🚨 ACTIVE EXPLOITATION
- Roundcube Webmail SQL Injection Flaw CVE-2026-48842 Exploited in the Wild
CVE-2026-48842
Canada's Cyber Center warns that attackers are actively exploiting a pre-authentication SQL injection vulnerability (CVE-2026-48842) in Roundcube Webmail.- Affects Roundcube Webmail deployments running versions before 1.6.16 (LTS branch) or before 1.7.1 (newer branch).
- CVE-2026-48842 is a pre-authentication SQL injection flaw in the virtuser_query plugin, requiring no valid credentials to exploit.
- The flaw stems from a backslash-escaping bypass in PHP's preg_replace function, letting attackers manipulate database queries via crafted input before login.
- Canada's Cyber Center updated advisory AV26-503 on September 21, 2026, confirming active exploitation based on open-source reporting.
- Exploitation could expose user identities, messages, address books, and support phishing or business email compromise operations.
Sources 📄 Source: cyber.gc.ca · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)
💥 BREACHES & INCIDENTS
- Armenian man sentenced to 24 months in US prison for Ryuk ransomware attacks
A US court has sentenced Armenian national Karen Vardanyan to 24 months in prison and ordered him to pay over $1.2 million in restitution for his role in Ryuk ransomware attacks.- Karen Vardanyan, a 35-year-old Armenian national, was sentenced to 24 months in federal prison followed by 3 years of supervised release for Ryuk ransomware attacks.
- He was involved in Ryuk attacks between March 2019 and June 2020, extorting more than $1 million from several victims, and was ordered to pay over $1.2 million in restitution.
- Charged in February 2024, he was arrested in Ukraine in April 2025, extradited to the US in June 2025, and pleaded guilty to conspiracy and computer fraud in July 2026.
- The DOJ's description suggests he was likely a ransomware affiliate or initial access provider rather than a malware developer or infrastructure operator.
🔓 CVEs & KEV
CVE-2026-82077 — PaperCut NG/MF — CVSS 7.3 — PaperCut NG/MF: Remote Code Execution via Scan2FaxAn improper limitation of a...
CVE-2026-87739 — PaperCut NG/MF — CVSS 6.9 — PaperCut MF/NG: User permissions are not evaluated on report generationAn imp...
🕵️ RESEARCH & DEEP DIVES
TeamFiltration Campaign UNK_CondorFiltration Hits 5,700+ Microsoft 365 Accounts in Chile
A TeamFiltration brute-force campaign targeted over 5,700 Microsoft 365 accounts across 28 tenants, compromising seven unmanaged service accounts.- Campaign UNK_CondorFiltration targeted Chilean retail and financial institutions across 28 Microsoft 365 tenants, with one retailer absorbing 78.3% of authentication attempts.
- Seven accounts were compromised — all dormant service accounts with default or never-rotated passwords and no MFA; six were breached within 7 minutes.
- Three attack waves ran late July to August 2026, peaking at ~1,520 and ~1,560 accounts per day, originating from 1,487 unique AWS EC2 IP addresses.
- The attacker used the TeamFiltration offensive framework for enumeration, password spraying, and exfiltration, then pivoted via a German VPN to probe corporate VPN, Azure Portal, SharePoint, and Microsoft Graph API.
- Post-compromise activity included access to Office, OneDrive, and Teams, suggesting possible data harvesting.
Malicious Firefox PDF Extension Steals Google Account Sessions via Post-Install Payload
A malicious Firefox extension disguised as a PDF tool steals Google account sessions and can silently change account passwords.- Targets Firefox users of Google services, mainly Portuguese- and Spanish-speaking users, via a PDF identity-check lure; extension ID pdf-para-texto@extensao.local appeared in Firefox Add-ons on September 3, 2026, with version 1.4 turning malicious on September 11.
- Steals active Google session cookies and account details, and can silently reset the account password when Google forces a password change.
- Ships clean with no theft instructions; five seconds after install it opens an attacker page (pdf[.]gusercontent[.]com) that arms the extension with settings and an account takeover script via a message bridge, evading store review.
- The injected script uses Google's real sign-in flow behind a full-screen verification overlay, forces passkey/security-key challenges, retries after bot-detection blocks, and exfiltrates session tokens and page telemetry to pdf[.]gusercontent[.]com endpoints.
- Socket.dev assessed overall impact as fairly low due to the add-on's small user base; C2 domain pdf[.]gusercontent[.]com with payload SHA-256 hashes documented.
Sources 📄 Source: socket.dev · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)New Galago ransomware operation emerges with claimed links to Panzer group
A new ransomware operation called Galago has emerged claiming a partnership with the Panzer group, though no attacks have been confirmed.- Organizations in healthcare, particularly Nordic/Icelandic providers, are the focus of the only victim claim so far.
- Galago was identified by CyberXTron on September 9, 2026 after an open-source alert alleged an attack on Icelandic healthcare organization Inter ehf, claiming 105 GB of stolen data with a leak window of September 28-29.
- No Galago intrusion, payload, or entry vector has been confirmed; its leak site was inactive when monitoring began September 15, with no published victims.
- Galago claims partnership with Panzer, supported only by a shared naming prefix on their Tor leak-site domains; Panzer posted 32 victims between August 5 and September 23, 2026 using double extortion.
- IOCs include Galago leak site pnzr4delgur5dlhtqcy7qqm6m7dkivxwh742enezpks5kswfpx7qrsid[.]onion, Panzer leak site pnzruro7syvwvefx5mpo2fhzi4jftgquynsqf3vy5x3no57yp2iz4nyd[.]onion, and a Panzer Tox ID.
Sources 📄 Source: cyberxtron.com · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)
📋 ADVISORIES
- 📄 Source for Check Point warns of active exploitation of two critical VPN and management flaws (CVSS 9.8) — blog.checkpoint.com