Cyber Hose

In this digest

• XBOW Built a $250,000 Chrome Full-Chain Exploit With GPT-5.6 AI Agents in Six Days
• Coruna and DarkSword iOS exploit kits can fully compromise iPhones via a single web visit
• Chrome, Firefox Updates Patch 114 Flaws as Mozilla Unveils Firefox Enterprise

In this digest

• FBI disrupts FAMOUS CHOLLIMA laptop farms used by North Korean IT workers, with CrowdStrike help
• Doyensec Researchers Escape Windows VBS Enclave Isolation via Four-Byte Write and Timing Bug (CVE-2026-83498)
• Google Search malvertising pushes trojanized PuTTY installer with EtherHiding C2

In this digest

• Microsoft patches actively exploited Windows Shell zero-day CVE-2026-96951 bypassing Mark of the Web
• Ledger confirms spy chip implant in wallets sold via reseller CryptoBilis behind crypto thefts
• Collabora Online built-in CODE Server RCE flaw CVE-2026-110447 exploited in the wild

In this digest

• OpenAI engineer arrested after hidden recording device found in executive conference room
• DOJ charges 14 in North Korean remote IT worker scheme, seizes 187 computers
• Hardware hacker found implants in Trezor wallets despite company's 'no compromise' claim

In this digest

• Danfoss refrigeration hack: 4,980 hosts exposed, over half in France
• Meta: Hackers Stole Code and Personal Data of 1,500 People in GitHub Breach
• Adobe Patches 140 Vulnerabilities Across 10 Products Including ColdFusion, Photoshop and Commerce

In this digest

• Ivanti Connect Secure auth bypass vulnerability CVE-2026-104935 added to CISA KEV catalog
• Hackers force French supermarket fridges to 50C in 'unprecedented' cyber-attack
• GitLab patches max-severity CVE-2026-97229 RCE flaw in CI/CD regex compiler

In this digest

• Low-cost Android phones ship with firmware malware turning devices into residential proxies
• ESET names Gorbag, a new Russia-aligned espionage group targeting Ukrainian entities
• CVE-2026-109758 — Perforce Helix Authentication Service — CVSS 9.3

In this digest

• CVE-2026-87689 — Rapid7 Metasploit Framework — CVSS 9.8 — Unauthenticated Credential Exposure in Metasploit Framework Web Service API
• LG webOS Flaws Let Remote Attackers Execute Commands as Root Without Authentication

In this digest

• Max-severity SSRF flaw CVE-2026-102255 in SonicWall SMA1000 appliances now exploited in attacks
• Norway fines Microsoft's Xandr $9.6M for unlawfully sharing Grindr user data
• Flock authorized by CISA as CVE Numbering Authority for its own surveillance products

In this digest

• Suspected state-linked actors mass-exploit Citrix NetScaler zero-days CVE-2026-88771 and CVE-2026-88772
• Hackers defrost fridges at hundreds of French supermarkets via vulnerable Danfoss controllers
• Security researcher urges organizations to upgrade Ivanti Connect Secure appliances