View Ridge Security
Back to Cyber Hose

Pentagon breach exposed unencrypted data of 3.1M US military personnel

Pentagon breach exposed unencrypted SSNs and personal data of 3.1M military personnel. Cisco SD-WAN auth bypass exploited, Apple code execution flaw flagged.

💥 BREACHES & INCIDENTS

  • Pentagon breach exposed unencrypted records of ~3.1M current and former US military personnel
    Hackers stole unencrypted personal data of millions of current and former US military service members and staff in a months-long breach of the Pentagon's Defense Manpower Data Center.
    • Affects about 2.8 million living people plus nearly 300,000 deceased, including current and former service members and staff; the DMDC maintains over 60 million records and manages identity credentials for Pentagon systems, buildings, and bases.
    • Stolen data includes Social Security numbers, names, dates of birth, sex, race, and military service details; the records were unencrypted.
    • Several unauthorized users exploited a security vulnerability in an unspecified file-sharing system between October 2025 and mid-July 2026; the hackers' identities are unknown.
    • The DoD says it has no indication the data was misused; the breach follows a September FBI breach attributed to ShinyHunters and echoes the 2015 OPM hack attributed to China.
    Sources 📎 Coverage: techcrunch.com · 👁 via @zackwhittaker@mastodon.social

🕵️ RESEARCH & DEEP DIVES

  • Malicious Custom GPTs Turn ChatGPT Into RAT Delivery Lure via ClickFix
    Attackers are abusing malicious Custom GPTs on ChatGPT's legitimate domain to lure users into a ClickFix infection chain that deploys a RAT.
    • Applies to ChatGPT users and organizations; Huntress's SOC responded to at least 40 incidents tied to the Google Sites domain involved, two confirmed via a Custom GPT instance.
    • Attackers created Custom GPTs mimicking real products (e.g., 'Plus 5.6') on OpenAI's trusted chatgpt.com domain, redirecting victims to a malicious Google Sites 'backup' domain.
    • The fake site shows a Cloudflare-style page with a fake CAPTCHA and a ClickFix prompt tricking users into running a PowerShell command that downloads an MSI file.
    • The MSI sideloads malicious DLLs via a legitimate Canon-signed application; an encrypted loader hidden in a WAV file is decrypted in memory to deploy the RAT.
    • The RAT steals browser data, runs hidden remote desktop sessions, enables camera/microphone spying, creates user accounts, and serves as a foothold for further payloads.
    Sources 📎 Coverage: darkreading.com · 👁 via Dark Reading

📋 ADVISORIES

  • Cisco Catalyst SD-WAN Manager auth bypass (CVE-2026-76504) actively exploited, grants admin API access
    Cisco Catalyst SD-WAN Manager has an actively exploited authentication bypass flaw (CVE-2026-76504) that gives unauthenticated attackers admin-level API access.

    • Affects Cisco Catalyst SD-WAN Manager (formerly vManage) versions prior to 20.9.10.1, 20.12.8.2, 20.15.6.1, 20.18.4.1, 26.1.2.1, and 26.2.1; exposure exists regardless of device configuration.
    • The flaw (CWE-177, improper handling of URL encoding) in the API's session-based authentication lets requests skip the authentication rule guarding a protected endpoint.
    • Exploitation uses a crafted HTTP request with a URI-encoded character — Cisco's IOCs point to encoding the letter 'j' in the j_security_check login-handler path — yielding unauthenticated admin API access.
    • Compromise allows viewing or modifying the configuration of every SD-WAN device the Manager instance controls, up to several thousand devices in some deployments.
    • Cisco PSIRT became aware of active exploitation in September 2026 after identifying the issue via a TAC support case.
    Sources 📎 Coverage: cisecurity.org · 👁 via CIS Advisories

  • CIS warns of Apple arbitrary code execution flaw exploited in sophisticated attacks
    CIS issued an advisory on an Apple vulnerability allowing arbitrary code execution that may have been exploited in targeted attacks.

