🚨 ACTIVE EXPLOITATION
Critical CosmosEscape Flaw in Azure Cosmos DB Allowed Cross-Tenant Key Access A vulnerability in Azure Cosmos DB's Gremlin API allowed attackers to access any database across tenants.
- Applies to Microsoft Azure Cosmos DB customers and Microsoft internal systems
- Vulnerability in Cosmos DB's Gremlin API enabled sandbox escape via .NET reflection misuse
- Attackers could execute arbitrary code on the DB Gateway component
- Exposed a platform-wide Cosmos Master Key granting full read-write access across tenants, regions, and APIs
- Allowed enumeration of accounts via the Config Store directory and retrieval of primary keys 📎 Coverage: thehackernews.com · 👁 via The Hacker News, Cyber Security News
Chaos ransomware deployed via Microsoft Teams vishing attacks on North American firms Threat actors use Microsoft Teams vishing calls to deploy Chaos ransomware on corporate devices.
- Targets: Dozens of US and Canadian organizations across services, manufacturing, energy, and construction sectors
- Attack vector: Impersonation of IT support in Microsoft Teams calls to convince employees to grant remote access
- Tools: Remote access via Microsoft Quick Assist and RemSupp, later primarily RemSupp for evasion
- Persistence: PowerShell backdoors disguised as Realtek and Windows audio components in registry
- Outcome: At least three intrusions led to Chaos ransomware deployment, with one encrypting files within 17 hours 📎 Coverage: bleepingcomputer.com · 👁 via Cybersecurity Dive, BleepingComputer
Home Assistant FFmpeg Flaw Allows File Theft and Root Command Execution Home Assistant's FFmpeg integration flaw enables file theft and root command execution.
- Applies to Home Assistant smart home platform, specifically Wyoming integration announce feature
- Vulnerability allows argument injection in FFmpeg input, enabling reading of arbitrary local files
- Attack uses FFmpeg pseudo-protocols (file:, concat:, subfile:) to bypass input validation
- Exfiltrates sensitive data like SUPERVISOR_TOKEN, enabling root-level command execution
- Requires attacker to control paired Wyoming Assist satellite and valid Home Assistant API token
- Patched in Home Assistant Core version 2026.6.2 with strict FFmpeg protocol allowlist 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News
GenieLocker ransomware by Toy Ghouls targets Windows, Linux, and ESXi systems GenieLocker ransomware attacks Windows, Linux, and VMware ESXi systems in Russia's manufacturing sector.
- Targets Windows, Linux, and VMware ESXi systems, mainly in Russia's manufacturing sector since March 2026
- Operated by Toy Ghouls group, formerly using LockBit, Babuk, and RedAlert ransomware families
- Initial access via OpenVPN using stolen valid credentials from trusted partner networks
- Uses tools like OpenSSH, socks5.exe, SoftPerfect Network Scanner, Mimikatz, PsExec, PAExec, and reverse SSH tunnels
- Windows variant includes anti-debugging, secret argument validation, and encrypts files selectively using libsodium crypto library
- Linux and ESXi variants lack anti-debugging but can stop VMs and encrypt virtual disks, risking virtual infrastructure 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News
🕵️ RESEARCH & DEEP DIVES
Server-Side Request Forgery in Boruta OAuth and OpenID URIs Allows Remote Attacker Requests
CVE-2026-54885Boruta OAuth/OpenID server is vulnerable to unauthenticated SSRF via request_uri and jwks_uri parameters.- Applies to Boruta versions from 2.3.2 before 2.3.7
- Vulnerability in OAuth request_uri and OpenID jwks_uri fetching code paths
- Allows unauthenticated remote attacker to make server issue HTTP requests to attacker-chosen URIs
- No validation of URI scheme, host, IP allowlist, or response size limits
- Enables SSRF attacks targeting internal services and cloud metadata endpoints 📎 Coverage: cve.threatint.com · 📄 Original: cve.threatint.com · 👁 via CVE ThreatInt
Hackers Exploit Nearly One in Four Vulnerabilities Before CVE Publication in 2026 Attackers exploited 23.43% of vulnerabilities before their CVEs were published in early 2026.
- Applies to vulnerabilities tracked by VulnCheck in the first half of 2026
- 23.43% of exploited vulnerabilities showed active attacks on or before CVE publication date
- Median time from CVE publication to known exploitation dropped from 120 to 80 days
- Content management systems, especially WordPress plugins, were most targeted
- Network edge devices from Cisco, Palo Alto, Fortinet, and others were heavily attacked
- AI development tools were also targeted, including exploits like CVE-2026-0769 and CVE-2026-5027 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News
⚠️ BREACHES & INCIDENTS
Analog Devices confirms June 2026 data breach with file exfiltration, operations unaffected Analog Devices suffered unauthorized access and file exfiltration in June 2026.
- Applies to Analog Devices internal systems detected on June 23, 2026
- Unauthorized party accessed and exfiltrated certain company files
- Incident response activated with external cybersecurity experts engaged
- Operations remained uninterrupted; no confirmed data leak or fraud use reported
- Extortion group ExfilSquad claimed stolen customer data but link to breach unverified 📎 Coverage: bleepingcomputer.com · 📄 Original: bleepingcomputer.com · 👁 via BleepingComputer, Cyber Security News
ExfilSquad claims theft of 740,000 records from UK education and police databases ExfilSquad hackers stole over 740,000 records from UK education and police databases.
- Targets include UK Department for Education helpdesk and Turing portals, and Police National Legal Database
- Data stolen includes names, emails, phone numbers, job titles of officials, school staff, police officers, and public
- Hackers posted data samples on leak site and demanded ransom from at least 14 victims including a UK university
- Police database breach exposed work-related info but no confidential victim, witness, or offender data
- Cybersecurity firm Sophos verified data legitimacy; ExfilSquad's social media account was suspended 📎 Coverage: metacurity.com · 👁 via @metacurity@infosec.exchange
River Bank Discloses Paying Threat Actor to Conceal Cybersecurity Incident River Bank paid a threat actor to cover up a cybersecurity incident.
- Applies to River Bank, a financial institution
- Incident involves a cybersecurity breach
- Bank paid the threat actor to conceal the incident
- Disclosure made via an SEC 8-K filing 📎 Coverage: cyberplace.social · 📄 Original: sec.gov · 👁 via @GossiTheDog@cyberplace.social
📋 ADVISORIES
- foreUP golf management API has two critical vulnerabilities exposing customer and merchant data foreUP's golf management API exposes merchant credentials and customer data via broken object-level authorization.
- Applies to foreUP golf management platform used by over 2,000 golf courses
- CVE-2026-15657 exposes Finix merchant API credentials in customer record responses
- CVE-2026-15658 allows unauthorized access to any customer's profile and payment tokens by changing golfer_id
- Attack requires only a valid low-privilege customer account and exploits missing object-level authorization
- Vulnerabilities affect all facilities using foreUP due to shared web API 📎 Coverage: kb.cert.org · 📄 Original: kb.cert.org · 👁 via CERT/CC Vulnerability Notes
🔓 CVEs & KEV
- Other: 20 CVEs (worst 8.6)