kyber.today

daily cyber × ai intelligence

← attack vectors

vector 3 of 22

Exposed service

An internet-facing server, admin panel, database or API reached directly.

70 real attacks

November 8, 2026

  • New telemetry expands the scope of Europe’s refrigeration attacks. Unit 42 puts the October 11–12 wave at roughly 700 French supermarkets and the November 1–2 wave at 100–115 locations across at least ten additional countries. NCSC–CERT-SE says Swedish food stores were affected. Unit 42 also found more than 5,000 exposed devices from named manufacturers on November 5–6. Initial access remains unconfirmed, and hacktivist attribution claims remain unverified (earlier coverage). · Threat Activity & Operations

November 7, 2026

  • Microsoft Threat Intelligence attributes October's ARTEX-driven financial-sector attacks to Storm-3358, a Cambodia-based, financially motivated cluster hitting banks in Southeast Asia plus a smaller number of large global firms. ARTEX agents scan internet-facing systems, exploit anonymous file upload and SSRF, then pull WISP, vshell and AdaptixC2 down with netcat and curl; follow-on activity includes web shells, credential harvesting, abuse of compromised cloud identities for persistence and exfiltration, password spraying, API enumeration and database dumping. IOCs are published in the write-up (Microsoft) (earlier coverage). · Agentic Tooling in the Wild
  • Chainalysis now says names, usernames, password hashes and live tokens for all users were exposed, and has pulled Reactor, Data Solutions, the KYT UI and API, address screening and the login page offline. An on-path attack captured a subset of customer passwords; affected accounts are locked, and restoration requires trusted-IP allowlisting followed by password resets and API key rotation. No evidence investigations data was accessed or attribution data manipulated (The Hacker News) (earlier coverage). · Agentic Tooling in the Wild
  • DigiCert's exposed internal system sat open for over 16 months. A February 2025 migration moved an archive off a VPN-protected network and onto the public internet, where it inherited the customer-facing self-registration flow; outsiders created non-MFA accounts and, via a permissions flaw, browsed archived records. DigiCert spotted the rogue accounts on 18 June 2026 and dismissed them, a researcher escalated on 21 June, access was closed on 2 July, and only on 19 October did it confirm records were read between 27 June and 2 July. Exposed data includes names, business contact details, and in some cases passports, driver's licences and utility bills; CA systems were unaffected (The Register, The Record) (earlier coverage). · Breaches & Incidents

November 6, 2026

  • Zyxel’s Patch 2 left the observed exploit path intact. Binarly separated the unauthenticated, root-capable CGI flaw into CVE-2026-107441, now fixed by Patch 3 for ten Zyxel GS1900 models. The exploit matches traffic associated with data theft from 996 switches, but neither Binarly nor GreyNoise proved those devices were running Patch 2, and Zyxel has not said the new CVE was exploited. CISA KEV still lists only CVE-2026-7273; researchers say a reduced PoC is forthcoming. The Hacker News · Vulnerabilities & Exploits
  • A new CISA/FBI alert elevates the refrigeration attacks into a global hardening priority. Agencies say malicious activity is targeting internet-accessible or unpatched cold-chain controllers across food, healthcare, transportation and chemicals. Hundreds of European supermarkets reportedly had temperatures raised, and controls were tampered with at three French blood-storage sites; linkage and attribution remain unproven. Operators are being told to remove unnecessary exposure, strengthen authentication and secure remaining remote access. CISA and The Record (earlier coverage). · Threat Activity & Infrastructure
  • GitBook’s postmortem traces its production breach from SSO to GitHub and Cloudflare. The company says an SSO flaw, a misconfigured GitHub integration and a Cloudflare API key enabled production access. GitBook is treating all customer data as exposed and cannot determine whether the attacker acted inside connected customer repositories; customers should rotate GitBook tokens, integration secrets and custom-backend signing keys. GitBook (earlier coverage). · Cloud, Identity & Incident Response
  • A migration error exposed a DigiCert internal business system to the internet. Unauthorized access reached archived customer contact information and, for some affected accounts, identity documents including passports, driver’s licenses and utility bills. The reporting provides no affected-customer count. BleepingComputer · Cloud, Identity & Incident Response

