🚨 ACTIVE EXPLOITATION
- UPDATE: StyleSmuggler zero-day (CVE-2026-75650) exploited to deploy PSK Agent RAT on Magento stores
CVE-2026-75650
Attackers are exploiting the StyleSmuggler zero-day in Adobe Commerce and Magento to install the PSK Agent remote access trojan on online store servers.- Affects Adobe Commerce 2.4.4–2.4.9, Adobe Commerce B2B 1.3.3–1.5.3, and Magento Open Source 2.4.6–2.4.9; CVSS 10.0 unauthenticated RCE, actively exploited since September 4, 2026.
- Exploitation targets /paypal/transparent/response/ to plant PHP code in report files under var/report/, then a /graphql request with attacker-controlled styles values loads and executes the poisoned file.
- Imperva tracked a coordinated PSK Agent campaign September 9–13, 2026 hitting stores in Western Europe, North America, and Asia-Pacific; the malware had a 0% VirusTotal detection rate.
- A curl-piped bash dropper (psk_agent.sh) fetches chi_down, an obfuscated 10.5 MB Go RAT that runs shell commands, proxies traffic via SOCKS5, and survives restarts; some attacks also drop a t4.php/zer4.php webshell.
- IOCs include SHA-256 hashes for psk_agent.sh, chi_down, and zer4.php; source IPs 132.243.238.178, 86.107.100.105, 185.18.222.13, 64.204.130.9; C2 domains ntp.timesync[.]to, windwsecurity[.]run, and beacon domain .0f851bdc9d.ddns.1433.eu.org; Chinese-language artifacts suggest a Chinese-speaking operator with moderate confidence.
💥 BREACHES & INCIDENTS
cPGuard update channel hijacked to backdoor Linux servers and steal credentials
Attackers compromised OPSSHIELD's cPGuard update infrastructure to push a malicious script that backdoored Linux servers and stole sensitive files.- Affects cPGuard versions 5.88.12 through 5.88.19 on Linux hosting servers; fixed in 5.88.25 or later
- Attack began November 2, 2026 at 02:06 UTC using compromised credentials to access OPSSHIELD's update distribution CDN
- Malicious script cpguard-v58812-i91511.sh installed a backdoor shell at /var/tmp/.cpg91511_sh and staged /var/tmp/.cpg91511/loot.tgz
- Stolen data included /etc/shadow, /etc/passwd, root MariaDB/MySQL config, root shell history, and root SSH authorization and known-hosts files
- Collected files were uploaded to OPSSHIELD's own licensing server under a compromised account; the vendor confirmed the attacker retrieved roughly 32 files, each from one customer server
Harvard alumni data breach exposed info of 851,000 accounts, HIBP confirms
Have I Been Pwned confirmed that the ShinyHunters breach of Harvard's Alumni Affairs and Development systems exposed data on 851,000 accounts.- Affects Harvard alumni, their spouses and partners, donors, parents of students, and some current students, faculty, and staff.
- Stolen data includes names, emails, dates of birth, phone numbers, physical addresses, social media profiles, event attendance, and donation details.
- Harvard says the breached systems did not generally contain Social Security numbers, passwords, or financial account information.
- Attackers gained access via a phone-based phishing attack discovered November 18, 2025; ShinyHunters claimed responsibility and leaked a 1.1GB archive in February 2026 after Harvard refused to pay a ransom.
- Princeton and the University of Pennsylvania disclosed similar donor-data breaches in the same period; ShinyHunters also published the UPenn data.
🔓 CVEs & KEV
CVE-2026-4052 — WSO2 API Manager — CVSS 9.8 — WSO2 Identity Server Resident Key Manager Flaw Grants System API Access to Self-Registered Users
CVE-2026-13594 — Zohocorp Log360 — CVSS 9.1 — Zoho ManageEngine Log360/EventLog Analyzer Critical Unauthorized Access Vulnerability
CVE-2026-120333 — TYPO3 Extension "Frontend User Registration" — CVSS 8.8 — Broken Access Control in extension "Frontend User Registration" (sf_register)...
CVE-2026-120330 — TYPO3 Extension "Mail" — CVSS 7.1 — Broken Access Control in extension "Mail" (mail)Backend actions and ajax rout...
CVE-2026-120328 — TYPO3 Extension "Mail" — CVSS 6.9 — Information Disclosure in extension "Mail" (mail)The click tracking middlewar...
