🚨 ACTIVE EXPLOITATION
CareCloud Data Breach Exposes Personal, Financial, and Medical Data of 350,000+ Hackers stole personal, financial, and medical data from CareCloud's AWS environment.
- Applies to CareCloud Health division's electronic health record environment
- Over 350,000 individuals impacted with stolen names, addresses, SSNs, DOBs, IDs, financial and medical info
- Hackers accessed CareCloud's AWS environment between March 10 and March 16, 2026
- Data exfiltration confirmed after investigation concluded on June 24, 2026 📎 Coverage: securityweek.com · 👁 via SecurityWeek
ExfilSquad hacks UK Department for Education, steals 600,000 records Hackers from ExfilSquad breached the UK Department for Education and stole data.
- Targets: UK Department for Education and UK Police National Legal Database
- Data stolen: 600,000 records including names, emails, and phone numbers
- Attack vector: Breach of two web portals, including the agency's help desk portal
- Threat actor: ExfilSquad claims responsibility and is attempting extortion
- Additional claims: ExfilSquad also claims breaches of UK Police database and Microsoft 📎 Coverage: news.risky.biz · 👁 via @campuscodi@mastodon.social
No detailed public reports on OpenAI-Hugging Face rogue AI incident CVE-2026-59726 and CVE-2026-66803
No substantive information is available on the OpenAI-Hugging Face rogue AI incident or related CVEs.- Applies to OpenAI and Hugging Face AI platforms
- Vulnerabilities identified as CVE-2026-59726 and CVE-2026-66803
- No public technical details or attack vectors disclosed
- No confirmed exploitation or impact reports found 📎 Coverage: mastodon.social · 👁 via @campuscodi@mastodon.social
🔓 CVEs & KEV
- Other: 21 CVEs (worst 9.8)
🕵️ RESEARCH & DEEP DIVES
Astaroth Malware Uses WhatsApp Web to Spread Banking Trojan in Brazil Astaroth malware spreads via victims' WhatsApp Web sessions by sending malicious ZIP files to contacts.
- Targets Brazilian WhatsApp users by exploiting active WhatsApp Web sessions
- Sends convincing Portuguese messages with malicious ZIP attachments to contacts
- Uses WebDriver to automate hidden browser sessions and WPPConnectWA-JS library for messaging
- Filters contacts to exclude groups, unsaved numbers, and non-Brazilian contacts
- Evolved from email phishing to automated WhatsApp propagation for faster infection chains 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News
OctLurk and SilkLurk Backdoors Target Central Asian Government Networks Custom backdoors OctLurk and SilkLurk have compromised Central Asian government computers.
- Targets government networks in Afghanistan, Kazakhstan, Kyrgyzstan, Tajikistan, Uzbekistan, and Syria
- Backdoors enable keylogging, browser password theft, email exfiltration, and remote command execution
- OctLurk uses victim-specific loaders and in-memory plugins for stealth and broad control
- SilkLurk hides behind legitimate Windows programs and injects payloads into memory
- Attackers use stolen admin credentials, scheduled tasks, malicious services, and PlugX RAT for persistence and lateral movement 📎 Coverage: cybersecuritynews.com · 📄 Original: cybersecuritynews.com · 👁 via Cyber Security News
Gentlemen Ransomware Kills Nearly 180 Security Processes Before Encryption Gentlemen ransomware disables nearly 180 security processes before encrypting files.
- Targets businesses using antivirus, endpoint detection, backup agents, and monitoring software
- Uses kernel-level driver anticheatG13.sys to terminate security-related processes and manipulate system memory
- Driver supports process termination, network traffic control, command-line rewriting, and driver load inspection
- Attackers gain deep system access to disable defenses before deploying ransomware encryption 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News
📋 ADVISORIES
CISA Warns Water Utilities of Cyberattacks on Internet-Exposed PLCs CISA warns water utilities of rising cyberattacks targeting internet-exposed PLCs.
- Applies to water and wastewater utilities using programmable logic controllers (PLCs)
- PLCs controlling water treatment, pumping, chemical dosing, and wastewater management are vulnerable
- Attackers alter PLC passwords and IP addresses to disrupt operations and lock out operators
- PLCs exposed via direct internet connections or vendor-installed cellular modems are targeted
- Rockwell Automation MicroLogix 1400 PLCs specifically mentioned for password recovery guidance 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News
PHP fixes three vulnerabilities causing SQL injection, memory corruption, and crashes PHP patched three high-severity flaws affecting ext-pgsql, ext-bcmath, and ext-phar extensions.
- Affects PHP optional extensions: ext-pgsql, ext-bcmath, and ext-phar
- SQL injection via php_pgsql_convert() in PostgreSQL extension with standard_conforming_strings enabled
- Out-of-bounds memory write in bccomp() due to incorrect buffer handling in BCMath extension
- Denial-of-service crash from infinite recursion in phar_get_link_source() following circular symbolic links in Phar archives
- Fixed in PHP versions 8.2.33, 8.3.33, 8.4.24, and 8.5.9 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News