November 5, 2026

  • The European refrigeration sabotage reached France's national blood service. EFS confirmed that overnight into November 2, attackers raised temperature and defrost thresholds in cold-storage chambers at three sites; monitoring caught it, and no blood products were lost. EFS itself was not targeted — its refrigeration supplier was, and Coolworld Rentals confirmed an incident in its remote monitoring software that it blames on a third-party component (BleepingComputer, Infosecurity). The campaign has now hit 12 countries including Sweden, Finland, Estonia, Ireland, Belgium, the Netherlands, Luxembourg and Romania (Catalin Cimpanu); pro-Russian Z-Pentest Alliance, working with NoName057(16), claims it on Telegram, describing setpoint changes and forced constant defrost on internet-exposed Danfoss and Dixell XWEB controllers with no malware involved (DailyDarkWeb). Sekoia caught the same activity on four honeypots on Sunday evening (reposted by @cyb3rops). (earlier coverage) · Threat Activity
  • DreamHost says attackers exploited a flaw in its web-based File Manager, sat in its systems from August 2026 until discovery on October 23, and took FTP/SFTP usernames and passwords plus webmail credentials and session tokens (BleepingComputer). · Incidents & Enforcement

November 4, 2026

  • LLMjacking has matured into a two-tier criminal market, per GTIG and Mandiant: one cluster scans for exposed LLM endpoints, another steals API keys from unprotected machines, and both feed "LLM mixers" that resell access. Victims have seen fraudulent charges exceed $100,000 in a single day and cumulative costs reach $1,000,000; one actor pushed more than 500,000 API calls in under eight hours through jet-night.com, which sells "unlimited access plans" at $60/month. Google also tracks UNC6993 aggregating stolen keys, and has observed exploitation of CVE-2026-40217 in LiteLLM for RCE via the custom-code guardrail testing endpoint (BleepingComputer, Dark Reading). As one practitioner notes, resold keys stay live for weeks — alerting on AI key usage from a new region or at odd hours beats finding it on the invoice. · Cloud, Identity & AI Abuse

November 1, 2026

  • PHP2Shell roots PAN-OS management interfaces but keeps failing against WordPress, with 22.6 million exposed instances potentially in scope after more than a week of attacks (SecurityWeek). Intel 471's hands-on test of a working exploit for CVE-2026-109618/109619 found reliability varies sharply between Apache mod_php and PHP-FPM, and recommends restarting workers after patching plus disabling session.upload_progress and tightening request limits — useful triage given the volume of AI-hallucinated PoCs in circulation (Intel 471); earlier coverage. · Exploits & Vulnerability Research
  • Northflank's breach has moved from exposure to abuse, with customers' AI API keys being used by the attacker; the platform has enabled secret rotation for Postgres and MongoDB addons and is advising customers to disable public exposure on addons (BleepingComputer); earlier coverage. · Threat Activity

October 31, 2026

  • Northflank told every customer to assume environment variables were decrypted. The deploy platform's status page instructs users to rotate all workload, secret-group and global secrets immediately and disable public addon access, with Postgres and MongoDB addon rotation enabled for all users; the timeline starts with a Wiz threat alert at 11:43 UTC on October 30 and patching from 12:02 UTC, and multiple users report their AI keys were used (Northflank). · Supply Chain & Developer Tooling
  • Florida's Department of Education says 4.9 million financial-aid applicants may have had SSNs, names, dates of birth, addresses and phone numbers exposed after unauthorized access to the Florida Student Financial Aid website, discovered October 19 and contained by taking the site offline (The Record). @mohammadvazin makes the obvious point that retention is a security control — old applications nobody owned are the actual blast radius. · Breaches & Exposures
  • About 42 million documents sat in an unprotected repository tied to CitySourced, the Granicus civic-complaint platform used by local governments, with records dating 2016–2026; a sampled subset included resident names, addresses, emails, phone numbers and complaint details. Granicus says the issue was resolved in August (Jeremiah Fowler / ExpressVPN). · Breaches & Exposures

