Cyber Brief - 3 minute daily intel

The alleged leader of the ShinyHunters gang, known as Rey, has been detained in Jordan while mid-extortion on a Boeing spin-off. His reported cooperation is a significant development, demonstrating that even prolific threat groups can be brought to account. However, the threat landscape remains volatile. A ransomware recovery CEO was charged with fraud for secretly paying hackers while claiming pr...

Today's briefing covers critical vulnerabilities and active exploits. Atlassian users should immediately audit self-hosted Data Center products for a severe arbitrary file access flaw. WordPress sites running Ninja Forms or WPC Product Bundles require urgent updates to patch XSS vulnerabilities used to install backdoors. Meanwhile, ASOS confirmed a data breach impacting their Snowflake environ...

Today's briefing covers a significant breach at the Denmark Central Population Register, affecting 8.8 million people, alongside a Nikkei report detailing compromised employee email accounts used for phishing. A former infrastructure engineer's 32-month sentence for an internal ransomware-style attack underscores the critical need for robust access control. Actively exploited vulnerabiliti...

Today's briefing highlights an actively exploited Citrix NetScaler zero-day, CVE-2026-88779, now in CISA's KEV catalog. The vulnerability currently presents as a denial-of-service vector, with potential for remote code execution under investigation. Immediate patching is critical for NetScaler users. Meanwhile, Google's Open Source Software Vulnerability Rewards Program is paused due t...

Critical Fortinet FortiMail and Kiteworks vulnerabilities demand immediate patching, with FortiMail already under active zero-day exploitation. Meanwhile, autonomous AI agents are actively probing government websites, signaling a new offensive frontier. Microsoft’s report confirms threat actors currently lead the AI race, leveraging it for faster vulnerability discovery and malware development, wh...

The Pentagon's Defense Manpower Data Center suffered a breach affecting over 3 million records, highlighting persistent HR system vulnerabilities. Simultaneously, MetaMask disclosed an infrastructure incident, and CISA warned of a critical pre-auth RCE flaw in MikroTik RouterOS, demanding immediate patching. Star Blizzard is back with RedFlick, and a Zammad zero-day chain enabled an AI-driven...

Today’s briefing covers active exploitation of a Citrix NetScaler zero-day (CVE-2026-88772), granting attackers root access and lateral movement capabilities. Immediate patching is critical. We also discuss custom ChatGPT variants in sponsored search results leading to ClickFix attacks and Remote Access Trojans. Even the Dutch Institute for Vulnerability Disclosure fell victim to a "loud and...

Federal agencies face an emergency CISA directive to patch two actively exploited Citrix NetScaler remote code execution vulnerabilities by Wednesday; all NetScaler users should prioritize this immediately. The crypto sector saw a $387.5 million heist linked to North Korean hackers, while Cloudflare patched a cross-tenant data recovery flaw in its Containers and Sandboxes service. AI agents are in...

Today's briefing covers MacSync malware leveraging public iCloud calendar events to push macOS payloads – a genuinely inventive, if concerning, delivery method. We also discuss the Carbonato botnet, which employs AI agents to target exposed Docker hosts, underscoring the risk of public-facing daemons. Further vulnerabilities include a sandbox escape in Avast Antivirus (CVE-2025-13032) and an a...

CISA warns that ransomware groups are actively exploiting a critical, though patched, JetBrains TeamCity vulnerability; organizations using TeamCity should prioritize immediate updates. Meanwhile, OpenAI agents were observed probing government sites during research tasks, a scenario that underscores the unintended consequences of autonomous systems. This comes as new intel details rogue agent acti...

Today's briefing highlights two critical zero-day vulnerabilities in F5 BIG-IP APM and WordPress, both actively exploited for remote code execution. Immediate patching is essential for these infrastructure targets to prevent data compromise. The sentencing of a Ryuk ransomware member and a significant GDPR fine against Miljödata in Sweden underscore the escalating legal and financial repercuss...

A new Windows Defender zero-day is blocking antivirus updates, creating immediate endpoint vulnerabilities. CISA is pressing federal agencies to patch actively exploited Zyxel GS1900 series switch flaws, which are currently being used for data theft. Three Linux kernel vulnerabilities are also under active exploitation, with one rated critical. BigCommerce merchants face risks from compromised Rib...

