kyber.today

daily cyber × ai intelligence

← attack phases

phase 9 of 14

Discovery

Mapping the environment once inside.

39 stories

October 17, 2026

  • CERT-In warned on 15 October that AI agents under test reached live systems at Indian organisations and read business records including personal data and confidential material, exceeding their assigned tasks — and that none of the affected organisations detected the access themselves (The Hacker News). · AI & Model Security · also collection

October 16, 2026

  • JPCERT/CC confirmed attackers were using AI for known-vulnerability scanning and API attacks. Investigators found multiple attack servers targeting services both inside and outside Japan. Artifacts showed attackers unpacking Android applications, reverse-engineering Flutter apps with Blutter and Android code with jadx, extracting backend API details and testing them for issues including SSRF. JPCERT/CC does not identify the model or threat actor involved. · AI & Agent Security

October 14, 2026

  • Denmark's CPR breach traced to the password 123456. The person claiming responsibility told Politiken they reached the Central Register of Persons through an IT company account protected by that password, and the paper reports at least three company accounts — including an administrator account — shared it. Access began 10 September, with 14 million automated searches run through 20 September; the intrusion was not detected until 2 October, 12 days after the last search, when a staffer noticed an unusually large invoice from supplier Pays ApS. Data on 8.8 million people was accessed from a register of roughly 11 million records (The Register) (earlier coverage). · Nordics & Europe · also initial access, collection

October 11, 2026

  • A single unvalidated JWT exposed an internal Microsoft analytics service holding an estimated 17.3 trillion rows. Researcher "Faav" found the service, codenamed Titan, via an unlinked API endpoint on an Azure Cloud Services host with a public Swagger file; changing the upn field to admin yielded working SQL query execution with no real credentials. The timeline shows the lead surfaced on 25 August 2026 by the researcher's own AI hunting agent ("Antares"), with access to 30 live routing targets and 17 analytics databases confirmed and reported to MSRC on 5 September. Testing was limited to two one-row samples; no customer data was dumped. Notably, the researcher states Microsoft had editorial control over the post, cutting sections and figures before publication. blog.faav.net (discussion) · Cloud & Identity · also initial access
  • Swiss marketplace Ricardo (SMG Swiss Marketplace Group) disclosed exposure of ~890,000 user accounts after detecting suspicious server activity on 7 October. Names, postal addresses, phone numbers and company names for business users were accessed through a vulnerability since fixed; email addresses and passwords were not affected, and the FDPIC was notified. webdisclosure · Nordic & Regional

October 9, 2026

  • Two more AI-stack exposures: thousands of internet-exposed NVIDIA GPUs were found through the DCGM exporter, with a disruption path tracked as CVE-2026-47483 (Lava Security), and CERT.pl disclosed a relative path traversal in Ollama (CVE-2026-103663) (CERT.pl). · AI & Model Security · also initial access

October 1, 2026

  • China-nexus UAT-11587 has hit at least 16 institutional environments across eight Asian countries — including Taiwan, India, the Philippines and Cambodia — since Talos first observed it in September 2025, delivering Antino, a Rust-compiled Windows backdoor supporting recon, shell/PowerShell execution, file transfer and in-memory shellcode (Cisco Talos). · Threat Intelligence · also initial access, execution

September 29, 2026

  • JadePuffer (Microsoft: Storm-3168) used two compromised Azure service principals from the same tenant to map resources and then delete them — a destructive stage lasting seven minutes against more than 100 storage accounts plus Key Vaults, Function Apps, VMs and App Services, in an ~18-hour June operation. Azure resource locks and storage-account-level protections saved some accounts; SQL database deletion failed because the attacker used an unsupported API version. Credentials for one service principal had appeared in a public GitHub issue before the attack (BleepingComputer, The Hacker News). Roughly half an hour after the wipe, the actor returned for 30+ storage-key requests, most successful. · Cloud & Identity · also impact
  • Misconfigured Supabase applications are exposing data in more than 16,000 databases — the familiar RLS-off pattern at scale (BleepingComputer). · Cloud & Identity · also collection

September 28, 2026

  • Cloudflare has fixed the Containers/Sandboxes cross-tenant flaw (earlier coverage) and published the mechanics: a shared storage pool skipped zeroing reused 64 KiB blocks, so writing 4 KiB into a new container's disk left up to 60 KiB of a previous tenant readable. Researchers found residual material on 18 of 24 container placements and 20 of 22 underlying nodes tested, including directory structures, database pages and structurally complete SQLite databases; reported via HackerOne on 4 September (BleepingComputer). · Cloud & Supply Chain

September 27, 2026

  • Microsoft's internal Titan analytics API validated every JWT claim except the signature. A researcher publishing as Faav submitted an alg:none synthetic token with upn set to admin, mapped to local admin, and reached the /v2/Query SQL route with no real Microsoft credentials — 30 live routing targets and 17 connected analytics databases, an estimated 17.3 trillion stored rows. Testing was limited to two one-row samples and reported to MSRC on 5 September. Notably, the researcher states Microsoft had editorial control over the write-up, cutting sections and figures (Faav). · Vulnerabilities & Exploits · also initial access, collection
  • Undocumented AWS CodeConnection APIs can be driven from inside a CodePipeline build job or SageMaker Studio notebook to enumerate, clone, push to and delete connected source repositories — a concrete CI/CD pivot from compute into the code supply chain (Thomas Preece). · Cloud & Identity · also lateral movement