October 30, 2026

  • Palo Alto Networks updated its advisory to say active exploitation of the PHP2Shell bugs has been observed against management interfaces exposed to the internet (The Hacker News). CISA separately told federal agencies to patch a high-severity Linux kernel privilege-escalation flaw ("Fragnesia") that attackers are chaining with PHP2Shell post-exploitation (BleepingComputer). One vendor counts roughly half a dozen confirmed exploitations, and another describes a narrowly targeted, suspected Chinese campaign that breached U.S. "government affiliated" servers (The Record); CERT.dk issued a Danish-language advisory on China-linked actors using PHP2Shell against firewalls (CERT.dk). Kevin Beaumont says he is aware of a ransomware crew using PHP2Shell against Palo Alto firewalls for initial access and then moving laterally (@GossiTheDog). Exploitation remains far from commodity — the bug is complex enough that mass exploitation hasn't materialised, per @HacktronAI. (earlier coverage) · Exploitation at the Network Edge

October 29, 2026

  • Moldova's government breach was a mass data-extraction run against unauthenticated services. Roughly 11 million requests between October 19 and 23 pulled data tied to about 750,000 national ID numbers (names, birth data, family relationships, insurance, benefits, pensions, driver's licences, photos, vehicle and some financial records); attackers used what they obtained to pull more from interconnected systems. Authorities inspected 82 digital services and disconnected 30+ systems and admin panels; card data was not taken and no records appear altered. The PM says foreign state involvement is being examined, with no attribution (The Record, e-Government Agency). · Cloud & Identity

October 26, 2026

  • A campaign against exposed firewalls and VPNs yielded more than 70,000 credentials. A joint investigation attributed the activity to k0t, also known as CryptoFeel, Member19 and QazWsxShop. Operators scanned for FortiGate and GlobalProtect infrastructure, exploited CVE-2025-64446 in FortiWeb and CVE-2026-0257 in PAN-OS/Prisma Access or used password attacks, then enumerated Active Directory, SMB and antivirus products. Researchers assess k0t as a likely initial-access broker or affiliate with links to Qilin and The Gentlemen (The Hacker News). · Threat Activity

October 25, 2026

  • Keystone hardware-wallet customers had shipping data stolen via Shopify API access. Keystone detected unauthorised access to its site on October 20 and confirmed on October 23 that names, contact details, shipping addresses and order details (items and prices) were taken. No payment data, recovery phrases, private keys or wallet passwords — but a list of confirmed hardware-wallet owners with home addresses is a targeting dataset in its own right. (DailyDarkWeb) · Breaches & Data Exposure

October 23, 2026

  • LiteLLM's post-mortem points at its own AI gateway logs. The project says it observed Claude Code responses containing GitHub CLI OAuth tokens that could land in gateway logs, and suspects attackers reached its internet-facing internal LiteLLM deployment, lifted tokens, used an organization-owner token to disable branch protections and served poisoned artifacts from a lookalike repository. How attackers got into the gateway is still unconfirmed (earlier coverage). LiteLLM, The Hacker News · Supply Chain & Identity
  • Railway tells all users to rotate secrets. The PaaS (~4.8 million users, 16M+ services) found anomalous activity in the systems storing customer environment variables and says an unauthorized third party may have accessed encrypted variables and, in some cases, obtained decrypted contents. Railway describes the incident as part of a series of attacks on AI inference providers, who were told to revoke keys. BleepingComputer · Supply Chain & Identity

October 21, 2026

  • Qilin and INC ransomware operators continue exploiting PAN-OS CVE-2026-0257. The May-patched authentication bypass lets attackers establish unauthorized GlobalProtect VPN sessions and bypass MFA. Observed follow-on activity includes RMM-based reconnaissance, RDP and SMB lateral movement, and direct pivots into vCenter/ESXi; in one case, operators disabled execInstalledOnly and dumped domain credentials offline from a domain controller’s VMDK, evading in-guest EDR controls, according to The Hacker News. · Vulnerabilities & Exploits
  • A Russian-speaking operator achieved code execution on at least two Ukrainian hosts through Graylog. Between May and September, one rented server scanned 7,576 live Ukrainian hosts and filtered them using the string UXP Verifier. A two-stage CommonsBeanutils2/JNDI chain reached two logging servers; one Elasticsearch cluster contained 6,833,058 documents associated with Ukraine’s state data-exchange platform. Logs showed aggregate queries but no exfiltration, and the interactive reverse shell was not directly recorded, Hunt.io reports. · Threat Activity
  • SafePay has breached at least 600 organizations since August 2024. A joint US, UK and German advisory calls it one of 2026’s most active ransomware groups. Initial access includes stolen or guessed credentials, phishing and exploited perimeter flaws such as CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711 and CVE-2024-40766; operators then create or hijack accounts, disable defenses, use legitimate remote tools, exfiltrate data and encrypt systems. See the CISA advisory. · Threat Activity · also via stolen credentials, phishing email