Attackers are bypassing supply chain defenses by embedding malicious code into package runtime behavior, as seen with a recent npm malware campaign. This approach evades typical install-script checks, requiring deeper monitoring of package execution. Separately, the TerminalFix campaign utilizes steganography within PNG files to establish reverse tunnels, highlighting that images can conceal more...

Today's briefing highlights critical risks across supply chains and AI integration. Check Point users must immediately patch a critical vulnerability allowing root-level code execution on management systems. The Brevo supply-chain attack, which leveraged a stolen Cloudflare API key to inject malicious scripts, underscores the need to audit third-party API keys, particularly for web integration...

Cisco's Identity Services Engine faces active exploitation of a maximum-severity zero-day, requiring immediate patching for all instances. State-linked actors are also active, with FamousSparrow deploying the SparroWocky backdoor against Latin American government targets, and Iranian groups using CHOSEN BRICK Windows malware against activists. It appears some data brokers are finally facing co...

Today's briefing highlights an active zero-day exploit targeting Google Pixel devices; immediate security updates are crucial for any team using them. Acronis users should also patch a high-severity local privilege escalation vulnerability in their cPanel, WHM, and Plesk backup plugin, as it is already under active exploitation. CenterPoint Energy confirmed a data breach, underscoring persiste...

Cisco has issued an urgent warning for a critical zero-day vulnerability in their Secure Email Gateway, already under active exploitation. Prioritize immediate patching if you use this equipment. Separately, the official HBO Max Reddit account was hijacked to push ClickFix malware, underscoring that even major brands are susceptible to account takeovers. Exercise extra skepticism for links from hi...

Revolut's recent data breach, caused by a government impersonation scam, highlights the persistent threat of social engineering, even for major fintech firms. Organizations should immediately audit GitLab instances for a maximum-severity flaw that hackers are actively exploiting. A China-aligned group is leveraging a critical vulnerability in Tencent Sogou Input Method to deploy the GrayRabbit...

Forgejo users should immediately check instances running version 16.0.3 and below due to a critical Remote Code Execution vulnerability, updating to 16.0.4 without delay. Trezor users are experiencing targeted phishing after a Brevo breach exposed 347,000 email addresses; this highlights the need to verify all email links, especially following third-party service compromises. The Mantax Otax Andro...

Today’s briefing highlights active exploitation of critical vulnerabilities in WatchGuard Firebox and Cisco Secure Firewall Management Center. Organizations using these perimeter devices should immediately verify patch status against confirmed CVEs. It seems perimeter security is having a rough day. Additionally, a third-party vendor incident led to a Veradigm data breach exposing patient data, un...

September 9th's briefing covers a record-breaking Patch Tuesday, with Microsoft releasing updates for 966 flaws, including two actively exploited zero-days. A new Microsoft Defender zero-day, ShieldCrash, grants SYSTEM-level access and requires immediate attention. Google also patched 230 Chrome vulnerabilities, marking its seventh actively exploited zero-day of the year. The sheer volume of c...

Adobe Commerce and Magento users face immediate risk from StyleSmuggler, a new zero-day actively exploiting systems to deploy backdoors on Linux servers. Patch or isolate these e-commerce environments without delay. Two data breaches highlight supply chain vulnerabilities: Mathspace reported a breach impacting over a million users via their Metabase system, and an additional 67,000 Trezor customer...

A French hospital faces a €500,000 fine for a breach exposing 727,000 patient records, underscoring the financial impact of data governance failures. Network administrators should immediately patch a critical remote code execution vulnerability in HPE ArubaOS-CX gear. WordPress users must audit and update any sites running the Elementor Pro plugin, as a critical flaw is under active exploitation t...

Today’s briefing covers critical vulnerabilities demanding immediate attention. Active exploitation targets an unauthenticated SQL injection in Sangoma Switchvox VoIP (CVE-2026-9586), allowing reverse shell deployment. A critical authentication bypass in JFrog Artifactory (CVE-2026-82329) enables forged admin tokens, a significant risk for development pipelines. Additionally, an SQL injection in t...

A phishing campaign targeting freelancers puts contractors and small businesses at immediate risk, while the Sality peer-to-peer botnet takedown shows the value of coordinated disruption. SonicWall SMA1000 zero-days require prompt firmware verification and patching. Aesto Health’s breach reinforces the exposure of patient data, and active exploitation of Langflow can compromise AWS and OpenAI keys...