🕵️ RESEARCH & DEEP DIVES
ESET uncovers Gorbag, Russia-aligned APT hitting Ukrainian courts and city councils with self-deleting malware
ESET Research has identified Gorbag, a Russia-aligned threat group harvesting data from Ukrainian organizations near the front line since February 2025.- Targets are exclusively Ukrainian: law enforcement and justice bodies, frontline city councils, defense sector entities, and a major transit hub for foreign military aid.
- Delivery is via spearphishing from compromised accounts; through 2025 attachments were macro-enabled Excel files, and in early 2026 RAR archives exploiting the WinRAR path traversal flaw CVE-2025-8088.
- The toolset includes Prime ReverseShell, a PowerShell reverse shell in a .NET binary, and BeautyStealer (versions 0.9–2.0), a C++ stealer that pulls browser data from Chrome, Edge, Opera and Firefox, OpenVPN configs, and files with ~40 extensions including .kdbx, .jks, .rdp, .pfx and .zs2.
- Data is collected in a single pass, exfiltrated, and the malware deletes itself; ESET suggests Gorbag may act as an initial access broker for other Russia-aligned actors.
- Targeted councils are in cities hit by Russian air strikes, suggesting operators may be reporting strike effectiveness to Russian military leadership.
Sources 📄 Source: welivesecurity.com · 📎 Coverage: helpnetsecurity.com · 👁 via @ESETresearch@infosec.exchangeTETRA network authentication fails to protect message authenticity, enabling traffic injection (CVE-2025-52944)
Midnight Blue's research shows TETRA authentication provides no per-message authenticity guarantees, allowing malicious traffic injection into mission-critical radio networks.- Affects TETRA radio networks used by emergency services, law enforcement, military, and critical infrastructure operators in over 100 countries, including voice dispatch and SCADA WAN deployments
- TETRA authentication (CVE-2025-52944) only restricts network registration; it provides no authenticity or integrity for individual traffic or signalling messages, so any attacker can inject voice or data using an already-authenticated ISSI
- Many base stations skip re-authentication when a radio roams between cells, extending the window for impersonation and injection attacks
- Most critical infrastructure operators run TEA1, which is backdoored and broken within a minute, or no encryption at all, leaving traffic injectable in practice
- The 2026 Taiwan High Speed Rail incident, where a student triggered a General Alarm that halted trains, demonstrates real-world impact of such TETRA attacks
📋 ADVISORIES
NCSC: UK Faces AI-Powered Cyberattacks on Critical Infrastructure by 2028
The UK NCSC's 2026 Annual Review warns AI-powered malware will highly likely feature in a ransomware attack on UK critical infrastructure by 2028.- Applies to UK organizations of all sizes, especially critical national infrastructure operators, and organizations with legacy technology or weak security postures.
- NCSC handled 80 nationally significant incidents and 1,831 attack reports (337 needing Incident Management support) from Sept 2025 to Aug 2026; malicious cyber activity costs UK organizations nearly $20 billion a year.
- AI acts as a force multiplier across the attack lifecycle — reconnaissance, social engineering, vulnerability discovery, and exploit development — scaling existing tactics rather than creating new attack vectors.
- China is assessed as best positioned to use AI against critical national infrastructure; Russia and Iran conduct sub-threshold attacks, and 88% of incidents used four access routes: public-facing apps, phishing, valid accounts, and external remote services.
- AI-assisted vulnerability discovery is expected to trigger a 'patch wave,' and a widening digital divide is likely between organizations able to adopt AI for defense and those that cannot.
Sources 📄 Source: ncsc.gov.uk · 📎 Coverage: securityweek.com · 👁 via SecurityWeek, Cyber Security NewsNCSC Annual Review 2026: 80 nationally significant incidents, AI seen accelerating ransomware threat
The UK NCSC's 2026 Annual Review reports 80 nationally significant cyber incidents and warns AI is making attacks faster and cheaper.- Applies to UK organizations, with critical infrastructure highlighted as exposed to AI-accelerated ransomware threats
- Review covers 1 September 2025 to 31 August 2026: 1,831 attack reports, 337 incidents needing Incident Management support, 80 nationally significant
- Early Warning service notified 8,500 organizations of suspected compromise; 88% of large-organization incidents used four access routes: public-facing apps, phishing, valid accounts, external remote services
- AI helps attackers research targets, craft social engineering messages, and find flaws faster, though no observed AI use enabled a new class of attack
- Most successful attacks still exploit known vulnerabilities, weak security hygiene, and internet-facing assets
📄 <https://www.ncsc.gov.uk/collection/annual