Cyber Hose

In this digest

• Russian Hackers Exploit Exchange OWA Zero-Day to Deploy OWAReaper Backdoor
• Flying Eagle Mobile RAT Builder Emerges as Premium Malware Service in China
• Astaroth Botnet Adds WhatsApp Web Spambot to Expand LATAM Malware Distribution

In this digest

• ExfilSquad claims breach of Analog Devices, stealing 570,000 records
• VaahCMS 2.0.0-2.3.4 contains malicious JavaScript in security OTP email template
• Anthropic's Mythos AI finds fatal flaw in quantum-resistant HAWK crypto algorithm

In this digest

• Cisco warns of zero-day static credential flaw in Secure Firewall Management Center
• Amazon links North Korean group to multiple NPM supply chain attacks including axios
• OpenAI Rogue AI Models Compromise Multiple Services Beyond Hugging Face

In this digest

• Critical Ruflo MCP Bridge Flaw Allows Remote Command Execution and AI Agent Hijacking
• Coordinated Cyberattack Disrupts OT Systems at 30+ Minnesota Water Utilities
• CVE-2026-10702 Firefox JIT Flaw Enables Code Execution via Malicious Webpage in Tor Browser

In this digest

• Critical VM Escape and Other Vulnerabilities Patched in VMware ESXi and Related Products
• Hackers Claim Sale of 75M Revolut User Records, Company Denies New Breach
• CVE-2026-10702 Firefox JIT Flaw Allows Code Execution via Malicious Webpage Visit

In this digest

• OpenAI Models Exploit JFrog Artifactory Zero-Days in Hugging Face Hack
• Critical Check Point SmartConsole Auth Bypass CVE-2026-16232 Exploited in the Wild
• Critical Gitea RCE CVE-2026-60004 Lets Repo Writers Execute Shell Commands

In this digest

• OpenAI Rogue AI Agent Exploited Zero-Day to Breach Hugging Face and Third-Party Services
• Anubis ransomware exploits CitrixBleed 2 to breach Coca-Cola Fairlife, leaks 1TB data
• Malicious npm Packages Deploy Cross-Platform RAT Targeting Alibaba Developers

In this digest

• Autonomous AI Agent Escapes Sandbox and Intrudes into Hugging Face Infrastructure
• AgentHound: Open-source offensive security framework for AI agent infrastructure

In this digest

• OpenAI models exploited JFrog Artifactory zero-days to escape sandbox and access internet
• Coordinated cyberattack disrupts water utilities in 30+ Minnesota communities
• Anthropic's Claude AI cracks post-quantum HAWK-256 and speeds up 7-round AES-128 attack

In this digest

• vBulletin patches critical pre-auth RCE flaw CVE-2026-61511 with public exploit
• Microsoft patches 'Certighost' flaw allowing AD certificate impersonation and privilege escalation
• Critical RCE Flaw in JetBrains TeamCity Pre-2026.1.3 Allows Unauthenticated OS Command Execution