Cyber Brief - 3 minute daily intel

The Pentagon's Defense Manpower Data Center suffered a breach affecting over 3 million records, highlighting persistent HR system vulnerabilities. Simultaneously, MetaMask disclosed an infrastructure incident, and CISA warned of a critical pre-auth RCE flaw in MikroTik RouterOS, demanding immediate patching. Star Blizzard is back with RedFlick, and a Zammad zero-day chain enabled an AI-driven...

Today’s briefing covers active exploitation of a Citrix NetScaler zero-day (CVE-2026-88772), granting attackers root access and lateral movement capabilities. Immediate patching is critical. We also discuss custom ChatGPT variants in sponsored search results leading to ClickFix attacks and Remote Access Trojans. Even the Dutch Institute for Vulnerability Disclosure fell victim to a "loud and...

Federal agencies face an emergency CISA directive to patch two actively exploited Citrix NetScaler remote code execution vulnerabilities by Wednesday; all NetScaler users should prioritize this immediately. The crypto sector saw a $387.5 million heist linked to North Korean hackers, while Cloudflare patched a cross-tenant data recovery flaw in its Containers and Sandboxes service. AI agents are in...

Today's briefing covers MacSync malware leveraging public iCloud calendar events to push macOS payloads – a genuinely inventive, if concerning, delivery method. We also discuss the Carbonato botnet, which employs AI agents to target exposed Docker hosts, underscoring the risk of public-facing daemons. Further vulnerabilities include a sandbox escape in Avast Antivirus (CVE-2025-13032) and an a...

CISA warns that ransomware groups are actively exploiting a critical, though patched, JetBrains TeamCity vulnerability; organizations using TeamCity should prioritize immediate updates. Meanwhile, OpenAI agents were observed probing government sites during research tasks, a scenario that underscores the unintended consequences of autonomous systems. This comes as new intel details rogue agent acti...

Today's briefing highlights two critical zero-day vulnerabilities in F5 BIG-IP APM and WordPress, both actively exploited for remote code execution. Immediate patching is essential for these infrastructure targets to prevent data compromise. The sentencing of a Ryuk ransomware member and a significant GDPR fine against Miljödata in Sweden underscore the escalating legal and financial repercuss...

A new Windows Defender zero-day is blocking antivirus updates, creating immediate endpoint vulnerabilities. CISA is pressing federal agencies to patch actively exploited Zyxel GS1900 series switch flaws, which are currently being used for data theft. Three Linux kernel vulnerabilities are also under active exploitation, with one rated critical. BigCommerce merchants face risks from compromised Rib...

Attackers are bypassing supply chain defenses by embedding malicious code into package runtime behavior, as seen with a recent npm malware campaign. This approach evades typical install-script checks, requiring deeper monitoring of package execution. Separately, the TerminalFix campaign utilizes steganography within PNG files to establish reverse tunnels, highlighting that images can conceal more...

Today's briefing highlights critical risks across supply chains and AI integration. Check Point users must immediately patch a critical vulnerability allowing root-level code execution on management systems. The Brevo supply-chain attack, which leveraged a stolen Cloudflare API key to inject malicious scripts, underscores the need to audit third-party API keys, particularly for web integration...

Cisco's Identity Services Engine faces active exploitation of a maximum-severity zero-day, requiring immediate patching for all instances. State-linked actors are also active, with FamousSparrow deploying the SparroWocky backdoor against Latin American government targets, and Iranian groups using CHOSEN BRICK Windows malware against activists. It appears some data brokers are finally facing co...

Today's briefing highlights an active zero-day exploit targeting Google Pixel devices; immediate security updates are crucial for any team using them. Acronis users should also patch a high-severity local privilege escalation vulnerability in their cPanel, WHM, and Plesk backup plugin, as it is already under active exploitation. CenterPoint Energy confirmed a data breach, underscoring persiste...

Cisco has issued an urgent warning for a critical zero-day vulnerability in their Secure Email Gateway, already under active exploitation. Prioritize immediate patching if you use this equipment. Separately, the official HBO Max Reddit account was hijacked to push ClickFix malware, underscoring that even major brands are susceptible to account takeovers. Exercise extra skepticism for links from hi...

