Cyber Hose

In this digest

• FortiBleed campaign against Fortinet firewalls and VPNs remains active
• Linux backdoors mimic Korean and Taiwanese email security tools to evade detection
• Dell System Update Path Traversal Leads to Unauthenticated Remote Root

In this digest

• Hackers exploit 32 zero-days for $388,500 on day one of Pwn2Own Ireland 2026
• GitHub Copilot CLI can be tricked via encrypted 'Cryptographic Context Injection' pages into exfiltrating local secrets
• Apache Struts fixes four flaws enabling RCE, DoS and data disclosure in 7.4.0 and 6.12.0

In this digest

• Wikimedia: Rogue OpenAI agents made unauthorized wiki edits and heavy scraping traffic
• Japan arrests Qilin ransomware core member, extradites Russian national to Germany
• LibreOffice, OpenOffice spreadsheets run remote Java code without macro warning

In this digest

• Active WordPress XSS campaign exploits WPC Product Bundles and Ninja Forms to hide admin accounts
• Nikkei discloses breaches of employee Microsoft 365 and Google Workspace email accounts
• Hackers hijack Asos app push notifications to claim Snowflake breach, threaten leak

In this digest

• FBI removes Accenture contractor after unpatched PeopleSoft flaw enabled ShinyHunters breach
• Atlassian patches CVE-2026-21589 (CVSS 9.3): unauthenticated file read in 8 Data Center products
• Sitemovr WordPress plugin <= 1.0.1 exposes sensitive data to unauthenticated attackers (CVE-2026-41563)

In this digest

• Twenty CRM GraphQL Flaw Exposes Plaintext External Service Credentials
• Sssd access control bypass via premature ldap access rule evaluation
• Sssd denial of service via crafted passkey kerberos authentication request

In this digest

• Citrix discloses third exploited NetScaler zero-day, CVE-2026-88779, in SAML deployments

In this digest

• SelectorsHub Chrome extension (~400k users) opens server-picked ad tabs without user action
• Langflow OS Command Injection Enables Unauthenticated Remote Code Execution
• Langflow Critical RCE: Authenticated Command Injection via Stdio Transport

In this digest

• CVE-2026-105691 — Penpot: Authenticated OS Command Injection in SVG Exporter
• CVE-2026-105639 — Plane: Unauthenticated Workspace Takeover
• CVE-2026-105638 — Plane: OTP Brute-Force Enables Unauthenticated Account Takeover

In this digest

• CVE-2026-105218 — go-pay gopay — CVSS 9.1
• CVE-2026-105216 — micro go-micro — CVSS 9.1
• CVE-2026-102282 — cthackers adm-zip — CVSS 7.1