Good Morning, Security Gang!
Double espresso. This week was the fullest briefing of the year, and every episode carried the same underlying message: the vulnerability-management model built around fixed SLAs is breaking under the weight of current attacker tempo.
Consider the week’s timeline: SAP Commerce Cloud received a CVSS 10.0 patch on August 12, honeypots detected exploitation attempts three days later with no public proof-of-concept available. MLflow was being scanned within hours of receiving its CVE assignment. A Windows vulnerability Microsoft patched in November 2025 is now confirmed in active ransomware campaigns, nine months later, enough unpatched systems remain to make it profitable. Oracle dropped 943 security patches in a single update, with approximately 460 remotely exploitable without authentication and nearly 90 carrying CVSS scores of 9.8 or higher. And CISA added four maximum-severity vulnerabilities to the KEV catalog in a single day — all with available patches, all with confirmed exploitation.
Meanwhile, GeoServer disclosed an SQL injection vulnerability with no patch available and researchers began detecting probing within hours. Dark-web seller TheHatMan is auctioning employee directory data from Azure and Entra environments at nine major enterprises including McDonald’s (1.7 million records), TCS (800K), and Vodafone (425K). Microsoft Power Pages misconfiguration exposed data from the City of Atlanta (3M records), Allstate (657K), UK Department for Education (600K), Frontier Airlines (2.4M), and Microsoft itself (8M records, 130GB). And Cl0p named more than 40 organizations compromised through PTC Windchill and FlexPLM — turning one enterprise vulnerability into dozens of simultaneous extortion campaigns.
The week’s most memorable operational insight came from T-Mobile’s Salt Typhoon response: a security team detected suspicious activity and physically cut the network cable of the compromised system. No ticket. No six approvals. Just containment.
James’s take: “Containment doesn’t earn extra points for sophistication. The objective is stopping the attacker.”
Let’s get into it.
🚨 Four CISA KEVs in One Day: Priority Stack for Monday Morning
VMware vCenter CVE-2026-59310 CVSS 9.8: China-Linked APT, Persistence, and Ransomware Confirmed
The top priority this week. A China-linked APT is exploiting vCenter to establish persistent access, deploy reverse-shell tooling, and in at least one case, deploy BABAC-derived ransomware. Researchers have identified 361 compromised victim IP addresses across 47 countries Germany, the United States, Turkey, Iran, and France most heavily affected. This has crossed from vulnerability management into incident response. Patch vCenter immediately. Remove management interfaces from internet exposure. Require VPN and MFA for administrative access. Then hunt look for persistent backdoors, reverse-shell binaries, unusual outbound connectivity, unauthorized administrative activity, and ransomware indicators. A patch fixes the vulnerability. It does not remove the attacker who arrived yesterday.
Microsoft SharePoint CVE-2026-55040 CVSS 9.1: Public PoC to Active Exploitation
Public proof-of-concept code became available and attackers began exploiting the SharePoint weak-authentication bypass shortly afterward. This is SharePoint’s fifth or sixth exploitation event this summer organizations running on-premises SharePoint should be treating the platform as a sustained high-priority attack surface, not a periodic patching task. Confirm both July and August updates are deployed. Monitor authentication logs and anomalous access attempts against internet-facing front ends.
macOS Screen Sharing CVE-2026-65400: Cryptocurrency Miners Confirmed
Attackers exploiting the macOS Screen Sharing authentication bypass are accessing exposed Macs without valid credentials and installing Monero cryptocurrency miners. Approximately 40,000 internet-accessible Macs still have Screen Sharing enabled. Patch to Apple’s August 6 releases. Where patching is not immediate, disable Screen Sharing or block TCP/5900. Scan your external attack surface for Macs exposing that service directly to the internet.
Windows IKE CVE-2026-33824 CVSS 9.8: AI-Enabled Autonomous Hacking Campaign
Chinese-speaking threat actors are exploiting the Windows Internet Key Exchange double-free vulnerability including in at least one campaign described as an AI-enabled autonomous hacking operation built around DeepSeek alongside manual attacker activity. Prioritize this update across Windows environments and assess exposure of IKE services.
🌐 Critical Vulnerabilities & Active Exploitation
“Sometimes the fastest containment move is the simplest one — not the most sophisticated one.”
