowbe4.com
Custom ChatGPTs push ClickFix attacks to deploy RAT malware - bleepingcomputer.com
US-Focused CSuite Phishing Steals Microsoft 365 Sessions and Deploys RMM Tools for Remote Access - thehackernews.com
Know Your Enemy: Browser-Based Attack Techniques in 2026 - thehackernews.com
Govern Claude AI with KnowBe4’s Agent Risk Manager - blog.knowbe4.com
OpenAI Gets Sued Over the Hugging Face Hack - wired.com
Anthropic Flags AI Agent Liability Risks as OpenAI Faces Hacking Lawsuit - securityweek.com
Microsoft to block Entra ID script injection attacks starting October - bleepingcomputer.com
Cloudflare Announces Public Certificate Authority for the Post-Quantum Web - darkreading.com
Trump Says Top Tech Firms Have Signed Accord to ‘Self-Police’ AI Development - securityweek.com
DARPA Selects Xint to Use AI in Securing Military Messaging Apps - securityweek.com

Cybersecurity Brief – 2026-04-14

Tue, 14 Apr 2026 00:00:00 +0000

Major Incidents or Breaches

Basic-Fit, a major European gym chain, disclosed a data breach affecting one million customers, with hackers accessing personal information.
Booking.com confirmed unauthorized access to its systems, exposing sensitive reservation and user data and prompting a forced reset of reservation PINs.
Rockstar Games suffered a data breach involving analytics data, attributed to the ShinyHunters extortion gang, following a security incident at analytics provider Anodot.
CPUID, developer of CPU-Z and HWMonitor, was compromised, leading to the distribution of trojanized installers (STX RAT) via modified download links.
OpenAI rotated macOS code-signing certificates following a supply chain attack involving a malicious Axios package executed in a GitHub Actions workflow; the incident is linked to North Korea.
The Los Angeles Police Department reported a data breach, as highlighted in Check Point’s latest threat intelligence bulletin.

Newly Discovered Vulnerabilities

Adobe released an emergency fix for a zero-day vulnerability (CVE-2026-34621) in Acrobat and Reader, which has been exploited in the wild since at least December 2025. The flaw allowed remote code execution via malicious PDF files.
ShowDoc, a document management platform, is affected by a critical remote code execution vulnerability (CVE-2025-0520) that is actively exploited on unpatched servers.
A critical vulnerability in the wolfSSL library allows attackers to bypass certificate verification by exploiting improper handling of the hash algorithm or size in ECDSA signature checks.
CISA added six actively exploited vulnerabilities affecting Fortinet, Microsoft, and Adobe products to its Known Exploited Vulnerabilities (KEV) catalog, indicating ongoing exploitation.

Notable Threat Actor Activity

JanelaRAT, a financial malware derived from BX RAT, has been observed in an ongoing campaign targeting banks and financial institutions in Latin America, with over 14,700 attacks in Brazil in 2025. The latest variants show updates to infection chains and malware capabilities.
North Korea-linked APT37 (ScarCruft) is conducting a multi-stage social engineering campaign via Facebook, delivering the RokRAT malware to targets.
APT41, a Chinese state-backed group, is deploying a “zero-detection” backdoor to harvest cloud credentials from AWS, Google, Azure, and Alibaba environments, using typosquatting to obscure command-and-control communications.
The W3LL phishing network, responsible for global phishing campaigns and $20 million in fraud attempts, was dismantled in a joint operation by the FBI and Indonesian police, resulting in the arrest of the alleged developer.
A new commodity phishing kit, “Venom Stealer,” is enabling automation of ClickFix attacks, a social engineering technique used to bypass multi-factor authentication.
A new infostealer dubbed “Storm” leverages server-side decryption to hijack browser sessions, enabling attackers to bypass passwords and multi-factor authentication protections.
Fake Claude (Anthropic) websites are distributing PlugX RAT via DLL sideloading, using legitimate branding to lure victims and employing clean-up routines post-infection.
Russian-speaking threat actors compromised CPUID’s download infrastructure to distribute the STX RAT.
International law enforcement operations in the US, UK, and Canada targeted multimillion-dollar cryptocurrency theft schemes, identifying over $45 million in stolen assets and freezing $12 million.

Trends, Tools, or Tactics of Interest

Anthropic’s Claude Mythos AI model was temporarily restricted after autonomously discovering and exploiting zero-day vulnerabilities across major operating systems and browsers, prompting warnings of a potential “AI vulnerability storm.”
Attackers are increasingly scanning for webshells, including EncystPHP, with a focus on those lacking authentication or secured with default credentials.
There is a trend toward server-side decryption in infostealer malware, as demonstrated by the “Storm” infostealer, which enables session hijacking and circumvents MFA.
Social engineering via social media platforms (e.g., Facebook) continues to be leveraged by state actors for initial access and malware delivery.
Gmail has introduced end-to-end encryption for enterprise users on Android and iOS, allowing secure message composition and reading on mobile devices.

Regulatory or Policy Developments Affecting the Security Industry

Operational Technology (OT) asset owners are being required by regulators to attest to their post-quantum cryptographic readiness, despite lacking adequate tooling to provide genuine security assurances.
Civil society organizations have issued warnings to Meta regarding potential risks associated with facial recognition features in smart glasses, citing privacy and safety concerns for vulnerable populations.