October 16, 2026

  • Suspected PRC-nexus actor ARMORY CASTLE exploited BeyondTrust CVE-2026-102764 as a zero-day in late August. ARMORY CASTLE, formerly tracked as UNC5221, used the critical unauthenticated file-upload flaw against BeyondTrust Remote Support appliances; successful exploitation can lead to host-level control. Google Threat Intelligence Group ties the observed exploitation to the actor. · Vulnerabilities & Exploits

October 11, 2026

  • Swiss marketplace Ricardo (SMG Swiss Marketplace Group) disclosed exposure of ~890,000 user accounts after detecting suspicious server activity on 7 October. Names, postal addresses, phone numbers and company names for business users were accessed through a vulnerability since fixed; email addresses and passwords were not affected, and the FDPIC was notified. webdisclosure · Nordic & Regional

October 8, 2026

  • PoeLLM hides its C2 address in a poem on GitHub. Lumen Black Lotus Labs tracks the campaign as Canto Incognito: more than 3,400 victim servers since April 2026, peaking mid-June at nearly 2,200 affected and about 800 active per day, concentrated in the US and Western Europe. Targets are internet-facing LiteLLM, Gotenberg, Gitea and Ivanti Sentry deployments; the malware derives its C2 from four keywords in a poem the operator has edited repeatedly since 13 April, and compromised hosts are repurposed as scanners and exploit servers while mining via XMRig, Iron and Kryptex (Lumen, The Hacker News). · Threat Activity

October 3, 2026

  • Warlock ransomware is still getting in through SharePoint, a year after ToolShell. Symantec tracks the China-nexus developer as Longlegs (aka Storm-2603, previously tied to CL-CRI-1040, CamoFei and ChamelGang), and reports at least four victims in the past two months across Portuguese- and Spanish-speaking countries in Europe, Africa and Latin America: a water utility, a telecoms provider, a regional government body and a university. In one critical-infrastructure intrusion the operators pushed a security-software killer to 40+ hosts in about two hours, then deployed Warlock on at least 33 hosts by staging it in the domain SYSVOL share and letting normal domain replication do the distribution. Tradecraft includes the vulnerable signed K7RKScan driver for EDR removal and Visual Studio Code tunnels for covert remote access (Symantec, The Record). · Threat Activity & Malware

September 25, 2026

  • CISA flagged JetBrains TeamCity CVE-2026-63077 as used in ransomware attacks in its 24 September KEV update. The CVSS 9.8 bug lets an unauthenticated attacker abuse the agent polling protocol to run OS commands as the TeamCity server process — exposing stored credentials, build artifacts and downstream pipelines. Patched 25 July (2025.11.7 / 2026.1.3), in KEV since 5 August, confirmed exploited by JetBrains on 7 August. Shadowserver tracks just over 160 internet-exposed servers still unpatched, down from ~700. BleepingComputer, SC Media · Vulnerabilities & Exploits
  • The Finnish Reservists' Association (Reserviläisliitto) was breached through a WordPress core vulnerability, with its site database reachable for five days from 17–21 July 2026. During an investigation into a similar case in September it emerged that data had actually been viewed. Form submissions — name, date of birth, email, phone, postal address — for a few hundred of the association's 51,000 members were affected; the membership/national-defence register was not, and no malware or payment phishing was found. The data protection ombudsman was notified. Ilta-Sanomat · Nordics