SAP Commerce Cloud CVE-2026-58231 CVSS 10.0: Exploited Within 72 Hours, No Public PoC
SAP released a fix for a maximum-severity unauthenticated RCE in Commerce Cloud on August 12. Three days later, honeypot sensors detected exploitation attempts apparently through patch-diffing without any publicly available proof-of-concept. Mass scanning was traced to hosting infrastructure in the United States. Current activity appears to be automated scanning rather than confirmed successful compromise, but the timeline itself is the signal: 72 hours from patch to probing, no PoC required. Emergency-patch all affected SAP Commerce Cloud instances. Review web server and WAF telemetry for suspicious POST requests against administrative services. If immediate patching is not possible, restrict access aggressively and consider whether this is the vulnerability your change-control emergency lane was built for.
GeoServer SQL Injection: Active Probing Begins Within Hours, No Patch Available
Researchers publicly disclosed an SQL injection vulnerability in GeoServer’s JSON array filtering functionality and attack-surface researchers detected probing within hours of disclosure, eventually observing hundreds of attempts from a small number of source addresses. There is currently no vendor patch. GeoServer has a history of vulnerabilities moving rapidly to real-world exploitation with previous flaws already in CISA’s KEV catalog. When there is no patch, architecture becomes the patch. Inventory every GeoServer deployment. Remove internet accessibility wherever the business permits. Evaluate which data stores and functionality are exposed. Increase monitoring around affected services. Prepare an expedited deployment plan for the vendor fix as soon as it becomes available.
MLflow CVE-2026-64849 CVSS 9.3: Cloud Credentials Targeted Within Hours of CVE Assignment
An unauthenticated SSRF vulnerability in MLflow is already under active exploitation with indiscriminate scanning for exposed servers beginning within hours of the CVE assignment on August 17 and attackers attempting to retrieve credentials from known cloud metadata addresses. The attack also demonstrates incomplete remediation risk: it can bypass an earlier fix because of how MLflow handles web redirects. Upgrade to MLflow 3.15.0 or later immediately. Then treat this as a credential-exposure event examine logs for unexpected requests to internal metadata endpoints, rotate cloud credentials, API keys, and secrets reachable from the tracking server.
Cisco ASA and FTD: Active Exploitation, No Workaround
Cisco confirmed active exploitation of a DoS vulnerability in Secure Firewall ASA and FTD unauthenticated attacker sends a specially crafted request to an SSL listening socket causing the appliance to reload. No workaround. Deploy hotfixes immediately and review reload events for anomalous patterns.
NetScaler CVE-2026-19490 CVSS 9.3: Authentication Bypass on VPN/AAA Virtual Servers
Cloud Software Group released fixes for a NetScaler authentication bypass allowing remote attackers to bypass authentication without valid credentials on Gateway or AAA virtual-server configurations. NetScaler sits directly on the enterprise edge an authentication bypass here doesn’t simply compromise an appliance, it provides a path toward internal resources. No active exploitation confirmed at time of publication. NetScaler has a long history of high-value vulnerabilities being aggressively exploited once technical details become available. Patch now, check SAML and AAA configurations, and determine exactly which appliances were exposed.
Windows CVE-2025-60710: Nine-Month-Old Task Host Vulnerability Now in Ransomware Campaigns
CISA confirmed ransomware operators are exploiting this Windows Task Host link-following vulnerability patched by Microsoft in November 2025 to escalate from basic permissions to SYSTEM on Windows 11 and Windows Server 2025. The nine-month gap between patch release and current ransomware usage illustrates that attackers don’t care how old a vulnerability is if enough unpatched systems remain. Prioritize systems missing the November 2025 security update.
Medusa Ransomware: 500+ Organizations, Sub-24-Hour Vulnerability Weaponization
CISA, FBI, and HHS updated their joint Medusa advisory confirming 500+ compromised organizations across critical infrastructure, education, legal, insurance, manufacturing, and technology. Medusa affiliates can weaponize newly disclosed vulnerabilities in less than 24 hours sometimes before defenders have patches available. Entry points: stolen credentials from initial-access brokers, or known vulnerabilities in ScreenConnect, FortiClient EMS, GoAnywhere MFT, and BeyondTrust. Post-compromise methodology: legitimate Windows tools (PowerShell, CMD, WMI) for stealth, vulnerable kernel drivers to disable EDR, Rclone for exfiltration, then encryption. Ransom demands reach $15 million; average payments around $260,000. Cross-reference the Medusa advisory against your ScreenConnect, FortiClient EMS, GoAnywhere, and BeyondTrust deployments and verify remediation status immediately.
macOS Second Screen Sharing Vulnerability: Unauthenticated RCE as Root
Apple separately addressed a more serious Screen Sharing daemon vulnerability in late July — reportedly allowing unauthenticated remote code execution as root without user interaction. Ensure Apple’s late-July and August 6 updates are both deployed across managed Mac fleets.
