Cyber Hose

In this digest

• Microsoft and Apple Patch Critical and High-Severity Security Flaws
• Enterprise Java flaws enable pre-auth RCE in Bonita BPM and Apache OFBiz
• UNC6671 Hijacks Microsoft 365 Sessions for Automated Data Theft

In this digest

• N-central Zero-Day Let Attackers Control Servers and Managed Devices
• SMOKE#SCREEN campaign uses fake updates to deploy ScreenConnect RMM
• CVE-2026-56162 — Azure SQL Database Elevation of Privilege

In this digest

• More Than 4,400 Rockwell PLCs Exposed Online, Including 22 in Attack-Hit Cities
• UNC6671 vishing attacks target hedge funds and private-equity firms
• Zbtlink routers ship with an embedded backdoor enabling remote root shells

In this digest

• Alinto SOGo 5.12.7 hit by actively exploited ICS invitation XSS
• Swiss FOITT SharePoint breach compromised about 200 accounts
• TONTOU Attack Bypasses Spectre v2 Defenses and Leaks Linux Password Hashes

In this digest

• Flaws in Major AI Coding Agents Enable RCE and Supply-Chain Attacks
• Interrupt Injection Bypasses Spectre v2 Defenses on Intel and AMD CPUs
• Attackers Can Abuse WSUS to Deliver Malware to Enterprise Endpoints

In this digest

• Cyberattack Disrupts Operations at All Three North Carolina Ports
• 4,407 Rockwell PLCs Exposed Online, Including 22 in Water-Attack Cities
• Zenity Finds Zero-Click Hijacking Flaws in Claude and ChatGPT Atlas

In this digest

• CryptoJS Weak RNG Linked to $5.7 Million Drained From Five Wallet Apps
• Remus Stealer Hides C2 in Ethereum While Draining Browser Vaults
• Canadian Man Pleads Guilty in Cloud Storage Hacking and Extortion Case

In this digest

• Meta AI Models Hacked External Systems During Security Testing
• AWS, Google, and Vercel Agent Flaws Bypass Model Checks to Trigger Tools
• Attackers Hijack AI API Keys to Power Gray-Market Transfer Stations

In this digest

• Zbtlink Routers Ship With ENDLESSDOORS Backdoor Enabling Root Shells
• Meta AI Model Accessed Internet and Exploited an Organization's Vulnerability
• Ransom Cartel Creator Sentenced to 16 Years for Ransomware Operation

In this digest

• Snowflake Hacker Pleads Guilty Over Breaches Affecting 100 Million People
• Keyv npm Compromise Spreads Mini Shai-Hulud to 444 Packages