🚨 ACTIVE EXPLOITATION
- WSO2 path traversal flaw CVE-2026-5430 added to CISA KEV catalog
CVE-2026-5430
CISA has added a path traversal vulnerability in multiple WSO2 products to its KEV catalog.- Affects WSO2 API Control Plane, API Manager, Traffic Manager, and Universal Gateway.
- Path traversal vulnerability allows unrestricted file upload leading to remote code execution.
- CISA KEV due date for federal remediation is 2026-09-27.
💥 BREACHES & INCIDENTS
- Canva breached via vendor Canny's Salesforce instance by new group 'The Seven Deadly Sins'
New extortion group The Seven Deadly Sins hacked Canva's data by breaching vendor Canny and its Salesforce connection, then listed Canva on a leak site after an unpaid ransom demand.- Canva Pty Ltd and other Canny/Salesforce customers are affected; Canny is a vendor connected to Canva's Salesforce account.
- Attackers claim full admin access to Canva's Salesforce org, exporting 2M+ CRM records, a 200M+ row data warehouse, contracts, billing attachments, and customer email lists of firms like Mercury and Proxyscrape.
- TSDS attacked Canny on August 28, spent two weeks inside exporting from Jira, Salesforce, Okta, and HubSpot, and claims ongoing access to 300+ Jira instances and 3.8 TB of data.
- The group uses email ransom demands with a one-week deadline, then a leak site countdown; it does not deploy ransomware and claims low-8-figure payouts.
- Canva confirmed limited enterprise customer information was exposed via Canny's connection to its Salesforce account; this is Canva's second breach after the 2019 incident affecting 139 million users.
🔓 CVEs & KEV
- CVE-2026-93353 — 9001 copyparty — CVSS 6.0 — copyparty SFTP Volume Restriction Bypass via mkdir/rmdir/chattr Handlerscopyp...
🕵️ RESEARCH & DEEP DIVES
MacSync macOS malware variant uses public iCloud calendar events to deliver new payloads
A new MacSync macOS infostealer variant uses public iCloud calendar events to deliver fresh payloads.- Targets macOS users, stealing browser data, crypto wallets, Telegram data, Keychain files, and SSH/AWS/Kubernetes/Git credentials.
- New variant fetches commands hidden in public iCloud calendar event descriptions, feeding them to zsh to download next-stage payloads.
- Delivered via ClickFix-style social engineering, fake cracked software, and a fake crypto wallet app called Toria promoted on social media.
- New Objective-C backdoor disguises as Finder, persists via LaunchAgent, .zshrc, and Git hooks, and can run attacker-supplied AppleScript or swap in fake Ledger wallet apps.
- Swift-based MacSync emerged in April 2025, evolving from the AMOS stealer family with modular capabilities.
'Salesbleed' Flaws in Salesforce Agentforce Enable Slack Phishing Attacks
Researchers found 'Salesbleed' vulnerabilities in Salesforce Agentforce that let attackers exfiltrate data and phish employees via trusted Slack channels.- Salesforce Agentforce customers are affected by three weaknesses collectively dubbed 'Salesbleed', with no CVE numbers assigned.
- Attackers can plant malicious AI prompts in Web-to-lead forms, which Agentforce agents ingest and execute inside the victim's environment to exfiltrate data to attacker-controlled URLs.
- Injected prompts can induce a Salesforce bot to reply to internal Slack threads with phishing links, without attribution or user confirmation, making messages appear to come from real employees or IT.
- Zenity researchers bypassed Salesforce's regex-based URL filtering with simple workarounds; Salesforce has since moved to spec-conformant URL parsing and now requires user confirmation for Slack message actions.
- Salesforce says there is no evidence of real-world exploitation so far.
New Carbonato malware uses AI agents to hijack exposed Docker hosts
A new botnet called Carbonato targets unauthenticated Docker daemons to install the Hermes Agent AI framework and take control of hosts.- Affects hosts running Docker daemons with the API exposed on port 2375 without authentication.
