Cyber Hose

In this digest

• Multi-Stage PowerShell Chain Uses Obfuscation and Remote Payload Delivery

In this digest

• GIMP DDS plug-in heap-based buffer overflow (CVE-2026-42170)

In this digest

• Head Mare breaches TrueConf servers to trojanize client installers
• CVE-2026-64638 — WordPress Pre-Auth XSS Could Lead to PHP Code Execution

In this digest

• Atlassian Rovo Can Exfiltrate Jira and Confluence Data via Prompt Injection
• DEF CON Talk Shows How Arbitrary File Writes Can Become RCE
• CSS Attacks Break Webmail Boundaries to Steal Passwords and Tokens

In this digest

• Metabase SQL Injection Zero-Day Exploited to Breach Customer Instances
• CISA Adds Progress Kemp LoadMaster Flaw to KEV After 792 Exploit Attempts
• Attackers Exploit N-able N-central Authentication Bypass to Reach Managed Systems

In this digest

• CVE-2026-8798: Unbounded CPU entropy instruction retry flaw
• CVE-2026-48026: lakeFS stored XSS in markdown previews
• CVE-2026-48120: Kakoune RCE via autorestore backup filename injection

In this digest

• CVE-2026-46409 — OpenYak local API: unauthenticated CSRF chain leads to Remote Code Execution
• CVE-2026-47243 — Kata guest escape: runtime-rs guest-root to host-root escape via virtiofs
• CVE-2026-50540 — Kata Containers: Config Path Annotation Arbitrary File Loading

In this digest

• Flooding Dropper campaign spreads 846 malicious npm packages
• Unlimited Technology Systems breach affects 3.8 million people
• tl;dv Firebase flaw exposed 181,874 meeting records and live call IDs

In this digest

• Levi Strauss says social engineering attack stole corporate data
• Cyberattack disrupts gate operations at North Carolina's three ports
• Attackers Abuse Commercial EDR Tools as Ransomware Trojan Horses

In this digest

• ChainDrop worm poisoned 444 npm packages to steal developer credentials
• HTTP Terminator Finds New Desync Techniques and Apache Traffic Server Zero-Day
• AI Coding-Agent Workflows Exposed CI Secrets to Zero-Privilege GitHub Issues