September 17, 2026

  • CVE-2026-59310 in VMware vCenter is now flagged by CISA as used in ransomware campaigns. The CVSS 9.8 directory traversal in the vCenter Syslog server gives unauthenticated code execution and was patched by Broadcom on 29 July; QUIRSO subsequently identified more than 360 compromised IPs across 47 countries, with reverse SSH tooling planted for persistence. CISA has not named the ransomware groups, and hundreds of vCenter servers remain internet-exposed. CERT.dk, CISA KEV. · Active Exploitation
  • ConnectWise ScreenConnect exploitation now has a CVE and a KEV entry: CVE-2026-84869, an improper-privilege-management and missing-authorization pair allowing file transfer and execution through an active remote session without host confirmation, fixed in 26.6.5. Shadowserver still tracks over 1,000 exposed unpatched instances — 758 in North America, 180 in Europe (earlier coverage). BleepingComputer. · Active Exploitation
  • WSO2 API Manager's JWT bypass (CVE-2026-5430, CVSS 9.8) is being exploited: watchTowr honeypots captured tokens with administrator privileges baked in on 13 September. The service accepts tokens signed with algorithms it does not support and approves them anyway; API Manager 4.1.0–4.6.0, API Control Plane, Traffic Manager and Universal Gateway are affected, with fixes published in May. The Hacker News. · Active Exploitation

September 11, 2026

  • Surfshark says a misconfigured internal engineering test server was exposed to the internet and accessed by an unauthorized third party; it held parts of system binaries and service configs, and some build credentials had previously been committed to code history. No customer data or VPN traffic, per the company (BleepingComputer). · Breaches

September 10, 2026

  • Cisco Secure Firewall Management Center: Talos is tracking active exploitation of CVE-2026-20079 (CVSS 10.0, unauthenticated auth bypass to root) and CVE-2026-20316 (5.3, low-privileged login). Three post-compromise clusters: UAT-12197 deployed web shells, a JAR-based command executor and exfiltrated credentials; UAT-11823 chained both CVEs to a Netcat reverse shell, proxy tooling and a variant of Cyclops Blink, previously attributed to Sandworm; UAT-11988 — assessed with high confidence as a ransomware operator — entered via static credentials and ran living-off-the-land recon with FMC's own tooling, tunneling, credential harvesting and encryption target-listing. Hotfixes are out; a broader hardening release lands the week of 14 September (Talos, BleepingComputer). · Exploited in the Wild
  • N-able N-central moved from disputed to confirmed: CISA added CVE-2026-86218 (CVSS 10.0 static code injection, pre-auth RCE) to KEV with an FCEB deadline of 11 September, and N-able told customers it "has been observed being exploited in the wild." watchTowr reproduced it; Huntress still cannot say which bug hit its customer's fully patched appliance on 4 September because of limited on-box logging, and cannot rule out the CVE-2026-86206/86207 admin-creation chain (The Hacker News; earlier coverage). · Exploited in the Wild

September 9, 2026

  • CERT Poland put CVEs and IoCs on the MikroTik takeovers: CVE-2026-67276 (SSH auth bypass) chained with CVE-2026-86060 (SSH session privilege manipulation) has been used since at least 2 September against devices with SSH reachable from the internet, creating an account named ops, from 82.192.72.4 and 103.102.31.18. Shadowserver saw more than 120,000 MikroTik devices with SSH exposed during a 24-hour scan window on 5 September; fixes are in RouterOS 7.25beta3, 7.24.2, 7.23.4 and 6.49.21 (SecurityWeek) (earlier coverage). · Patch Tuesday & Active Exploitation

September 6, 2026

  • Attackers are taking over MikroTik RouterOS devices whose SSH service is exposed to the internet. CERT Polska disclosed six flaws—CVE-2026-67276, CVE-2026-67277, CVE-2026-67278, CVE-2026-67279, CVE-2026-67281 and CVE-2026-86060—including two critical issues. Its active-exploitation alert calls for immediate updates and compromise checks; the technical advisory covers the full set. · Vulnerabilities & Exploits

September 4, 2026

  • CISA added seven actively exploited flaws to KEV, spanning an unusually broad stack: CVE-2026-83548 (SonicWall SMA 1000 pre-auth SSRF, CVSS 10.0), CVE-2026-82329 (JFrog Artifactory auth bypass), CVE-2026-9586 (Sangoma Switchvox pre-auth SQLi), CVE-2026-59822 (BerriAI LiteLLM improper authentication), CVE-2026-48710 (Starlette request smuggling) and CVE-2026-49869 (Kestra OSS command injection) (CISA). Observed post-exploitation is reverse shells and crypto miners (The Hacker News); the Artifactory bug is being used to forge admin tokens (BleepingComputer). LiteLLM sitting in KEV is the signal to watch — AI gateway middleware is now in the exploited-in-the-wild category. · Exploitation & Vulnerabilities

