📋 ADVISORIES
- US offers $10 million reward for Chinese 'Hafnium' hacker Zhang Yu
The U.S. State Department is offering up to $10 million for information on Chinese hacker Zhang Yu, accused of leading Hafnium attacks that stole COVID-19 research.- The Rewards for Justice reward targets Zhang Yu, 44, director of Shanghai Firetech Information Science and Technology, who remains at large.
- Zhang is accused of acting for China's Ministry of State Security and Shanghai State Security Bureau, targeting U.S. universities, immunologists, and virologists to steal COVID-19 vaccine, treatment, and testing research.
- Zhang and alleged partner Xu Zewei face a nine-count indictment for intrusions from February 2020 to June 2021, including the HAFNIUM Microsoft Exchange Server campaign that exploited Exchange vulnerabilities and installed web shells to steal mailbox data.
- The HAFNIUM campaign targeted over 60,000 U.S. entities and compromised more than 12,700; Microsoft tracks the group as Silk Typhoon.
- Xu Zewei was arrested in Milan in July 2025 and extradited to the U.S. in April 2026; at a targeted law firm, attackers searched for terms including 'Chinese sources,' 'MSS,' and 'HongKong'.
Sources 📄 Source: rewardsforjustice.net · 📎 Coverage: therecord.media · 👁 via Cyber Security News, cryptika.com (discovered)
🔓 CVEs & KEV
CVE-2026-76500 — Cisco Application Policy Infrastructure Controller (APIC) — CVSS 9.8 — Cisco APIC Critical Resource Control Flaw (CVE-2026-76500) Analysis
CVE-2026-87683 — Brocade Fabric OS — CVSS 8.6 — Multiple stack-based buffer overflow vulnerabilities exist in the REST API ma...
CVE-2026-87682 — Brocade Fabric OS — CVSS 8.6 — Multiple OS Command Injection vulnerabilities exist in the management interfa...
CVE-2026-87680 — Brocade Fabric OS — CVSS 8.5 — A command injection vulnerability in the REST API management interface of Bro...
CVE-2026-87679 — Brocade Fabric OS — CVSS 8.5 — When Brocade Fabric OS versions before 10.0.1 processes trunk configuration o...
CVE-2026-87681 — Brocade Fabric OS — CVSS 7.1 — An Access Control Bypass vulnerability exists in the Role-Based Access Contro...