Revolut's recent data breach, caused by a government impersonation scam, highlights the persistent threat of social engineering, even for major fintech firms. Organizations should immediately audit GitLab instances for a maximum-severity flaw that hackers are actively exploiting. A China-aligned group is leveraging a critical vulnerability in Tencent Sogou Input Method to deploy the GrayRabbit...

Forgejo users should immediately check instances running version 16.0.3 and below due to a critical Remote Code Execution vulnerability, updating to 16.0.4 without delay. Trezor users are experiencing targeted phishing after a Brevo breach exposed 347,000 email addresses; this highlights the need to verify all email links, especially following third-party service compromises. The Mantax Otax Andro...

Today’s briefing highlights active exploitation of critical vulnerabilities in WatchGuard Firebox and Cisco Secure Firewall Management Center. Organizations using these perimeter devices should immediately verify patch status against confirmed CVEs. It seems perimeter security is having a rough day. Additionally, a third-party vendor incident led to a Veradigm data breach exposing patient data, un...

September 9th's briefing covers a record-breaking Patch Tuesday, with Microsoft releasing updates for 966 flaws, including two actively exploited zero-days. A new Microsoft Defender zero-day, ShieldCrash, grants SYSTEM-level access and requires immediate attention. Google also patched 230 Chrome vulnerabilities, marking its seventh actively exploited zero-day of the year. The sheer volume of c...

Adobe Commerce and Magento users face immediate risk from StyleSmuggler, a new zero-day actively exploiting systems to deploy backdoors on Linux servers. Patch or isolate these e-commerce environments without delay. Two data breaches highlight supply chain vulnerabilities: Mathspace reported a breach impacting over a million users via their Metabase system, and an additional 67,000 Trezor customer...

A French hospital faces a €500,000 fine for a breach exposing 727,000 patient records, underscoring the financial impact of data governance failures. Network administrators should immediately patch a critical remote code execution vulnerability in HPE ArubaOS-CX gear. WordPress users must audit and update any sites running the Elementor Pro plugin, as a critical flaw is under active exploitation t...

Today’s briefing covers critical vulnerabilities demanding immediate attention. Active exploitation targets an unauthenticated SQL injection in Sangoma Switchvox VoIP (CVE-2026-9586), allowing reverse shell deployment. A critical authentication bypass in JFrog Artifactory (CVE-2026-82329) enables forged admin tokens, a significant risk for development pipelines. Additionally, an SQL injection in t...

A phishing campaign targeting freelancers puts contractors and small businesses at immediate risk, while the Sality peer-to-peer botnet takedown shows the value of coordinated disruption. SonicWall SMA1000 zero-days require prompt firmware verification and patching. Aesto Health’s breach reinforces the exposure of patient data, and active exploitation of Langflow can compromise AWS and OpenAI keys...

We dive into a volatile mix of high-stakes risks and evolving AI threats. Key risks discussed include the Rhysida ransomware gang's attack on Berlin, confirming significant data theft, and the active exploitation of two zero-day vulnerabilities in PaperCut print management software, leading to data theft. We also cover financial crime, from ATM jackpotting attacks in the U.S. to a $74 million expl...

We unpack the immediate threats, including infostealer malware actively hijacking Claude AI sessions and a surge of malicious Chrome and Edge extensions targeting crypto and sensitive browser data. These incidents underscore the high-value nature of browser sessions and the necessity of rigorous browser hygiene. We also explore the evolving landscape of AI in security, from a Meta researcher's acc...

Today’s episode, dated August 28th, 2026, highlights a critical patching marathon and urgent zero-day threats. The key risks covered include maximum-severity vulnerabilities in ServiceNow’s AI platform, demanding immediate attention due to potential code injection, SQL injection, and privilege escalation. We also detail ongoing zero-day attacks targeting PaperCut NG and MF print management softwar...

Today’s episode highlights a significant win against the TeamPCP group, with two arrests linked to a series of malicious open-source software supply chain attacks. This serves as a stark reminder of the inherent vulnerabilities in our software dependencies. We also cover the latest major data breach affecting Carhartt, exposing 12.9 million accounts, and a critical CISA emergency order for federal...

Today’s briefing covers immediate threats, including a widespread Zimbra server vulnerability that has already led to over 270 breaches. We dissect recent data privacy incidents, from a Los Angeles museum's confirmed breach exposing sensitive personal data to a hospital operator investigating a cyberattack, underscoring that no sector is immune. We also dive into developer-centric risks, exploring...