Cyber Hose

In this digest

• DebugBear hit by supply chain attack: served script replaced to steal crypto assets
• Chained PHP2Shell and kernel LPE exploits root 25 PAN-OS firewalls, including US government systems

In this digest

• Binance probes suspected hack draining up to $5.8 billion from hot wallets
• Hugging Face crypto-mining campaign returns, hijacking GPU servers via malicious models
• Polymarket halts trading after vendor compromise injects crypto-draining script; $2.5M traced

In this digest

• UNM Health Sciences ransomware attack disrupts patient care; Byod gang claims breach of 36,000 systems
• Microsoft: North Korean threat actors are operationalizing AI across their tradecraft
• Rust zip crate flaws (RUSTSEC-2026-0367, CVE-2026-115905) enable privilege escalation and RCE

In this digest

• INJ3CTOR3 Malware Now Steals SIP Trunk Credentials From FreePBX Servers for Phone Fraud
• 42M records with PII exposed in CitySourced GovTech platform database
• Hackers Claim Wagyu Crypto Swap Platform Breach; Leak Links Monero Transactions to IPs

In this digest

• Cisco SD-WAN zero-day exploited to plant KeyDrift malware linked to Volt Typhoon's Silent Train network
• Cisco patches second exploited ASA/FTD VPN zero-day used for DoS attacks
• 319 Chrome extensions hijacked searches of 13.4 million users via search provider override

In this digest

• Chained PHP2Shell and Linux kernel exploits root 25 servers, including US government systems
• WatchGuard discloses 7 critical Fireware OS flaws enabling RCE and root-level attacks
• CISA Adds Exploited VMware ESX Logging Flaw CVE-2026-41709 to KEV Catalog

In this digest

• Talos: UAT-11473 APT exploited CVE-2026-20127 to deploy KeyDrift malware on Cisco SD-WAN controllers
• XML Signature Wrapping auth bypass in Moldova's MPass SAML library, fixed in 10.0.4

In this digest

• Leak of DHS Okta data exposes 41,000 employees, including undercover ICE agents
• Fragnesia (CVE-2026-46300): Linux kernel ESP-in-TCP flaw grants root, added to CISA KEV
• GhostAction returns: compromised GitHub accounts push credential-stealing workflows across 30,000+ repos

In this digest

• Volt Typhoon used covert 'Silent Train' network of rotating compromised devices in four zero-day campaigns
• DEVCORE's Orange Tsai publishes logic-only Microsoft Edge sandbox escape that won $175,000 at Pwn2Own
• Researcher claims 0-click Telegram sticker bugs chained to code execution on iOS

In this digest

• 68 GB of Philippine DMW/POEA database backups stolen via exposed staging server
• Skyw4lker Device Code Phishing Campaign Targets U.S. Manufacturing, Tech, and Healthcare Firms
• CVE-2026-105420 — Wing FTP Server Path Traversal leading to Remote Code Execution