Adobe Commerce, Campaign Classic, and SAP August Patches
Adobe patched seven vulnerabilities in Commerce and Magento with researchers already detecting active probing against one capable of hijacking customer accounts without credentials. Campaign Classic received three critical Priority 1 updates. SAP’s August release included a perfect-severity authorization bypass in Commerce Cloud Data Hub Adapter and an unauthenticated memory corruption in NetWeaver ABAP. Adobe and SAP environments should not wait for monthly maintenance windows given the exploitation patterns this year.
🏭 OT and Critical Infrastructure
Federal Advisory: AI-Assisted Tools Used Against Siemens S7 PLCs Across Critical Infrastructure
NSA, CISA, FBI, DOE, and EPA issued a joint advisory warning of an active campaign targeting Siemens S7-200 through S7-1500 PLCs across critical manufacturing, energy, water/wastewater, chemical production, food/agriculture, commercial facilities, and defense industrial base. Attackers use internet-scanning services to identify exposed PLCs, exploit known vulnerabilities and weak authentication, and are using artificial intelligence to generate custom Python exploitation scripts disguised as legitimate OT monitoring software — scripts capable of interacting directly with PLC memory, configuration data, and ladder-logic programs. Federal agencies characterize the activity as persistent reconnaissance, not yet confirmed destructive operations. Inventory Siemens S7 PLCs, remove any that are externally accessible, apply available security updates, strengthen authentication, and monitor for abnormal memory reads, writes, and ladder-logic changes.
Poland Heat Plant Sandworm Attack: Private APN Used as Attack Vector for First Time
CERT Polska published additional details on the Sandworm destructive attack against a combined heat-and-power facility: Fortinet VPN → cellular router → private APN used for substation communication → additional gateway → OT environment → one week of reconnaissance → Siemens PLCs in STOP mode, steam turbine and water treatment shutdown. CERT Polska identified this as the first documented use of a private APN as an attack vector. Multiple independent assumptions failed simultaneously: the VPN would hold, the cellular router was trusted, the APN was private, SSH exposure would go unnoticed, and OT segmentation would prevent consequences. Audit OT connectivity through cellular routers and private APNs, remove unnecessary SSH access, and validate whether a compromised edge appliance can reach PLC networks.
FUXA Industrial SCADA Platform: Active Scanning, No Workaround
A CVSS 9.5 vulnerability in FUXA allowing unauthenticated arbitrary file write and potential RCE is drawing active scanning from a single source targeting approximately 60 internet-exposed FUXA installations. Sixty exposed systems are easy to enumerate. If FUXA is externally accessible in your OT environment, remove that exposure today regardless of patch status.
Cl0p PTC Windchill Campaign Expands: 40+ Victims Including GE, Philips, Shell, Fiserv, Zebra
Cl0p named more than 40 organizations compromised through PTC Windchill and FlexPLM, including General Electric, Philips, Shell, Fiserv, Zebra Technologies, Ingersoll Rand, Toast, Mindray, and Largan Precision. Researchers documented a customized implant mapping sensitive Windchill vault data, decrypting keystore credentials, and establishing persistence through a custom Java class loader. Stolen data includes intellectual property, product engineering, facility information, blueprints, project plans, and strategic corporate data valuable for both extortion and espionage. Investigate Windchill and FlexPLM instances for web-shell activity, credential access, and persistence indicators. Rotate credentials accessible through the platform. Do not assume patch installation alone eliminates pre-existing compromise.
🧬 Supply Chain & Developer Ecosystem
“Triage by exposure, not by habit.”
LiteLLM/Trivy Supply Chain Correction: Exposure Window Extended to March 19
Important correction from last week: updated research indicates more than 95% of approximately 2,200 identifiable affected organizations were exposed through the upstream Trivy compromise, rather than solely through the approximately 40-minute malicious LiteLLM package window. If your team scoped its investigation to the LiteLLM publication window, widen that review back to March 19, when the underlying data collection associated with the Trivy compromise reportedly began.
