💥 BREACHES & INCIDENTS
- 68 GB of Philippine DMW/POEA database backups stolen via exposed staging server
An attacker exfiltrated 68.8 GiB of database backups from the Philippine overseas-employment agency (POEA, now under DMW), leaving evidence on an internet-exposed staging server.- Affected: Philippine Department of Migrant Workers / POEA — 27 database backups (68.837 GiB) of overseas Filipino worker records were copied out.
- Researchers found the operator's staging server open over HTTP, containing the operator's own rclone log confirming the completed exfiltration; download servers presented a *.dmw.gov.ph certificate issued to POEA.
- Privilege escalation used a rebranded GodPotato payload ('Wrqsnx') reaching SYSTEM via SeImpersonate abuse with no CVE involved.
- The payload was loaded in memory by a PowerShell stager so no file hits disk, leaving only a writable memory page in combase.dll after process exit, evading injection scanners.
- Separately, hacktivist group HappyGoluckyPH claimed responsibility for a DMW breach, alleging over a month of access to DMW's Active Directory; a ransomware attack also forced DMW to shut down online services.
🕵️ RESEARCH & DEEP DIVES
Skyw4lker Device Code Phishing Campaign Targets U.S. Manufacturing, Tech, and Healthcare Firms
A device code phishing campaign dubbed Skyw4lker is compromising U.S. organizations' Microsoft 365 accounts without stealing credentials.- Targets U.S. organizations, primarily in manufacturing, technology, and healthcare sectors.
- Steals Microsoft 365 authentication tokens by abusing the legitimate device code authentication flow, bypassing MFA without capturing passwords.
- Victims receive password-protected documents posing as contracts or service proposals, leading to a page on sites[.]google[.]com that redirects into a Microsoft authentication flow the attacker initiated.
- Phishing pages use obfuscated JavaScript and a PHP backend to create victim sessions, collect IP address and geolocation, and poll until authentication completes.
- Because the authentication itself is legitimate, identity telemetry may show only a valid sign-in, making the attack hard to detect.
- FBI recorded 193,407 phishing/spoofing complaints in 2024 and over $20.9 billion in reported internet crime losses in 2025.
CrowdStrike 2026 Legal Threat Landscape Report: eCrime leads legal-sector attacks, China activity intensifies
CrowdStrike has released its 2026 Legal Threat Landscape Report finding that eCrime drives 82% of threats to legal entities as intrusions against the legal sector nearly doubled since 2023.- Applies to law firms and legal entities, which hold privileged communications, M&A details, intellectual property, government matters, and financial records
- Cyber intrusions targeting the legal sector nearly doubled between 2023 and 2026, driven by both eCrime and nation-state adversaries
- eCrime accounts for 82% of threats to legal entities, with financially motivated adversaries as the dominant actor group
- China-nexus nation-state activity against the legal sector is intensifying, targeting long-term strategic intelligence value
- Findings are based on threat activity observed from September 1, 2025 through August 31, 2026
Fake Colombian court notice emails deliver XWorm RAT via hidden Windows scripts
Attackers are targeting Colombian organizations with phishing emails posing as court notices that install the XWorm remote access trojan.- Targets Colombian organizations with Spanish-language emails impersonating court/legal notices; the same judicial lure appeared in Blind Eagle-linked campaigns
- Attachments are VBScript or JavaScript files (e.g. ACTA_NOTIFICA_TUTELA.js, PROCESO DISCIPLINARIO_ RAD_00470032.vbs), some in ZIP archives, with second stages fetched from Filestack and ImageKit
- Obfuscated scripts use a custom Base93 decoder and multiple encryption layers, then run hidden PowerShell to load the RSG_UnityApp .NET DLL and inject XWorm into RegAsm.exe
- XWorm exfiltrates system details and supports shell commands, screen capture, file management, plugins, and DDoS; Arctic Wolf found three C2 servers and the same loader also delivering DCRat
- IOCs include C2s loganwolverin2042[.]webredirect[.]org:4521 and ukranieukranie20222022[.]duckdns[.]org:3008, IPs 45[.]92[.]1[.]127 and 77[.]110[.]114[.]115
Sources 📄 Source: github.com · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)Researchers chain SVG sanitizer bypass and CSP-stripping gadget to XSS in Cloudflare /cdn-cgi/image/
Searchlight Cyber researchers achieved cross-site scripting through Cloudflare's /cdn-cgi/image/ image transformation endpoint.- Affects any website proxied by Cloudflare that uses the managed /cdn-cgi/image/ Image Transformations endpoint, served from the customer's own hostname.
