AI agents steal 600K credit cards, infect 100+ retail sites with

💥 BREACHES & INCIDENTS

• AI agents used to steal 600K credit cards, infect 100+ retail sites with skimmers
  A threat actor used open-source AI agent frameworks to compromise 119+ retail websites and steal over 600,000 credit card records.
  • Targets online retailers, including a Fortune 500 hospitality company, a major U.S. airline, a large U.S. industrial supplies distributor, and an online fashion retailer.
  • Campaign active since at least July 2026; 105 attack waves between September 10-15 hit at least 27 companies, with 600,000+ valid cards stolen from two companies.
  • Attack chain uses three AI tools: Strix for scanning (146 runs against 138 hosts), Cairn for autonomous exploitation, and Hermes for orchestration using claude-opus-4.6.
  • Skimmers injected via appended JavaScript, checkout script tags, S3/CDN and cache poisoning, database field modification, Kubernetes deployment changes, and cron jobs for persistence.
  • Operator spent an estimated $12,000-$18,000 total, averaging ~$25 per target; a cleanup routine wiped card data from Magento databases after exfiltration, causing data loss at several retailers.
  Sources 📎 Coverage: bleepingcomputer.com · 👁 via BleepingComputer

🕵️ RESEARCH & DEEP DIVES

• Leaked GitLab issue email address lets anyone commit code and run CI jobs as you
  Aikido Security found that GitLab's per-user incoming email token acts as a non-expiring credential allowing code commits and CI job execution in a user's name.
  • Affects all GitLab.com accounts and self-managed instances with incoming email enabled (default on GitLab.com); GitLab Dedicated appears unaffected.
  • The token in the issue email address is shared across all projects a user can access, public or private, and never expires; GitLab does not verify the sender's identity.
  • Changing the address suffix from -issue to -merge-request lets an attacker email a patch that GitLab commits to any branch the user can push to, including main, and can trigger CI/CD jobs as the user.
  • The attack bypasses IP allowlists (incoming email is exempt) and 2FA requirements; public projects' paths and IDs are enough to target them.
  • Aikido reported it via HackerOne in May 2026 (closed as intended behavior) and privately to GitLab in June; GitLab has only updated documentation text so far.
  Sources 📄 Source: gitlab.com · 📎 Coverage: thehackernews.com · 👁 via The Hacker News

📋 ADVISORIES

• CERT/CC: kotaemon IDOR lets any authenticated user read or delete others' chats (CVE-2026-86867)
  CERT/CC disclosed that Cinnamon's kotaemon up to v0.12.0 fails to verify conversation ownership, letting any authenticated user read, delete, rename, or overwrite other users' conversations.

  • Affects Cinnamon's open-source kotaemon RAG chat tool, all versions up to v0.12.0, in multi-user mode (CVE-2026-86867, VU#754548).
  • Four handlers (select_conv, delete_conv, rename_conv, persist_chat_suggestions) query conversations by ID with no check that Conversation.user matches the requesting user.
  • Any authenticated account with a victim's conversation UUID can read full chat transcripts and RAG retrieval history containing verbatim excerpts from private documents, delete conversations permanently, rename them, or overwrite suggestion lists.
  • Victim UUIDs are exposed via public conversations in the global browser and remain valid even after a conversation is set to private; injected suggestions could enable prompt injection.
  • No official patch is available; the vendor could not be reached to coordinate disclosure.
  Sources 📄 Source: cve.org · 📎 Coverage: kb.cert.org · 👁 via CERT/CC Vulnerability Notes

• 📄 Source for Ryuk ransomware operator Karen Vardanyan sentenced to 2 years in prison — justice.gov

🔓 CVEs & KEV

• CVE-2026-86059 — dokploy — CVSS 9.6 — Dokploy: Git Provider Credential Exposure via Unprotected .one Endpoints and ...

• CVE-2026-87121 — lwIP TCP/IP Stack MQTT — CVSS 9.3 — lwIP TCP/IP Stack MQTT Client Application

• CVE-2026-95848 — moquette-io moquette — CVSS 9.3 — Moquette fails open when configured authentication or authorization classes c...

• CVE-2026-94456 — GitroomHQ postiz-app — CVSS 9.1 — Unauthenticated recovery of the Math.random() state behind OAuth tokens, auth...

• CVE-2026-96804 — MLflow — CVSS 8.8 — CVE-2026-96804MLflow's statsmodel flavor, versions 2.1.0 to 3.14.0, omits the...

• CVE-2026-95847 — moquette-io moquette — CVSS 8.8 — Moquette client IDs can cause cross-session H2 durable-queue corruptionMoquet...

• CVE-2026-91018 — lwIP API — CVSS 8.7 — lwIP (Lightweight IP)

• CVE-2026-95846 — moquette-io moquette — CVSS 8.7 — Moquette publishes Last-Will messages without enforcing write authorizationMo...

• CVE-2026-95845 — moquette-io moquette — CVSS 8.7 — Moquette unbounded per-session message queues allow memory exhaustionMoquette...

• CVE-2026-95844 — moquette-io moquette — CVSS 8.7 — Moquette deeply nested MQTT topics can cause stack exhaustionMoquette is a li...

• CVE-2026-95843 — moquette-io moquette — CVSS 8.7 — Moquette malformed shared subscriptions can crash command processingMoquette ...

• CVE-2026-95842 — moquette-io moquette — CVSS 8.7 — Moquette uncaught MQTT command exceptions can terminate shared session event ...

• CVE-2026-83803 — getsentry sentry — CVSS 7.7 — Sentry: Unsafe pickle deserialization in Relocation FeatureSentry is an error...

• CVE-2026-88830 — Red Hat Hardened Images — CVSS 7.5 — Busybox: busybox: tls montgomery reduction allocates bytes instead of digits,...

• CVE-2026-96808 — Flatpak — CVSS 7.4 — In Flatpak before 1.18.1, the revokefs writer, used by the flatpak-system-hel...

• CVE-2026-88832 — Red Hat Hardened Images — CVSS 7.3 — Busybox: busybox: romfs volume id parsing performs unbounded memcpy into fixe...

• CVE-2026-94455 — GitroomHQ postiz-app — CVSS 7.1 — Unauthenticated /enterprise/create-user mints lifetime top-tier organizations...