💥 BREACHES & INCIDENTS
DC Health Agency Exposes 400,000 Medicaid Beneficiary Records
DC's Department of Health Care Finance is notifying nearly 400,000 Medicaid and DC Healthcare Alliance beneficiaries of a data exposure on its website.- Affects Medicaid and DC Healthcare Alliance beneficiaries who enrolled between 2023 and 2026; 399,086 people reported to HHS.
- Exposed data includes Medicaid IDs, provider names, dates of birth, race, gender, ethnicity, and ward; no Social Security numbers, names, or financial information.
- Two reports on the DHCF website displayed only summary data but contained hidden underlying personal information accessible to unauthorized users between 2023 and July 2026.
- Not a hack; DHCF discovered the issue in July and removed the reports immediately, with no evidence of misuse.
📎 https://www.securityweek.com/dc-health-agency-exposes-400000-beneficiary-records/ · 👁 via https://www.securityweek.com/dc-health-agency-exposes-400000-beneficiary-records/
Former US Soldier Cameron Wagenius Sentenced to 70 Months for Hacking AT&T and Verizon
Former Army soldier Cameron John Wagenius was sentenced to 70 months in prison for hacking AT&T and Verizon and extorting victims with stolen data.- Cameron John Wagenius, 22, a former Army soldier using the moniker 'kiberphant0m', hacked wireless carrier databases between April 2023 and December 2024 while on active duty.
- He publicly disclosed the confidential call detail records of a government official in November 2024 and threatened to release more.
- Wagenius and conspirators used the SSH Brute utility and other tools to obtain credentials from at least 10 organizations, exfiltrate data, and extort at least $1 million.
- Stolen data was also sold on cybercrime forums and used for fraud; he was ordered to pay $294,978 in restitution.
- Co-conspirators include Connor Riley Moucka (Judische) and John Erin Binns, tied to AT&T, T-Mobile, and Snowflake breaches; Moucka pleaded guilty in August.
📎 https://www.securityweek.com/prison-sentence-for-former-us-soldier-who-hacked-att-and-verizon/ · 👁 via https://www.securityweek.com/prison-sentence-for-former-us-soldier-who-hacked-att-and-verizon/
🔓 CVEs & KEV
CVE-2026-12265 — Zohocorp DDI Central — CVSS 8.8 — Missing Authorization on HA Failover Config allows Complete Data DestructionZ...
CVE-2026-12264 — Zohocorp DDI Central — CVSS 8.8 — Authenticated File Write via HA Failover Config Upload leads to RCEZohocorp M...
CVE-2026-78424 — SUSE NeuVector — CVSS 8.8 — OS Command Injection in Packet-Capture (Sniffer) Filter leading to Remote Cod...
CVE-2026-101292 — Red Hat AMQ Broker 7 — CVSS 8.2 — Artemis-core-client: unsafe reflection in apache activemq artemis federation ...
CVE-2026-86330 — Red Hat Openshift Data Foundation 4 — CVSS 7.2 — Noobaa-core: noobaa-core: os command injection in cluster_internal_api.set_ho...
🕵️ RESEARCH & DEEP DIVES
TrustSink Attack Uses Rogue MFA Provider to Steal Microsoft Entra Passwords During Legitimate Logins
Varonis disclosed TrustSink, a Microsoft Entra attack that abuses a rogue external authentication method to steal passwords during legitimate MFA logins.- Targets Microsoft Entra ID tenants; requires prior compromise of a privileged account such as Global Administrator or Authentication Policy Administrator.
- Abuses External Authentication Methods (EAM): attacker registers an app and service principal, grants consent, and hosts a rogue MFA provider over HTTPS.
- During MFA the provider shows users a pixel-accurate copy of Microsoft's password page and silently records credentials, while sending Entra a signed token claiming a hardware-key check succeeded.
- Works as a post-compromise persistence mechanism; password resets alone don't help because the provider captures replacement credentials at next login.
- IOCs include trident-sip-filter.ngrok-free.dev, its /eam/.well-known/openid-configuration discovery URL, the externalauthprovider redirect URI, and deploy.py/cleanup_eam.py scripts.
Sources 📄 Source: varonis.com · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)Proton Mail sender spoofing via display-name homograph confirmed, bounty paid, still unfixed
A researcher disclosed a Proton Mail sender-spoofing flaw using display-name homographs that Proton confirmed and paid a bounty for but left unfixed for 16 months.- Affects Proton Mail web interface users; spoofed messages land in the inbox with no warning.
- Attackers control the From display name and can place an address-shaped string on a look-alike domain (e.g. gmaiI.com with capital I), which renders identically to gmail.com in the default macOS system font.
- Messages from domains without a DMARC record get no authentication-failure banner even when SPF fails; a Reply-To alias can silently redirect replies to attacker-controlled addresses.
- Demonstrated end-to-end using swaks over Proton's inbound MX with STARTTLS; reported 13 Feb 2025, bounty awarded April 2025, still reproducible as of September 2026.
Fake Jev AI storefronts resell access and route user prompts through third-party servers
Fake storefronts impersonating the newly launched Jev AI model resell access at inflated prices while routing user prompts through servers the operators control.- Affects users of Jev AI, a model launched September 15, 2026 that returns decisions rather than written answers; lookalike domains were registered three days after launch.
- Fake storefronts with playgrounds, documentation, pricing and checkout pages surfaced in search results, some ranking ahead of the official site.
- The sites forward requests to the genuine API but charge 6 to 11.5 times the official rate ($0.042 per million input tokens vs $0.247–$0.483 at resellers), putting an unrelated operator between users and the developer.
- One storefront routed requests through an app hosted on Railway behind Cloudflare, with no service agreement covering the route and unclear log retention.
- Six sites shared the same storefront code across music, video and other AI offerings; about 670 domains containing the model's name appeared in eight days, roughly twice the usual rate. IOCs include jev-ai[.]pro, jevtypesafeai[.]com, jev-agent[.]org, jev-agent[.]com, jevapi[.]pro, jevmodel[.]org and jevai[.]site.
Sources 📄 Source: research.eye.security · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)
📋 ADVISORIES
- 📄 Source for OpenAI Agent Swarm Escaped Sandboxes, Hit Hugging Face, Left 80,000 Attack Payloads — swarmtraces.org