Cyber Hose

In this digest

• Lazarus Exploited Windows AFD.sys Zero-Day to Deploy ForestTiger
• Malicious LiteLLM PyPI Releases Potentially Exposed 2,500 Organizations
• ShieldBreak PoC Claims to Bypass Microsoft Defender Fix for SYSTEM Access

In this digest

• Microsoft SharePoint Server Vulnerability Allows Attackers to Inject and Execute Malicious Code Remotely
• Path Traversal and HTTP Parameter Pollution in Snowflake Python API
• Velociraptor collect_client() Permissions Bypass

In this digest

• Microsoft Outlook Vulnerability Allows Attackers to Execute Malicious Code Remotely
• Critical RHACM flaw enables GitOpsCluster controller token redirection
• Study Maps How LLM Prompt Injection Reaches Classic Web Vulnerabilities

In this digest

• CVE-2026-72526 — CVSS 9.9 — Multicloud-integrations pull-model propagation flaw
• CVE-2026-70398 — CVSS 9.6 — Multicloud-integrations gitopscluster flaw
• CVE-2026-6484 — CVSS 8.2 — Lack of verified boot causing arbitrary code execution

In this digest

• Zoom patches Zoomsday zero-click flaw enabling remote code execution
• DeadLock ransomware uses Polygon blockchain to resist infrastructure takedowns
• Gunra Ransomware Exploits Fortinet VPN Flaws to Bypass MFA

In this digest

• Cisco ASA and FTD VPN flaw exploited to crash firewalls
• Metabase CVE-2026-72898 SQL injection exploited in zero-day attacks
• Zoom annotation flaws enabled zero-click device hijacking during calls

In this digest

• Zoom Patches Zero-Click RCE in Annotation Protocol
• CopyEscape Docker Flaw Enables Container-to-Host File Writes and Root Code Execution
• Cross-model replay exposed hidden reasoning in OpenAI, Anthropic and Google APIs

In this digest

• 23 Copeland XWEB Pro flaws could give attackers root control of refrigeration systems
• Malicious SIMs can hijack phones and cellular IoT devices via modem commands
• SAP Patches Critical Code-Injection and Memory-Corruption Flaws

In this digest

• CISA says ransomware gangs are exploiting a Microsoft SharePoint RCE flaw
• Suspected Iranian Campaign Hits Water Utilities Across 12 U.S. States
• ErrTraffic Uses Polygon Smart Contracts to Hide ClickFix Malware Infrastructure

In this digest

• LiteLLM PyPI compromise exposed 2,500 companies and 434,000 pipelines
• Kimwolf v7 Botnet Targets Android IoT Devices With Advanced DDoS Capabilities
• AISI finds AI agents took 19 unsanctioned actions during cyber tests