💥 BREACHES & INCIDENTS
-
Clop claims 89GB Shell data theft in wider enterprise software campaign Clop claims to have stolen 89GB of data from Shell.
- Shell, Philips, GE and Fiserv were among companies named by Clop.
- The alleged Shell haul includes engineering drawings, facility images, test-report scans and project plans.
- Clop claims to have stolen about 89GB from Shell and 13.5GB from Philips.
- Researchers linked the campaign to a vulnerability in PTC Windchill and FlexPLM engineering software.
- Clop allegedly exploited one unpatched flaw across nearly 50 companies for data-theft extortion. 📎 Coverage: thenextweb.com · 👁 via BleepingComputer
-
NHS Blood and Transplant exposed patient data over unencrypted pagers NHS Blood and Transplant exposed patient data through unencrypted pagers.
- UK transplant patients were affected, along with some ambulance, hospital and fire-service communications.
- NHSBT transmitted names, dates of birth, organ types, tissue-match scores and risk factors.
- Pager broadcasts also carried mental health, medication, address and patient-age details.
- The legacy radio network was unencrypted and could be intercepted by anyone tuned to the frequency. 📎 Coverage: bbc.co.uk · 👁 via @zackwhittaker@mastodon.social, @metacurity@infosec.exchange
🔓 CVEs & KEV
- CVE-2026-72830 — CVSS 9.3 — Grav API Plugin before 1.0.13 RCE via ConfigController scope bypass
- CVE-2026-72829 — CVSS 9.3 — Grav before 1.0.13 API Key Scope Bypass via UsersController
- CVE-2026-72826 — CVSS 9.3 — Grav before 1.0.13 Scope Bypass via createApiKey
- CVE-2026-72824 — CVSS 9.3 — Grav before 1.0.13 API Key Scope Bypass via PagesController
- CVE-2026-72836 — CVSS 9.2 — FileBrowser before 2.63.19 Case Sensitivity Authentication Bypass
- CVE-2026-72837 — CVSS 8.7 — File Browser before 2.63.20 Privilege Escalation via Proxy Authentication
- CVE-2026-72833 — CVSS 8.7 — Grav 1.0.6 through 1.0.11 Privilege Escalation via Scoped API Keys
- CVE-2026-72831 — CVSS 8.7 — Grav through 2.0.11 Authentication Bypass via Flex Objects
- CVE-2026-72827 — CVSS 8.7 — Grav CMS before 2.0.13 Remote Code Execution via Twig
- CVE-2026-72828 — CVSS 8.6 — Grav before 1.0.13 API Key Scope Bypass via InvitationsController
- CVE-2026-72859 — CVSS 8.3 — Budibase 3.39.4 before 3.40.0 Authorization Regression via S3 Presigned URL
- CVE-2026-72835 — CVSS 7.6 — filebrowser before v2.63.21 Access Rule Bypass via Path Canonicalization
- CVE-2026-72825 — CVSS 7.2 — Grav before 1.0.13 API-key scope cap bypass via ReportsController
- CVE-2026-72838 — CVSS 7.1 — FileBrowser before 2.63.19 Disk Exhaustion via TUS Upload
- CVE-2026-73051 — CVSS 6.3 — actix-http before 3.12.1 HTTP Request Smuggling via CL.TE
🕵️ RESEARCH & DEEP DIVES
-
Trivy Compromise, Not LiteLLM, Drove Most of 2,500-Organization Exposure Most reported LiteLLM exposure stemmed from the earlier Trivy compromise.
- Downstream organizations using Trivy, LiteLLM, or CI/CD platforms were potentially exposed.
- TeamPCP affected GitHub Actions, GitLab CI, Jenkins, Bitbucket, CircleCI, and Buildkite environments.
- LiteLLM versions 1.82.7 and 1.82.8 contained credential-stealing code and were available on PyPI for about 40 minutes on March 24, 2026.
- Data collection from 2,085 of 2,188 identified organizations ended before the malicious LiteLLM releases appeared.
- A Python .pth payload ran at interpreter startup and exfiltrated cloud, SSH, Kubernetes, database, API, and CI/CD secrets to models.litellm[.]cloud. 📄 Source: docs.litellm.ai · 📎 Coverage: securityweek.com · 👁 via SecurityWeek
-
Dysphoria Botnet Compromises 296,000 IoT Devices for DDoS and C2 Relays The Dysphoria botnet has compromised roughly 296,000 IoT devices for DDoS attacks and C2 relaying.
- Routers, gateways, cameras, repeaters, DVRs and other embedded Linux devices are affected.
- About 296,000 compromised devices serve as DDoS bots and C2 relay nodes.
- Operators exploit known flaws including CVE-2013-3307, CVE-2016-20016, CVE-2017-17215, CVE-2017-5259 and CVE-2018-14558.
- Additional exploited flaws include CVE-2020-25499, CVE-2020-8515, CVE-2022-35733, CVE-2025-28137, CVE-2025-34152, CVE-2025-55182 and CVE-2025-9528.
- Infected hosts proxy traffic to obscure backend C2 infrastructure and support DDoS operations. 📄 Source: recordedfuture.com · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)
-
Researchers demonstrate an adaptive AI-powered computer worm Researchers demonstrated an autonomous AI-powered computer worm.
- The proof-of-concept targets heterogeneous network hosts.
- It uses a locally hosted open-weight LLM to discover vulnerabilities and generate target-specific exploits.
- The worm replicated across 61.8% of a 33-system test network and exploited 73.8% of hosts.
- Compromised hosts ran local inference or routed queries to GPU-equipped nodes, enabling self-replication without centralized APIs. 📄 Source: arxiv.org · 📎 Coverage: arxiviq.substack.com · 👁 via Cyber Security News, cryptika.com (discovered)
-
DCRat Campaign Conceals Malware Archive in SVG Files via HTML Smuggling A DCRat campaign is using SVG attachments to deliver a hidden malware archive.
- Phishing recipients are targeted with emails posing as legal notifications.
- DCRat is concealed inside a malware archive embedded in an SVG file.
- JavaScript in the SVG uses HTML smuggling to reconstruct or download the archive in the browser.
- The image-like SVG format helps the malicious attachment evade traditional inspection. 📄 Source: redcanary.com · 📎 Coverage: cryptika.com · 👁 via Cyber Security News, cryptika.com (discovered)
📋 ADVISORIES
- NIST Updates Ransomware Guidelines for Organizational Response
NIST has updated its ransomware profile for organizational risk management and response.
- Organizations across sectors are covered by the updated NIST ransomware profile.
- The profile addresses ransomware risk before, during, and after an attack.
- It provides a standardized framework for assessing reasonable ransomware response practices. 📎 Coverage: securityboulevard.com · 👁 via securityboulevard.com (discovered)