September 3, 2026

  • Aesto Health: 9.54 million individuals, from an intrusion into part of its AWS environment between 2 and 18 December 2025, exposing PII and PHI across multiple healthcare clients (The Record, BleepingComputer). · Breaches & Leaks

August 31, 2026

  • Around 12 TB of Valve data from 2003–2013 — old Steam depots, development builds, prototypes and unreleased assets — has surfaced online, reportedly pulled from legacy Steam2 content infrastructure through a publicly reachable endpoint with no authentication rather than an intrusion (Game Rant). · Threat Activity

August 28, 2026

  • PaperCut NG/MF has an actively exploited zero-day. Huntress observed in-the-wild exploitation and reproduced a pre-auth RCE chain against a stock PaperCut NG 25.0.11.75758 install; PaperCut confirms an unauthenticated attacker can remotely alter trusted application configuration and execute arbitrary Java inside the app (BleepingComputer, Huntress). Emergency fixes exist for v25 and v26; v24 fixes are still in progress — pull application servers off the public internet now. · Exploitation & Vulnerabilities
  • Citrix NetScaler ADC/Gateway CVE-2026-8452 is being exploited, with CISA giving federal agencies until Saturday to patch (BleepingComputer, SecurityWeek). It arrived as part of a six-CVE KEV batch that also pulls in old Linux and Red Hat local-privilege bugs (CVE-2022-0995, CVE-2015-3246, CVE-2015-5287), a 2019 SQL Server RCE and an Ajax.NET Professional deserialization flaw (CISA, The Hacker News). · Exploitation & Vulnerabilities

August 27, 2026

  • July's water-sector attacks were broader than first disclosed: CISA says more than 100 internet-exposed water systems were targeted in the Iran-linked campaign and has issued guidance on reducing internet exposure of OT (SecurityWeek) (discussion). · Threat Activity

August 21, 2026

August 20, 2026

  • Heights Finance disclosed a breach affecting 1.2 million people via a third-party cloud platform (SecurityWeek), and SafePal exposed data on ~39,800 customers through an authorization flaw in an order-tracking plugin (The Hacker News). · Breaches & Regional

August 4, 2026

  • INC Ransomware has become the dominant actor exploiting SonicWall SMA 1000 flaws. Resecurity reports INC accelerating sharply since the start of August, using the appliance bugs for root access and lateral movement and posting multiple victims to its leak site (The Hacker News, SecurityWeek). · Vulnerabilities & Exploits
  • Midnight Blizzard's hotel Wi-Fi campaign uses custom malware to breach M365 accounts. New reporting adds technical detail: DNS and HTTP manipulation of captive-portal infrastructure to intercept Microsoft credentials, plus deployment of Golang RATs across multiple countries (BleepingComputer, The Record). Follows earlier coverage. · Threat Activity

August 2, 2026

  • CareCloud breach hits 350,000+. Attackers exfiltrated personal, financial, and medical data from the healthcare IT firm's AWS environment back in March 2026 (SecurityWeek). · Data Breaches

August 1, 2026

  • Amgen disclosed a cloud data breach in an 8-K filing, saying attackers exfiltrated proprietary data and patient protected health information from multiple third-party cloud environments (BleepingComputer, SEC filing). · Breaches

July 30, 2026

  • The Fairlife breach is confirmed after Coca-Cola refused Anubis's ransom (earlier coverage). Anubis published ~1 TB of stolen data after its July 27 deadline; a CitrixBleed exploit is cited as the entry point. TechTimes · Data Breaches & Extortion

July 29, 2026

  • Arista VeloCloud Orchestrator is under active exploitation as a zero-day. The on-prem OS command-injection flaw (CVSS 10.0, tracked as CVE-2026-16812 in vendor reporting) lets a remote attacker reach privileged internal functionality and run arbitrary code (Arista advisory, SecurityWeek) (earlier coverage). (discussion) · Vulnerabilities & Exploits
  • Over 24,000 internet-exposed BMCs leak password hashes pre-login via a ~20-year-old IPMI flaw. Of 36,872 exposed IPMI management interfaces, 24,650 disclose password-derived authentication hashes before any login — offline-crackable and ripe for lateral movement into server management planes (BleepingComputer, The Hacker News). · Vulnerabilities & Exploits
  • PhantomEnigma is delivering malware through hijacked legitimate government websites (Hackread). Hunt.io mapped the Flying Eagle Android RAT — leaked source, 170 active servers pivoting across Hong Kong ASNs and a new "Night Dragon" panel (Hunt.io). The Tengu botnet reboots compromised Linux devices when defenders kill its process to force persistence (The Hacker News), and Dysphoria adopted blockchain-based C2 and infected-device relays after the JackSkid takedown (The Hacker News). · Threat Activity