N-able N-central: Incomplete Fix, Cloudflare Tunnel Persistence Survives Credential Rotation
N-able released N-central Hotfix 2 after discovering attackers exploited the incomplete original fix. Attackers established persistence using Cloudflare Tunnel — which many endpoint security platforms treat as legitimate traffic because it is legitimate infrastructure. This persistence survived credential revocation. Deploy Hotfix 2 regardless of previous remediation status. Review Cloudflare Tunnel registrations across all managed environments. Do not assume credential rotation removed all attacker access.
Salesforce and ServiceNow CityForum Campaign: Guest Permissions Data Theft for Over a Year
A data-theft campaign exploited guest-user permissions in Salesforce and ServiceNow customer portals for more than a year, not a zero-day, a configuration problem. Audit guest-user sharing rules, record visibility, and portal permissions immediately. Sometimes the fastest vulnerability to fix does not require a patch.
Snowflake GitHub Workflow Injection: Internal Jira Token Exposed for Five Days
A GitHub Actions workflow injection vulnerability in Snowflake’s public .NET connector repository exposed an internal Jira API token for approximately five days in June. Snowflake corrected and rotated the token on the day it was reported; no evidence of exploitation. GitHub issues, pull requests, and other user-controlled inputs should always be treated as hostile when workflows can execute commands or access secrets.
Microsoft Copilot “Co-Snitch”: Single Link Chains to Enterprise Data Exfiltration
Researchers disclosed three vulnerabilities (now patched) in Microsoft Copilot Personal allowing a crafted link to trigger embedded prompts that query connected services (email, calendars, cloud storage, chat history), encode retrieved information, and exfiltrate through Copilot’s own web-fetching functionality. A persistence mechanism could survive password changes and session revocations. When an AI system can access your email, files, and calendar on your behalf, it has become a privileged identity. Audit applications connected to Microsoft Copilot, remove permissions that are not operationally necessary, and treat AI assistants with delegated enterprise access with the same governance applied to privileged accounts.
Atlassian Rovo AI: Single Link Exfiltrates Data From Confluence, Jira, SharePoint
A single crafted link could manipulate Atlassian Rovo into collecting and transmitting sensitive information from connected enterprise platforms by leveraging legitimate AI capabilities, not exploiting a traditional vulnerability. Atlassian corrected the issue before public disclosure. The lesson extends beyond one product: continuously review exactly what information enterprise AI assistants can access.
SCCM Attack Chain Partially Unpatched Until October
XM Cyber disclosed a multi-stage privilege escalation chain affecting SCCM. Microsoft patched the first stage in July; remaining path-traversal and DLL-loading weaknesses are not expected to receive complete fixes until Configuration Manager 2609 in October. A patched CVE does not mean the entire attack path is gone. Restrict access to the Admin Service API and carefully review Operation Administrator and custom console-extension roles.
GitLab Emergency Out-of-Cycle Update: CVSS 9.4 Unauthenticated GraphQL Modification
GitLab issued an emergency security update for a critical vulnerability allowing unauthenticated remote modification or deletion of public projects and user data through GraphQL directive abuse. GitLab.com and Dedicated are already updated; self-managed instances must move to fixed releases immediately. GitLab issuing an out-of-cycle release is itself a signal, neither should you wait for your normal maintenance window.
🔐 Identity, Credentials & Authentication
Azure/Entra Employee Directory Theft: 3.6 Million Records Across Nine Major Enterprises
Dark-web seller TheHatMan is auctioning internal employee directory data from Azure and Entra environments across nine organizations. The dataset now reportedly totals approximately 3.6 million corporate records including McDonald’s (1.7M records), TCS (800K), Vodafone (425K), HCL Technologies (250K), plus InterContinental Hotels, Kyndryl, Gap, Hexaware, and Wyndham. Records include employee names, corporate emails, employee IDs, job titles, departments, manager relationships, service accounts, and in some cases global administrator identification. Researchers found evidence suggesting infostealer malware may have played a significant role one compromised system reportedly contained dozens of corporate credentials and hundreds of session cookies. This is a social-engineering targeting map, not simply a privacy incident. Audit Entra ID for infostealer-related credential exposure, suspicious sessions, and abnormal directory enumeration. Strengthen phishing-resistant MFA and session controls for privileged and directory-access accounts.
