🚨 ACTIVE EXPLOITATION
-
Critical Ruflo Vulnerability Allows Unauthenticated Remote Code Execution in AI Agent Platform
CVE-2026-59726
A critical unauthenticated RCE vulnerability was found in Ruflo's MCP bridge allowing full system compromise.- Applies to Ruflo AI agent orchestration platform, versions prior to 3.16.3
- Vulnerability CVE-2026-59726 exposes the MCP bridge POST /mcp endpoint without authentication
- Allows attackers to execute commands inside the MCP bridge container as node user
- Attackers can steal API keys, spawn rogue AI agent swarms, poison AI learning data, and deploy persistent backdoors
- Root cause is default docker-compose.yml binding port 3001 to 0.0.0.0 exposing all network interfaces
📎 Coverage: securityweek.com · 📄 Original: securityweek.com · 👁 via SecurityWeek
-
Russian Hackers Exploit Microsoft OWA XSS Flaw to Maintain Mailbox Access
CVE-2026-42897
Russian hackers exploited a Microsoft Outlook Web Access XSS flaw to maintain persistent mailbox access.- Targets include U.S. and European government, telecom, financial, hospitality, and aerospace sectors
- Vulnerability exploited is CVE-2026-42897, a cross-site scripting (XSS) flaw in Microsoft OWA
- Attack uses 'half-click' email exploits with no URLs or attachments to trigger JavaScript payloads
- Malware OWAReaper deployed, enabling persistent access by stealing credentials and abusing Outlook APIs
- OWAReaper uses GitHub and attacker emails for command-and-control and exfiltrates data via HTTPS and DNS tunneling
📎 Coverage: thehackernews.com · 👁 via The Hacker News
-
STAC4749 Ransomware Campaign Uses Microsoft Teams Calls to Deploy Chaos Ransomware
Attackers use fake Microsoft Teams calls to gain remote access and deploy Chaos ransomware.- Targets North American organizations using Microsoft Teams collaboration platform
- Attackers impersonate IT support to initiate remote sessions via Microsoft Quick Assist or similar tools
- Initial access gained through social engineering in short two-minute Teams calls
- Operators deploy custom loaders and Python-based backdoors to establish persistence and move laterally
- Chaos ransomware deployed rapidly post-access, with some attacks completing encryption within 17 hours
📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News
🔓 RESEARCH & DEEP DIVES
-
Toy Ghouls deploy custom GenieLocker ransomware on Windows, Linux, and ESXi systems
Toy Ghouls group uses custom GenieLocker ransomware to encrypt Windows, Linux, and ESXi systems.- Targets organizations in Russia, mainly manufacturing sector
- GenieLocker ransomware has Windows PE and Linux/ESXi ELF variants
- Initial access via OpenVPN using stolen credentials from trusted partners
- Lateral movement with RDP, SSH, PsExec, PAExec; tools include Mimikatz and SoftPerfect Network Scanner
- Encrypts files on Windows and disks on Linux/ESXi; no data exfiltration or double extortion observed
📎 Coverage: securelist.com · 📄 Original: securelist.com · 👁 via Securelist (Kaspersky)
-
Unauthenticated SSRF in PIA via OIDC Issuer Allowlist Bypass (CVE-2026-18353)
CVE-2026-18353
PIA's OIDC issuer allowlist bypass enables unauthenticated SSRF attacks.- Applies to PIA versions before 0.6.0, specifically affecting the POST /v1/upload/sbom endpoint
- Vulnerability arises from unverified 'iss' claim checked against an allowlist using Python's urlparse
- urlparse and requests parse backslash-containing URLs differently, allowing bypass of issuer allowlist
- Attackers can cause SSRF by crafting issuer URLs that pass allowlist but redirect requests to arbitrary hosts
- No authentication required; CVSS score 8.8 indicates high severity
📎 Coverage: cve.threatint.com · 📄 Original: cve.threatint.com · 👁 via CVE ThreatInt
-
Work Panel Platform Enables Scalable Enterprise Account Takeovers via Vishing
A criminal platform called Work Panel facilitates enterprise account takeovers through coordinated voice phishing.- Targets customers of multiple identity providers including Okta, Microsoft 365, and Salesforce
- Enables vishing campaigns that impersonate helpdesk staff using researched employee data
- Features role-based operator console separating callers, managers, and administrators
- Automates phishing site creation, brand cloning, and real-time victim interaction
- Includes live monitoring, secret rotation, and self-destruct functions to evade takedown
📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News
-
Fake Flash Player Installer Uses Microsoft-Themed Certificate to Deploy AtlasRAT
AtlasRAT malware is delivered via a fake Flash Player installer using a Microsoft-themed certificate.- Targets Windows users through a fake Flash Player installer named FlashPlay.Exe
- Malware loads code directly into memory to evade traditional file-based detection
- Uses a four-stage loader chain culminating in MainDll.Dll payload with encrypted C2 communication
- Final payload uses a self-signed certificate named CN=update.Microsoft.Com to appear legitimate
- Capabilities include keystroke logging, code injection into WeChat, persistence, and encrypted command-and-control
📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News
-
linux-cryptomining-pam-evasion — Cyber Security News
-
north-korea-hackers-internal-conflict — Graham Cluley
📋 ADVISORIES
- GitLab patches 13 vulnerabilities risking data leaks, pipeline tampering, and DoS
GitLab fixed 13 vulnerabilities affecting CE and EE that risk data exposure and pipeline attacks.- Applies to GitLab Community Edition (CE) and Enterprise Edition (EE) self-managed deployments
- Includes high-severity flaws like info exposure in Workhorse and mass-assignment in Pipeline Schedule API
- Attackers can manipulate CI/CD pipelines, access sensitive data, or cause denial-of-service via merge request discussions
- Vulnerabilities include improper access control, race conditions, XSS, and prompt injection in AI-assisted tools
- Patch versions 19.2.1, 19.1.3, and 19.0.5 released July 29, 2026; GitLab.com already patched
📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News