🚨 ACTIVE EXPLOITATION
- Hackers Abuse Google Workspace Accounts to Send Phishing and Scam Emails Hackers are using compromised Google Workspace accounts to send phishing and scam emails.
- Google Workspace customers, including schools and colleges, are affected.
- Compromised organizational accounts are used to send phishing and scam emails.
- Messages originate from real organizational domains, making them harder for filters and recipients to detect. 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News
💥 BREACHES & INCIDENTS
- Poland's MyDr breach exposes medical data of nearly 19 million people A breach of Poland's MyDr system exposed medical data linked to nearly 19 million people.
- The affected system served doctors and medical institutions across Poland, including about 12,000 facilities.
- Stolen data exceeded 2 TB and included prescriptions, appointments, medications, and patient-submitted documents.
- The breach involved 19 million records containing data fragments that may be linked to individuals.
- Authorities have found no indication of a foreign attack and have not established how the data was removed. 📄 Source: tvpworld.com · 📎 Coverage: unn.ua · 👁 via @metacurity@infosec.exchange
🔓 CVEs & KEV
- CVE-2026-59500 — CVSS 10.0 — Priority - CWE-287: Improper AuthenticationCWE-287: Improper Authentication
- CVE-2026-15413 — CVSS 10.0 — Link Factory - BackdoorThe Link Factory WordPress plugin is a backdoor. Distr...
- CVE-2026-59507 — CVSS 9.3 — Priority – CWE-798: Use of Hard-coded Credentials CWE-200: Exposure of Sensit...
- CVE-2026-59506 — CVSS 9.3 — Priority – CWE-306: Missing Authentication for Critical FunctionCWE-306: Miss...
- CVE-2026-59504 — CVSS 9.1 — Priority – CWE-602: Client-Side Enforcement of Server-Side SecurityCWE-602: C...
- CVE-2026-59503 — CVSS 9.1 — Priority – CWE-200: Exposure of Sensitive Information to an Unauthorized Acto...
- CVE-2026-12263 — CVSS 8.8 — Authentication BypassZohocorp ManageEngine Password Manager Pro versions befo...
- CVE-2026-59505 — CVSS 8.6 — Priority - CWE-284: Improper Access ControlCWE-284: Improper Access Control
- CVE-2026-59499 — CVSS 8.6 — Priority – CWE-200: Exposure of Sensitive Information to an Unauthorized Acto...
- CVE-2026-59501 — CVSS 8.2 — Priority – CWE-284: Improper Access ControlCWE-284: Improper Access Control
- CVE-2026-19484 — CVSS 7.5 — @fastify/busboy vulnerable to Denial of Service via oversized multipart bound...
- CVE-2026-19481 — CVSS 7.5 — @fastify/busboy vulnerable to Denial of Service via prototype-named multipart...
- CVE-2026-16455 — CVSS 6.9 — Local privilege escalation via improper input sanitization in execl() callIn ...
- CVE-2026-18368 — CVSS 6.0 — Heap buffer overflow in ModbusgwdIn Teltonika Networks RUTOS devices, a vulne...
🕵️ RESEARCH & DEEP DIVES
Internet-Exposed BMCs Expose Data Centers to Hardware-Level Takeover Lava found thousands of internet-exposed BMCs vulnerable to offline password cracking.
- Data centers, GPU clouds, and bare-metal providers using HPE, Supermicro, and other server platforms are affected.
- 36,872 BMC interfaces exposed IPMI on the public internet; 24,650 disclosed authentication material before login.
- CVE-2013-4786 in IPMI v2.0 leaks password-derived HMAC-SHA1 hashes to unauthenticated clients.
- Attackers reaching UDP port 623 can crack weak, reused, factory-set, or predictable passwords offline.
- Lava found evidence of exploitation, including ransomware notes on exposed HPE BMC interfaces. 📄 Source: lavahq.io · 📎 Coverage: darkreading.com · 👁 via Cyber Security News
Cisco Talos identifies JWR phishing framework targeting payment and shopping platforms Cisco Talos identified the undocumented JWR phishing framework.
- Customers of major payment and shopping platforms are targeted.
- JWR creates convincing counterfeit checkout and login pages.
- The framework impersonates trusted platform interfaces to facilitate phishing. 📄 Source: cmu.edu · 📎 Coverage: blog.talosintelligence.com · 👁 via Cisco Talos
[City-Forum campaign steals data from Salesforce and ServiceNow portals](https://www.bleepingcomputer.com/news/security/city-for