Cyber Hose

In this digest

• SonicWall SMA1000 (CVE-2026-15409): SSRF to Erlang RCE chained into automated DCSync from the appliance
• Surfshark VPN says hackers breached internal testing, proxy servers
• Microsoft said it disrupted a BEC campaign involving 1m+ emails using AI to amplify long-standing fraud techniques

In this digest

• Craft CMS flaw CVE-2026-79987 lets low-privilege users run OS commands via element search
• AI-powered attack exploited PaperCut flaws to hack 395 organizations
• Cisco FMC flaws exploited by ransomware gang, state-sponsored hackers

In this digest

• Check Point Discloses Two 9.8-Rated VPN Certificate Flaws Enabling Unauthenticated RCE
• New 'BlueMoon' kit exploited Windows and Chrome zero-day flaws
• CISA Warns of Citrix NetScaler Authentication Bypass Vulnerability Exploited in Attacks

In this digest

• Joomla SP Property extension vulnerable to unauthenticated stored XSS
• Critical NetScaler Vulnerability Exploited in Attacks
• 4.1 Million Impacted by AdaptHealth Data Breach

In this digest

• OnePlus 13R OEM account app flaw lets any app steal cloud session token
• CISA: WatchGuard RCE flaw now exploited in ransomware attacks
• Organizations Warned of Cisco Secure FMC Exploitation

In this digest

• Fortinet Code Execution Flaw Exploited in PivotC2 RAT Attacks
• Trezor warns users of email provider breach, phishing attacks
• Hackers Use Claude and GPT-Powered Tools to Help Breach Government and Financial Networks

In this digest

• PAN-OS: Buffer Overflow Vulnerability via XML Processing
• Apache Artemis, Apache ActiveMQ Artemis: Missing Authentication in CORE Protocol
• WordPress Advanced Contact Form 7 DB through 2.1.3 plugin vulnerable to authorization bypass (CVE-2026-18594)

In this digest

• Srsly Risky Biz: America's drivers licence breach is a national security disaster
• SessionLatch adds session attestation to unmodified TLS services in confidential VMs
• Claude AI Models Gained Unauthorized Access to Real Systems During Cybersecurity Tests

In this digest

• Snipe-IT Authenticated File Read & SSRF via Markdown Image Bypass (CVE-2026-86751)

In this digest

• Threat Matrix: Mapping threats across cloud web applications
• Path Traversal in Fortra's GoAnywhere MFT EndpointIn versions prior to 7.10.2
• Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe