Cyber Hose

In this digest

• CISA adds two actively exploited Check Point flaws (CVE-2026-85102, CVE-2026-93616) to KEV catalog
• GitLab patches two critical CI/CD regex flaws (CVSS 9.9) enabling code execution
• HPE patches critical ALE flaws enabling bypass of security controls and system takeover

In this digest

• CSRF flaw in Elementor 4.3.0/4.3.1 lets attackers escalate privileges on 10M+ sites
• 'SalesBleed' Flaws in Salesforce Agentforce Enabled Zero-Click Data Exfiltration
• Bitget says hackers stole $351.6 million from its hot and warm wallets

In this digest

• Crypto casino Duelbits confirms ~$7M hot-wallet hack, takes platform offline
• Russia's Hybrid Cyber-Physical War in Europe Heats Up, Recorded Future Warns
• Cloudflare Fixes Containers Flaw That Exposed Other Customers' Leftover Disk Data

In this digest

• Bitget Hot Wallet Breached: Attackers Stole $351.6 Million From Hot Wallets
• Hackers Exploit Payy Network's Ethereum Bridge Contract, Draining Its Full Balance
• Major vulnerability found in ancient TACACS+ networking protocol

In this digest

• macOS CDC-ACM serial interface bypasses TCC, exfiltrating secrets in 24 seconds
• Cloudflare Patches Cross-Tenant Data Leak in Containers Storage Layer
• CVE-2026-53493 containerd image-pull DoS via crafted OCI index graph amplification

In this digest

• Bipartisan bills would direct CISA to boost cyber defenses for biotech and biological data
• CVE-2026-61741 — Critical XXE in http4s-scala-xml Allows File Disclosure and SSRF

In this digest

• WSO2 path traversal flaw CVE-2026-5430 added to CISA KEV catalog
• Canva breached via vendor Canny's Salesforce instance by new group 'The Seven Deadly Sins'
• 'Salesbleed' Flaws in Salesforce Agentforce Enable Slack Phishing Attacks

In this digest

• Microsoft tracks Storm-2570 ransomware affiliate's consistent tradecraft across Qilin, DragonForce, Anubis, BERT
• Exposed GitLab project email addresses let attackers push code and open merge requests
• CVE-2026-13016 — ServiceNow AI Platform — CVSS 9.3 — Unauthenticated SQL Injection

In this digest

• FBI Investigates ShinyHunters Claim of Data Theft on 38,000 Staff
• Hackers Breach Third Cargo Ship; LNG Tanker Diverts to Spain
• DOJ Arrests Oxygen Forensics Leaders for Concealing Russian Ownership

In this digest

• Four crypto projects breached in September: Nostra, Neutron, Astroport/Drop, Duelbits lose millions
• CVE-2026-97360 HFS2 Unauthenticated Arbitrary File Access Leads to Full Host Compromise
• Konni-linked 'Operation Conflict Compass' uses fake PDF LNK lures to deploy VelvetCake downloader in Ukraine