September 25, 2026

  • File-notification systems leak behaviour across Linux, Android, Windows and macOS (ACM CCS, 15–19 November, The Hague). On Windows, watching C:\ reports the full path of every file touched anywhere on the system regardless of permissions and across users — Microsoft calls it an undocumented feature, and the response earned a Pwnie nomination for lamest vendor response 2026. On Linux, an inotify watch on a readable directory reports events for files the attacker cannot read, including /dev/input for inter-keystroke timing. On Android, FileObserver bypasses the FUSE per-app storage view, demonstrated against WhatsApp. The authors say they are unaware of in-the-wild exploitation. inoti.fyi, The Register · Vulnerability Research

September 20, 2026

  • adnullenum — single-pass anonymous (null-session) Active Directory enumeration over \samr and \lsarpc, in impacket and non-impacket variants. Pulls domain info, password/lockout policy, RID discovery, per-user detail (group membership, logon hours, allowed workstations, account flags) and group membership in one run, degrading gracefully when SAMR is locked down and still pulling DNS/forest/trust data from LSA. Writes timestamped run folders with txt/csv/json, a manifest, ready-to-use userlist.txt/computerlist.txt and a saved RID list, and flags AS-REP-roastable accounts, PASSWD_NOTREQD, unconstrained delegation, and descriptions containing passwords. GitHub · New Tools & Releases · also reconnaissance

September 17, 2026

  • Spain's AEPD disclosed its first personal-data breach notification involving an attack allegedly carried out by an AI agent running on a well-known LLM. Per the notification, the agent searched files for weaknesses, logged in, then autonomously hunted for flaws in the application before modifying personal data and accessing invoices. AEPD has not yet verified the report, and notes that confirmation would not imply the model or its provider's infrastructure was compromised. AEPD, BleepingComputer. · AI & Agent Security · also initial access, credential access, lateral movement, exfiltration, impact

September 16, 2026

  • CVE-2026-39364 is being mass-scanned for cloud secrets on exposed Vite development servers. F5 Labs observed August requests targeting environment files, certificates, AWS and Azure configurations, Terraform state and Serverless configuration through a query-parameter bypass. Exploitation requires a network-exposed dev server, a target under server.fs.allow and a matching server.fs.deny rule; Vite’s default localhost binding is not internet-exposed (The Hacker News). · Vulnerabilities & Exploitation

September 14, 2026

  • An unattended Hermes agent handled post-exploitation inside Thailand’s Ministry of Finance. From July 9–13, 2026, Hunt.io found three exposed attacker directories containing exploit code, webshells, suo5 tunnels, scripts with hard-coded stolen credentials, and Hermes logs. Those logs showed the agent in approval-disabled “YOLO” mode enumerating ministry hosts, traversing files, and collecting LinPEAS output from an adjacent system. Active session cookies, deployed webshells, and internal-network access indicate compromise of multiple systems, although the initial-access path remains unknown and deployment of two staged WAR files was not confirmed. Recovered Windows and Linux samples belonged to the same custom Go implant, which the operator called Hades, and contained hard-coded C2 addresses. · AI-Enabled Threat Activity · also execution, collection

September 12, 2026

  • Cisco tied exploited FMC flaws to credential theft, a Cyclops Blink variant, and Qilin ransomware. The Hacker News reports that UAT-12197 used CVE-2026-20079 for web shells and credential access, UAT-11823 combined it with CVE-2026-20316 to deploy Cyclops Blink, and UAT-11988 used the latter for initial access before living-off-the-land reconnaissance and Qilin deployment. CISA’s September 12 patch deadline for U.S. federal civilian agencies is now in effect (earlier coverage). · Vulnerabilities & Active Exploitation · also initial access, execution, credential access

August 28, 2026

  • Aurora ransomware operators used the Cursor coding agent live during intrusions. Researchers recovered weeks of operator interaction logs from attacker infrastructure showing AI assistance for internal enumeration, Active Directory reconnaissance, privilege discovery, VPN/proxy configuration, credential hunting and general troubleshooting across seven victim companies (Reuters). · AI & Model Security · also credential access, lateral movement

August 18, 2026

  • CoSnitch manipulated Microsoft Copilot into mapping its own architecture and security weaknesses. Researchers used the “meta-hacking” approach to uncover a one-click flaw capable of silently exfiltrating data, according to the primary Varonis research. Dark Reading details how Copilot was induced to reveal information that helped construct the attack. (discussion) · AI & Model Security · also exfiltration

August 17, 2026

  • AppFlowy authenticated SQL injection. The vendor patched its SaaS but left the self-hosted OSS build vulnerable — a reminder to check which branch you're actually running (project.black). · Vulnerabilities & Exploits
  • MCP servers as a quiet enterprise-secret leak. THN walks through how plaintext config files, over-permissioned access, and prompt injection let MCP servers expose secrets — often before security teams even know a server is running (The Hacker News). · AI & Model Security · also collection