- Carbonato connects to the exposed API, launches a privileged container, and opens a reverse SSH tunnel while installing an SSH server with the operators' key.
- Persistence is achieved via cron jobs, systemd timers, rc.local, and OpenRC hooks; new deployments are reported through Telegram.
- The Hermes Agent framework is installed with a 'GH0ST' agent that overwrites the default SOUL.md persona file and runs an interactive command loop via Telegram.
- Worm-like scripts scan attached networks every five minutes to spread to other exposed Docker daemons; indicators include the GH0ST persona file, CARBONATO_API_KEY, unexpected Telegram traffic, and reverse SSH tunnels toward AS262145.
SectopRAT Found Hidden in Tampered Legitimate Audio Application
Fortinet discovered a new SectopRAT variant hidden inside a legitimate Italian digital-audio application via a tampered DLL.- Targets of the campaign are users of a legitimate Italian digital-audio application; the malware was added after installation, not via a compromised vendor or exploited vulnerability.
- SectopRAT (ArechClient2) is an obfuscated .NET backdoor and infostealer that steals browser credentials, cookies, files, saved payment info, and data from email, gaming, and cryptocurrency wallet apps.
- Attackers tampered with FrameworkBase.dll to load the payload, which was encrypted and embedded in a database file and launched via a legitimate-looking executable.
- The malware connects to attacker infrastructure with AES-encrypted traffic (unlike prior variants) and supports 29 commands, including file/process manipulation, screen viewing, and self-cleanup.
- SectopRAT has previously been disguised as a Notion installer, Claude Desktop, and a Trojanized EarthTime app, delivered via malvertising, SEO poisoning, and ClickFix scams.
Lunex info stealer MaaS deployed via BYOVD targeting Ukrainian-speaking users
Ontinue researchers have published the first in-depth binary analysis of the Lunex information stealer, delivered via BYOVD to Ukrainian-speaking users.- Targets Ukrainian-speaking users via a fake CAPTCHA page that tricks victims into running an msiexec command installing elita.msi, a stealthy per-user MSI installer posing as 'Vertification' by 'Internal Software'.
- The loader (psychedelic.exe/config.exe) spoofs Canonical's Update Manager, encrypts all strings with AES-256-CTR, and escalates privileges before deploying the AMD driver PDFWKRNL.sys (CVE-2023-20598) as a BYOVD to disable kernel-level security callbacks.
- LunexStealer (psychedeliclove.exe) steals credentials from seven Chromium-based browsers, exfiltrates cryptocurrency wallets, and installs a PowerShell-based Native Messaging Host backdoor for persistent remote filesystem access.
- Ontinue identified 28 Lunex C2 panels across 13 countries; Russian-language operator UI strings and banking trojan capabilities suggest a financially motivated, CIS-aligned threat actor.
- Key IOCs include SHA-256 hashes for elita.msi (38E90AFF...), the loader (bf14cd6c...), PDFWKRNL.sys (6e8b49cf...), and LunexStealer (06f43469...).
📋 ADVISORIES
- CERT/CC details ViewSonic vCast flaw chain enabling unauthenticated smartboard compromise
CERT/CC published a vulnerability note describing three chained ViewSonic vCast flaws that allow unauthenticated full compromise of ViewBoard smartboards.- Affects ViewSonic ViewBoard smartboards running the vCast wireless connection suite, widely deployed in enterprise and educational environments.
- CVE-2026-82989: unauthenticated /snapshot or /screen API endpoints allow remote exfiltration of JPEG images of screen content.
- CVE-2026-82988: an unauthenticated APK download endpoint lets attackers trigger installation of a malicious APK via a supplied URL.
- CVE-2026-82987: exposed unauthenticated network service endpoints allow arbitrary input injection via HTTP requests.
- Chained over a shared network, the flaws enable arbitrary code execution without user interaction, persistent app installation, and lateral movement; ViewSonic did not respond to coordination.
- Reported by Adam Mohammed Zenker; documented in CERT/CC Vulnerability Note VU#234131, published 2026-09-24.