Cyber Hose

In this digest

• Ahold Delhaize takes systems offline after cyberattack disrupts stores in US and Europe
• Attackers exploit AhsayCBS backup flaws (CVE-2026-105133/105134) to deploy webshells and XMRig miners
• Cyberattack defrosts refrigerators at hundreds of French supermarkets via Danfoss controllers

In this digest

• CVSS 10.0 Bricksforge WordPress file upload flaw under active exploitation, enabling unauthenticated RCE
• CyberXero uses Claude Code AI agents in campaign stealing 628,000+ Ukrainian records
• 75 recovered AI agent transcripts show autonomous intrusions from recon to root

In this digest

• Weak admin password '123456' linked to breach of 8.8M Danish CPR records at IT firm Pays
• FBI confirms multiple arrests of ShinyHunters suspects in US, Jordan, and Netherlands
• Discourse Image Pipeline Exploit Chains JPEG Race, GhostScript and ImageMagick for File Read

In this digest

• Nippon Columbia malware incident may expose 8.7M Daiichi Kosho karaoke customer records
• Kimsuky's Operation GitPower spear-phishes Ukrainian diplomacy and security experts
• Google unveils AISeal enclave architecture to isolate Android on-device AI data from host OS

In this digest

• Chinese hacker used ARTEX AI suite and Claude agents to attack South Korean banks
• Report: ~1,000 of 1,280 AI-embedded third-party products operate outside SSO, invisible to identity controls
• Miri stored all environment variables in target/, leaking CI secrets via GitHub Actions caches

In this digest

• Working Exploit Published for Pre-Auth AnyDesk Linux Flaw That Grants Root Access
• Hackers hijack .gh, .sl, .as ccTLDs, obtain unauthorized HTTPS certificates for Google domains
• Rust-based Warden Stealer MaaS targets AI agent data from Claude, Codex, Grok and Cursor

In this digest

• Leaked chats claim Silent Ransom Group extorted $206.95M from 27 firms without encryption
• GoBalance Flaw Lets Attackers Recover Tor Keys and Hijack Dark-Web .onion Addresses
• Microsoft: outdated Windows devices will lose Windows Update access after 2027 certificate rotation

In this digest

• FBI seizes domains behind China-linked Microscan and FishHub hacking tools
• Microsoft Partner Center Certificate Validation Bypass Leads to Network Privilege Escalation

In this digest

• Ransomware attack on SoftBank subsidiary IDC Frontier disrupts IDCF Cloud for 495 customers
• Citrix NetScaler SAML memory overflow flaw (CVE-2026-107406) allows unauthenticated RCE
• DOJ and FBI seize seven domains behind Flax Typhoon hacking tools MicroScan and FishHub

In this digest

• CISA adds ProFTPD mod_copy flaw CVE-2015-3306 to KEV catalog
• CISA adds exploited ISC BIND flaw CVE-2015-5477 to KEV catalog amid China-linked hacking advisory
• Apache Struts CVE-2016-3081 added to CISA KEV amid China-linked exploitation