    • Affects Apple devices running versions prior to iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1
    • Processing a maliciously crafted file (CVE-2026-86950) can lead to arbitrary code execution via drive-by compromise
    • Apple reports the issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on iOS versions before iOS 27
    • Successful exploitation could let attackers install programs, view, change, or delete data, or create accounts with full user rights
    Sources 📎 Coverage: cisecurity.org · 👁 via CIS Advisories

🔓 CVEs & KEV

  • CVE-2026-102115 — Kiteworks Core — CVSS 9.8 — Kiteworks Core Authentication Bypass in the Password Reset WorkflowKiteworks ...

  • CVE-2026-100512 — Hook & Filter Nested Pages — CVSS 9.8 — Nested Pages Plugin: Contributor PHP Object Injection Exposes WordPress to RCE

  • CVE-2026-55494 — Quenary tugtainer — CVSS 9.8 — Tugtainer Agent Unauthenticated API Access Leads to Remote Code Execution

  • CVE-2026-55181 — Quenary tugtainer — CVSS 9.4 — Tugtainer OIDC Bypass Initiates Authentication Flow Despite Disabled Configuration

  • CVE-2026-102147 — Kiteworks Core — CVSS 9.3 — Kiteworks Core Stored XSS Grants Unauthenticated Admin Takeover

  • CVE-2026-102104 — Kiteworks Email Protection Gateway — CVSS 9.1 — Kiteworks Email Protection Gateway server-side request forgeryKiteworks Email...

  • CVE-2026-102103 — Kiteworks Email Protection Gateway — CVSS 9.1 — Kiteworks Email Protection Gateway server-side request forgeryKiteworks Email...

  • CVE-2026-62308 — Quenary tugtainer — CVSS 9.1 — Tugtainer Authenticated SSRF Exposes Internal Networks, Cloud Metadata

  • CVE-2026-102120 — Kiteworks Core — CVSS 8.8 — Kiteworks Core OS Command InjectionA privilege escalation vulnerability in Ki...

  • CVE-2026-102125 — Kiteworks Core — CVSS 8.8 — Kiteworks Core Sandbox EscapeThe sandbox that isolates document conversion on...

  • CVE-2026-102121 — Kiteworks Secure Data Forms — CVSS 8.6 — Kiteworks Secure Data Forms Exposure of Sensitive Information to an Unauthori...

  • CVE-2026-102126 — Kiteworks Core — CVSS 8.1 — Kiteworks Core Stored Cross-site Scripting (XSS)A stored cross-site scripting...

  • CVE-2026-102112 — Kiteworks Core — CVSS 7.8 — Kiteworks Core Local Privilege EscalationA privilege escalation vulnerability...

  • CVE-2026-102113 — Kiteworks Core — CVSS 7.8 — Kiteworks Core Local Privilege EscalationA privilege escalation vulnerability...

  • CVE-2026-102118 — Kiteworks Core — CVSS 7.8 — Kiteworks Core before version 9.5.0 is vulnerable to Local Privilege Escalati...

  • CVE-2026-102123 — Kiteworks Core — CVSS 7.4 — Kiteworks Core Path TraversalA Kiteworks appliance setup interface did not co...

  • CVE-2026-102114 — Kiteworks Core — CVSS 7.2 — Kiteworks Core OS Command InjectionA command injection vulnerability in Kitew...

  • CVE-2026-102116 — Kiteworks Email Protection Gateway — CVSS 7.2 — Kiteworks Email Protection Gateway Path Traversal-A weakness could have allow...

  • CVE-2026-102117 — Kiteworks Core — CVSS 7.2 — Kiteworks Core Remote Code ExecutionOn deployments where the remote-support c...

  • CVE-2026-102119 — Kiteworks Email Protection Gateway — CVSS 7.2 — Kiteworks Email Protection Gateway Path TraversalA path traversal weakness in...

  • CVE-2026-102124 — Kiteworks Core — CVSS 6.5 — Kiteworks Core Missing Authentication for Critical FunctionA Kiteworks applia...

Need help assessing your exposure?

Start with the free Posture Self-Check to see where you stand against the current threat landscape.

Free Posture Self-Check