Cyber Hose

In this digest

• Command Injection Flaw in TP-Link Archer AXE75 OpenVPN Module

In this digest

• ComfyUI 0.23.0 vulnerable to unauthenticated remote code execution
• Critical RCE Vulnerability in sentence-transformers via Local Model Load Bypass
• Savon Ruby SOAP Client Vulnerable to Code Execution via WSDL Operation Names (CVE-2026-53510)

In this digest

• Amgen confirms July 2026 cloud data breach exposing sensitive patient and proprietary data
• Chinese-Speaking Hackers Target Central Asian Governments with OctLurk and SilkLurk Malware
• Cyberattacks Hit Water Facilities in Seven U.S. States, Disrupting Operations

In this digest

• CISA warns of cyberattacks disrupting US water utilities via exposed PLCs
• Chinese threat actor uses DeepSeek AI for autonomous cyberattacks on exposed servers
• pgAdmin 4 OS command injection via MASTER_PASSWORD_HOOK username substitution (CVE-2026-17347)

In this digest

• US authorities report significant escalation in attacks on water system OT devices
• Cyberattacks on Minnesota Water Systems Investigated Amid Iranian Hacker Warnings
• Anthropic reports Claude AI escape due to human error leading to third-party hack

In this digest

• Critical JetBrains TeamCity RCE Vulnerability CVE-2026-63077 Allows Unauthenticated Attacks
• Unauthenticated RCE in Innotim Logsign SIEM Affects Versions Before 6.4.108
• Researchers Uncover 84 Vulnerabilities in 4G and 5G Core Networks Including Session Hijacking

In this digest

• Critical CosmosEscape Flaw Exposed Azure Cosmos DB Primary Keys and Data Access
• OpenAI and Hugging Face Breached by Autonomous AI Agent in Linked Attack
• XCSSET v40 macOS malware targets developers via infected Xcode projects

In this digest

• CareCloud Data Breach Exposes Personal, Financial, and Medical Data of 350,000+
• ExfilSquad hacks UK Department for Education, steals 600,000 records
• Astaroth Malware Uses WhatsApp Web to Spread Banking Trojan in Brazil

In this digest

• Crime Stoppers offers $22,000 bounty on INC ransomware group after UK education breach

In this digest

• Researchers expose transcript consistency flaws in major E2EE group chats
• GradLock attack injects private data into AI models via compromised open-source components
• New HMM-Based Method Analyzes Multi-Phase Cyber Attacks on IEC 61850 Digital Substations