- The attack required three pieces: a bypass of Cloudflare's SVG sanitizer (svg-hush), a Chromium gadget that strips the default-src 'none' CSP, and an open-redirect chain.
- The open-redirect chain made the attack work even against restricted source configurations.
- The research builds on prior /cdn-cgi/ findings including CSP bypasses and XSS gadgets reported by kinugawamasato, albinowax, garethheyes, avlidienbrunn, matured_kazama, and kevin_mizu.
Huntress: Attackers Compromise Camera Management Software to Deploy Malware on Windows Hosts
Huntress observed multiple incidents where attackers compromised camera management software to deploy a reverse shell and malware on Windows computers.- Applies to organizations running camera/video management software on Windows, observed by Huntress across several customer environments in September and October 2026.
- Attackers gained access through the camera application, though the exact initial compromise method remains unresolved; no specific vulnerability or CVE was identified.
- Attackers deployed a suspected reverse shell (rs.win32.exe) in the user's application data directory, configured with a remote address, port, and authentication values.
- Malicious DLLs were sideloaded via the legitimate Windows Parental Control Monitor binary (WpcMon.exe), with Run Key persistence established and beacons sent to a C2 server.
- The affected application lacked file version info and logs; strings linked it to a domain of Korean company 3R Global, but Huntress could not confirm the vendor or software origin.
🔓 CVEs & KEV
CVE-2026-105420 — Wing Soft Technology Wing FTP Server — CVSS 9.4 — Path Traversal in Wing WFTP Server leading to Remote Code ExecutionWing FTP S...
CVE-2026-108142 — Veeam Backup and Replication — CVSS 9.1 — Veeam Patches Critical Backup & Replication Authorization Bypass Vulnerability
CVE-2026-116391 — GS Plugins GS Logo Slider — CVSS 8.8 — WordPress GS Logo Slider plugin through 3.8.9 - PHP Object Injection vulnerability...
CVE-2026-111850 — BuddyPress — CVSS 8.5 — WordPress BuddyPress plugin through 14.5.2 - SQL Injection vulnerabilityImproper N...
CVE-2026-116393 — iHomefinder, Inc. Optima Express — CVSS 7.5 — WordPress Optima Express + MarketBoost IDX Plugin plugin through 8.7.8 - Broken Ac...
CVE-2026-115591 — Supsystic Contact Form by Supsystic — CVSS 7.5 — WordPress Contact Form by Supsystic plugin through 1.10.5 - Sensitive Data Exposur...
CVE-2026-116392 — PickPlugins Accordion — CVSS 7.2 — WordPress Accordion plugin through 2.3.25 - PHP Object Injection vulnerabilityDese...
CVE-2026-115612 — iova.mihai SliceWP — CVSS 7.1 — WordPress SliceWP plugin through 1.2.13 - Cross Site Scripting (XSS) vulnerability...
CVE-2026-116404 — David Anderson Redux Framework — CVSS 6.5 — WordPress Redux Framework plugin through 4.5.16 - Broken Access Control vulnerabil...
📋 ADVISORIES
📄 Source for FBI seizes virtualine.net domain of bulletproof hosting provider tied to ransomware and CSAM — justice.gov
📄 Source for Claude AI builds one-click Chrome and zero-click Linux exploit chains in lab tests — anthropic.com
📄 Source for FBI seizes Virtualine bulletproof hosting domain in international operation — justice.gov
📄 Source for Moldova's health insurance agency CNAM hit by major cyberattack; possible theft of citizens' data — cnam.md
📄 Source for Adobe Patches 8 Critical Campaign Classic Flaws Enabling Code Execution and Security Bypass — adobe.com
📄 Source for *Malicious Firefox extensions impersonate Phantom