August 14, 2026

  • The Metabase pre-auth SQL injection zero-day now has a CVE and a technical writeup. Horizon3 details CVE-2026-72898, an actively exploited unauthenticated SQLi in Metabase before x.63.5 that yields admin access, config modification, and data theft — the flaw that had circulated without a CVE now formally tracked (earlier coverage). (Horizon3) · Vulnerabilities & Exploits · also initial access, credential access

August 13, 2026

  • The "City-Forum" campaign is quietly exfiltrating data from Salesforce and ServiceNow by abusing unauthenticated guest access to enumerate and pull exposed records. Active since at least March 2025 across multiple sectors, it uses custom tooling, per Dark Reading and SecurityWeek. · Threat Activity · also exfiltration

August 6, 2026

  • Critical Gitea flaw lets unauthenticated attackers read any file the service account can access via crafted Org-mode markup (CVE-2026-59774, CVSS 9.8) in versions 1.22.1–1.27.0; fixed in 1.27.1 (The Hacker News). · Vulnerabilities & Exploits
  • Others worth noting: a CVSS 10.0 cross-tenant flaw in HashiCorp's Terraform MCP Server (one user's token reusable by later users) plus a CVSS 9.5 unauthenticated Veeam Service Provider Console bug, among 11 patched (The Hacker News); and an unfixed path-traversal in Apache Dubbo 3.0.0–3.3.6 (SecureLayer7). · Vulnerabilities & Exploits · also privilege escalation

August 4, 2026

  • Rocket.Chat unauthenticated LFI via path traversal. A high-severity local file inclusion in /custom-sounds/ under FileSystem storage was patched and disclosed on HackerOne (HackerOne). · Vulnerabilities & Exploits

July 29, 2026

  • Over 24,000 internet-exposed BMCs leak password hashes pre-login via a ~20-year-old IPMI flaw. Of 36,872 exposed IPMI management interfaces, 24,650 disclose password-derived authentication hashes before any login — offline-crackable and ripe for lateral movement into server management planes (BleepingComputer, The Hacker News). · Vulnerabilities & Exploits
  • "Ghost credentials" — dormant non-human identities are opening hidden cloud attack paths, with researcher Aleksandr Krasnov releasing an open-source tool to map the trust paths these forgotten NHIs create (Dark Reading). · Cloud & Identity · also credential access, lateral movement

July 26, 2026

  • UK AISI/CAISI's preliminary assessment of Moonshot's Kimi K3 finds it lags US frontier labs on offensive cyber capability, but that its guardrails failed to stop users from developing exploits, per NIST (discussion) and earlier coverage. Practitioners are already leaning on that permissive posture — @Dinosn reports valid findings against real scoped assets, calling its guardrails "ideal for pentest." · AI & Model Security
  • A forum actor claims 1.95M records from Spain's Ministry of Foreign Affairs via an IDOR flaw — a 2.45GB JSON archive of names, emails, DOBs, nationalities, phone numbers, and ID document data listed for $1,500 — alongside separate claims against the UK Police National Legal Database (~135K law-enforcement contacts) and the UK Department for Education (~600K records), all currently unverified, per DarkWebInformer. · Data Breaches & Leaks · also collection

July 25, 2026

  • Hermes AI agent run unattended against Thailand's Ministry of Finance. An operator installed the assistant on a rented server, disabled its command-confirmation prompt, and pointed it at the ministry's network — where it autonomously enumerated hosts for root paths, hunted filesystems and staged a custom Hades implant. The Hacker News, Hunt.io. · AI & Model Security · also initial access, execution

July 20, 2026

  • GhostHound — a BloodHound OpenGraph extension that surfaces Active Directory tombstone reanimation as a first-class attack path, enumerating deleted objects via SHOW_DELETED, mapping who can restore them, and flagging when a reanimated identity regains privileged group membership (GitHub). · New Tools & Releases · also lateral movement

July 18, 2026

  • Immich BOLA — a broken object-level authorization flaw in the self-hosted media platform lets DAST bypass its "locked folder" protection (Escape). · Vulnerabilities & Exploits
  • TP-Link Kasa EC71 cameras leaked precise home GPS via unauthenticated UDP for six years (CVE-2026-13230), returning sub-meter coordinates to a single packet; the researcher rates it 7.1 High versus TP-Link's 5.3 (write-up) (discussion). gruez tempers the framing, noting exposure requires LAN access rather than direct internet reach. · IoT & Policy

July 15, 2026

  • A researcher registered on FIFA's public Agent Platform and was auto-added to FIFA's internal Microsoft Entra tenant — the same tenant powering its internal systems. The Angular app only checked roles client-side while backend APIs served everything, including RTMP ingest URLs and stream keys for World Cup 2026 camera feeds. The researcher reported "the Angular app only checked roles client-side; the backend APIs served everything," including write access to match stats and the live score system. bobdahacker.com, Schneier (discussion) · Cloud & Identity · also initial access