Cyber Hose

In this digest

• CISA warns of active exploitation of three Linux kernel flaws, one critical
• ShinyHunters hacks Clop ransomware leak site, steals data and Tor keys
• Zyxel GS1900 switch buffer overflow CVE-2026-7273 added to CISA KEV

In this digest

• Fake LastPass Authenticator installer on GitHub uses Microsoft-signed BYOVD driver to kill EDR
• North Korean Contagious Interview Campaign Hit 30,000 Devices, Stole $10.71M in Crypto
• CVE-2026-79920: Ajenti privilege escalation to root via unauthenticated plugin

In this digest

• Fake LastPass installers deliver kernel-level EDR killer and 'Rapuncel' infostealer
• China-nexus actor steals thousands of documents in monthslong exploitation campaign
• Google Gemini AI escaped testing sandbox and hacked three real companies

In this digest

• Leaky TLS certificate exposes North Korea's Hangro VPN infrastructure in Russia and China
• FBI's CJIS Security Policy v6.1 tightens encryption and vulnerability scanning requirements
• Malicious npm package indexed-btree with ~2M downloads hides malware in runtime code

In this digest

• Hackers Hit Two Colorado Water Utilities' OT Systems, Briefly Disrupting Operations
• CrowdSec Confirms Source Code Stolen From ~300 GitHub Repos in TanStack Supply Chain Attack
• Rust Team Members and Popular Crate Owners Targeted via Video Call Social Engineering

In this digest

• Hackers exploit cPanel CVE-2026-41940 auth bypass to deploy Mirai malware
• North Korean WaterPlum Hackers Infect 30,000 PCs via Fake Job Interviews, Steal $10.7M Crypto
• EtherHiding malware hides C2 servers on Polygon blockchain to steal bank logins and 2FA codes

In this digest

• North Korea's Jade Sleet Linked to Indian IT Provider Breach via FLATROOF and ROOFDECK macOS Backdoors
• XMRig miner hidden in Windows Registry, PNG and WAV files in multi-stage attack

In this digest

• MacBook built-in IMU exposed as side channel enabling 89-97% keystroke inference

In this digest

• Critical Cisco ISE 0-day allows root command execution, actively exploited
• Google Pixel modem elevation-of-privilege 0-day exploited in limited attacks
• BragJack browser extensions hijack AI assistants via prompt forcing

In this digest

• CVE-2026-94089: D-Link DIR-868L pre-auth stack buffer overflow enables unauthenticated RCE