July 24, 2026

  • Carla car-rental data was exposed in an unsecured AWS bucket — 48,000 PDFs of sensitive customer records. SC World. · Cloud & Identity

July 19, 2026

  • Flock Safety breach fallout widens. Cleveland City Council disclosed unauthorized access to data through Flock's ALPR software, feeding a growing backlash — including reporting that the license-plate-reader platform leaked police officers' own plate searches — as agencies pause or cancel contracts (Malwarebytes, pwnhackers AMA). · Privacy & Surveillance

July 18, 2026

July 14, 2026

  • The US and eight allies issued a joint advisory (AA26-194a) warning that FSB Center 16 is opportunistically compromising poorly configured routers worldwide via SNMP and Cisco flaws, and CISA added the exploited Cisco IOS vulnerability to its KEV catalog — the technical follow-through to this week's first joint EU/UK cyber sanctions over the Poland grid attack (earlier coverage). Recommended defenses include disabling Smart Install, hardening SNMP, and firmware updates. CISA, BleepingComputer · Threat Activity

July 11, 2026

  • Progress Software emailed ShareFile customers urging them to immediately power down Windows servers running Storage Zone Controllers after identifying a "credible external security threat," and has temporarily disabled affected accounts. watchTowr says it is tracking rumors of active zero-day exploitation against exposed on-prem controllers and has notified clients with internet-facing instances. Treat any exposed Storage Zone Controller as potentially compromised. The Hacker News, BleepingComputer · Vulnerabilities & Exploits

July 3, 2026

  • Sysdig says it captured the first documented case of agentic ransomware: an operator it dubs JADEPUFFER in which a large language model handled the entire chain — breaking into an internet-facing Langflow instance via CVE-2025-3248, stealing credentials, moving laterally, then encrypting and wiping a production database. Sysdig, The Hacker News. · AI & Model Security
  • Oracle E-Business Suite CVE-2026-46817 was exploited against ~950 exposed instances before public exploit code dropped, allowing attackers to read sensitive files. The Register, CERT.dk. · Vulnerabilities & Exploits

July 2, 2026

  • Progress Kemp LoadMaster pre-auth RCE CVE-2026-8037 (root command execution via crafted API request) is now under active exploitation, per eSentire's TRU — moving from last week's watchTowr PoC to real-world attacks. Patch if the API is exposed. The Hacker News. · Vulnerabilities & Exploits

June 21, 2026

  • Huntress walked through containing a real intrusion at a nursing-facility network: initial access via an exposed RDWeb portal and a compromised test account, followed by RDP lateral movement, enumeration, and persistence attempts — caught and shut down by Managed EDR, Defender telemetry, and SOC response that disabled accounts and blocked the attacker IP before full compromise (Huntress). A useful reminder that internet-exposed RDWeb plus weak test accounts remains a top initial-access path. · Detection & Purple Team

June 19, 2026

  • Mandiant detailed PRC-nexus UNC6508 spending over two years inside North American medical/defense research networks via vulnerable REDCap servers, deploying INFINITERED malware and abusing enterprise admin tools for covert exfil (Mandiant, Security Affairs). · Nation-State & APT

June 17, 2026

  • UNC6508 (China-nexus) lived undetected in North American medical, AI, and defense research networks for over a year (Sep 2023–Nov 2025), exploiting vulnerable REDCap servers to drop custom INFINITERED malware, then exfiltrating by rewiring victims' own Google Workspace mail-forwarding rules. Google/Mandiant, BleepingComputer. · Threat Activity
  • Instructure Canvas breach hit 275 million students: ShinyHunters exploited stored XSS in the support-ticket system, enabled by poor content isolation and shared infrastructure. Scott Helme. · Data Breaches & Extortion