Cyber Hose

In this digest

• Cisco FMC Software Vulnerable to Static Credential Flaw Exploited in the Wild
• Anthropic's Claude AI breached 3 orgs, uploaded malware to PyPI during tests

In this digest

• South Korea fines KT $39M for 11-month customer data breach via rogue femtocell

In this digest

• Critical Remote Code Execution Flaw Discovered in Azure Cosmos DB (CVE-2026-66803)
• CareCloud notifies 345,000+ after March breach exposed medical records
• Coordinated Cyberattacks Disrupt 30+ Minnesota Water Utilities' PLCs

In this digest

• Amazon Links North Korean Hackers to Multiple NPM Supply Chain Attacks
• DPRK-Linked macOS Malvertising Uses Fake Updates to Deliver Crypto-Stealing Malware
• Six critical vulnerabilities found in SGLang framework including unauthenticated RCE and data leaks

In this digest

• CISA Warns of Exploited Cisco Secure Firewall Management 0-Day CVE-2026-20316
• ShinyHunters claims breach of Brinks Home, threatens to leak 4.9M records
• IBM Langflow OSS 1.0.0-1.10.1 vulnerable to unauthenticated RCE via MCP stdio launcher CVE-2026-12940

In this digest

• Critical CosmosEscape Flaw in Azure Cosmos DB Allowed Cross-Tenant Key Access
• Chaos ransomware deployed via Microsoft Teams vishing attacks on North American firms
• Home Assistant FFmpeg Flaw Allows File Theft and Root Command Execution

In this digest

• State-Sponsored Hackers Exploit AnySign4PC in South Korea to Deploy Backdoors
• SilverFox Uses 3-Driver BYOVD Chain to Deploy ValleyRAT on Japanese Manufacturer
• Chinese-Speaking Threat Actor Uses Autonomous AI for Multi-Vulnerability Cyberattacks

In this digest

• Critical Ruflo Vulnerability Allows Unauthenticated Remote Code Execution in AI Agent Platform
• Russian Hackers Exploit Microsoft OWA XSS Flaw to Maintain Mailbox Access
• STAC4749 Ransomware Campaign Uses Microsoft Teams Calls to Deploy Chaos Ransomware

In this digest

• TA488 Exploited Outlook Web Access 0-Day XSS Flaw to Compromise Mailboxes
• UK Department for Education hacked, 607K records of officials leaked in 2026 breach
• OS Command Injection Vulnerability Found in OCPP Agent Before Version 1.9.1

In this digest

• Critical Ruby on Rails Active Storage Flaw Allows Arbitrary File Read and RCE