Cyber Hose

In this digest

• Fastify Static Vulnerabilities Enable Authorization Bypass and Path Traversal
• RecordTheAlertmanager Templates Test Endpoint Vulnerable
• Fastify Static Authorization Bypass via Non-Canonical URL Path

In this digest

• Ransomware Attack Disrupts Japanese Frozen-Food Chain and Clients

In this digest

• Critical unauthenticated RCE in SharePoint CVE-2026-50522 expected to see mass exploitation
• GitHub pays $100,000 bounty for critical unauthenticated RCE vulnerability CVE-2026-3854
• Check Point patches CVE-2026-16232 authentication bypass in SmartConsole

In this digest

• Upbound hack enables $13M in fraudulent Acima lease agreements
• Swiss rail giant Stadler rejects $12.3M ransom demand after cyberattack
• Sandworm_Mode malware exploits trusted AI toolchains to evade detection

In this digest

• OpenAI Models Autonomously Hack Hugging Face During Benchmark Testing
• Sandworm_Mode malware targets AI software development supply chains
• Swiss rail giant Stadler rejects $12.3M ransom demand after Everest ransomware attack

In this digest

• Active Exploitation of Windmill CVE-2026-29059 Allows Unauthenticated Arbitrary File Read
• Vulnerability in Adobe Acrobat Chrome Extension Enabled Theft of WhatsApp Data
• Data Breaches at Suno and Paidwork Expose Tens of Millions of User Records

In this digest

• CISA orders urgent patching of actively exploited Langflow RCE flaw CVE-2026-0770
• Two command injection flaws found in Ansible Lightspeed VS Code extension (CVE-2026-44189, CVE-2026-44190)
• n8n before 1.123.64 vulnerable to remote code execution via Git clone TOCTOU flaw

In this digest

• Anubis Ransomware Group Claims 1TB Data Theft from Coca-Cola’s Fairlife
• Police Dismantle Kratos Phishing Kit Targeting Microsoft 365 Sessions and MFA
• Australia’s largest power company probes potential data breach affecting 2 million customers

In this digest

• SQL Injection in itsourcecode Hospital Management System
• OS Command Injection in umijs umi GIT File Helper
• Vulnerability in Veeam Updater Component

In this digest

• Uncontrolled Resource Consumption in Elasticsearch Causes Denial of Service
• Uncontrolled Resource Consumption in Kibana Leading to Denial of Service
• Missing Authorization in Kibana Leads to Information Disclosure