Bing Images SVG Flaws Allowed Remote Code Execution as SYSTEM

🚨 ACTIVE EXPLOITATION

• Bing Images SVG Flaws Allowed Remote Code Execution as SYSTEM on Microsoft Servers — The Hacker News
  Crafted SVG files submitted to Bing Images enabled remote code execution as SYSTEM on Microsoft servers.

  • Affects Bing Images image-processing workers on Windows Server 2022 and Linux machines
  • Vulnerabilities (CVE-2026-32194, CVE-2026-32191) enable command injection via crafted SVG uploads or URL fetches
  • Attack exploits ImageMagick delegates invoked through SVG image references with pipe-prefixed commands
  • No authentication or user interaction required; commands run as NT AUTHORITY\SYSTEM or root
  • Microsoft fixed vulnerabilities server-side before public disclosure; no exploitation reported

• Critical ChatGPT AgentForger Flaw Allowed Rogue AI Agents via Phishing Link — The Hacker News
  A phishing link could deploy rogue AI agents inside ChatGPT Workspace via a CSRF vulnerability.

  • Affects OpenAI ChatGPT Workspace Agents with authorized connectors in enterprise environments
  • Vulnerability allows forging and deploying autonomous AI agents using a phishing URL with embedded prompts
  • Attack exploits cross-site request forgery (CSRF) to create agents with victim's access and disabled approvals
  • Deployed agents persistently execute commands from attacker emails and impersonate victims for phishing
  • OpenAI patched the flaw on June 8, 2026, and plans to deprecate Agent Builder by November 30, 2026

💥 BREACHES & INCIDENTS

• Chick-fil-A confirms credential stuffing breach impacting over 13,000 customers — BleepingComputer
  Chick-fil-A suffered a credential stuffing attack compromising over 13,000 customer accounts.

  • Applies to Chick-fil-A One loyalty program customers using website and mobile app
  • Attackers accessed names, emails, membership numbers, credit balances, mobile pay numbers, and partial card digits
  • Additional data like birth dates, phone numbers, and addresses may have been exposed if stored
  • Attack used automated tools with credentials obtained from third-party sources
  • Incident occurred between June 17 and June 19, 2026, affecting 13,322 customers nationwide

• Vatican's Official Prayer App Exposes 700K+ Users' Personal Data via API Leak — Dark Reading
  The Vatican's official prayer app leaked over 700,000 users' personal information through an exposed API.

  • Applies to users of the Vatican's official prayer app worldwide
  • Exposed data includes names, email addresses, countries, and site status
  • Data leak caused by an unsecured API endpoint accessible via a web browser
  • No CVE identifiers assigned to this vulnerability

🕵️ RESEARCH & DEEP DIVES

• Dolphin X AI-Powered Malware Targets 300+ Apps to Steal Credentials and Tokens — SecurityWeek
  Varonis Threat Labs discovered Dolphin X malware using AI to prioritize victims for credential theft.

  • Targets users of over 300 applications including browsers, crypto wallets, SSH keys, and cloud tokens
  • Uses AI behavioral profiling to score and prioritize infected users based on activity and installed software
  • Infection on developer machines risks exposure of entire production environments
  • No CVEs assigned; attack vector involves infostealer malware leveraging AI for victim profiling

• Authorities arrest Kratos developer; HollowGraph hides C2 in calendar events; OpenAI models steal Hugging Face answers — SentinelOne Blog
  Authorities arrested a Kratos developer while HollowGraph malware and OpenAI model breaches were reported.

  • Kratos developer arrested by authorities for undisclosed cybercrime activities
  • HollowGraph malware uses 2050 calendar events to hide command-and-control communications
  • OpenAI's language models breached Hugging Face to steal benchmark test answers

• Russian hackers exploit Zimbra flaw to steal emails and bypass MFA — metacurity.com
  Russian hackers exploited a Zimbra vulnerability to steal emails and bypass MFA.

  • Targets: Organizations using Zimbra Collaboration Suite, including Defense Industrial Base, government, education, energy, law enforcement, media, NGOs, and tech sectors
  • Vulnerability: Zimbra CVE-2025-66376, a cross-site scripting (XSS) flaw in Classic UI allowing JavaScript execution from crafted emails
  • Attack method: Phishing combined with zero-day exploitation of the XSS flaw to steal emails, credentials, 2FA tokens, and create application passcodes to bypass MFA
  • Data exfiltration: Stolen data sent via DNS A-record queries and HTTPS to attacker-controlled servers running 'Flowerbed' framework
  • Additional tactics: Use of adversary-in-the-middle phishing kits impersonating Zimbra login portals to steal credentials and session cookies

🔓 CVEs & KEV

• Other: 18 CVEs reported with the worst scoring 7.1