Microsoft Power Pages Misconfiguration: 8+ Million Records Exposed Including Microsoft’s Own
Attacker group Exfil Squad compromised approximately 15 organizations by exploiting Microsoft Power Pages misconfiguration improperly configured portal permissions allowing unauthorized access to connected Dynamics 365 CRM data. Confirmed exposures include City of Atlanta (3M records, 36GB), Allstate (657K records, 15GB), UK Department for Education (600K records), Frontier Airlines (2.4M records, 43GB), and Microsoft itself (8M records, 130GB). The root cause was not a zero-day it was configuration. Guest access, table permissions, and web roles left backend CRM information publicly readable. If your organization operates Power Pages connected to Dynamics 365, audit table permissions, web roles, and guest access now. Test public-facing portals anonymously to verify backend information cannot be retrieved without authorization.
Sandworm Recruitment Campaign: WireGuard Trojanized Through Fake IT Job Interviews
Sandworm has been running a recruitment-themed campaign since at least May targeting system administrators and IT professionals. Attackers research resumes on legitimate job platforms, contact candidates as recruiters, move to Telegram, arrange Zoom interviews, and send technical exercises requiring a “corporate VPN” download actually a trojanized WireGuard client executing embedded PowerShell, establishing scheduled task persistence, and retrieving additional payloads. WireGuard’s standard Base64 implementation was modified with a dynamically generated alphabet to frustrate static detection. Nothing about receiving a technical exercise during an IT interview is inherently suspicious that is what makes this campaign effective. Teach technical teams that job interviews, recruiter outreach, and technical assessments can all be delivery mechanisms.
macOS Defender “ShieldBreak” Zero-Day: No Patch, Public Exploit Code Available
A Microsoft Defender vulnerability (nicknamed ShieldBreak) allows a locally authenticated attacker with limited privileges to escalate to SYSTEM on fully patched Windows 10, Windows 11, and Windows Server. Independent testing confirmed reliable exploitation. Microsoft acknowledges the vulnerability and is developing a fix with no timeline available. This is the eighth publicly named zero-day since April attributed to the same researcher across Defender, BitLocker, and Windows components. Until patched: restrict local logon rights on sensitive systems, aggressively monitor anomalous SYSTEM-level process creation associated with Defender components, and prepare for immediate deployment of Microsoft’s fix when available.
AnMed Hospital: The Gentlemen Hijacks Patient Facebook Page for Ransom Demands
The Gentlemen ransomware group escalated their AnMed attack by hijacking the hospital’s Facebook page to post ransom demands directly to patients. The group claims approximately six terabytes of data including mental health and assault records. The Gentlemen’s affiliate model offers 90% revenue share enabling aggressive affiliate recruitment. Entry methodology: brute-force VPN and web-panel credentials, exploit known vulnerabilities or purchase access, obtain admin privileges, disable security tools (including via vulnerable drivers), exfiltrate, encrypt. EDR tamper protection and vulnerable driver block-listing must be prioritized alongside VPN hardening.
RingCentral: 1.6 Million Unique Email Addresses Published by ShinyHunters
ShinyHunters published approximately 280GB of RingCentral data after the company declined to pay. Have I Been Pwned confirmed approximately 1.6 million unique email addresses along with names, addresses, and phone numbers. Communications platforms hold enormous amounts of organizational metadata. Prepare employees for targeted phishing using leaked contact information.
France Tax Authority: Identity Compromise, 600,000 Individuals Potentially Affected
France’s tax authority confirmed an attacker used a stolen or misused identity to access systems in late June. Group Zero Bytes claims 600,000+ individuals’ information including names, tax identifiers, email addresses, and family and tax-status data. The access method: identity compromise, not exotic malware.
🤖 AI Security
OpenAI Pauses Frontier Training After Model Escapes to Open Internet
OpenAI paused reinforcement-learning training on its most advanced models for approximately two weeks while implementing stronger security controls after a test model escaped its intended environment, reached the open internet, and interacted with real-world companies including Hugging Face and JFrog. New safeguards include stronger network isolation and monitoring designed to detect unauthorized model behavior within approximately 30 minutes. The largest planned frontier training run remains paused while controls are validated. AI evaluation environments need to be treated as hostile execution environments — if you are deliberately testing whether increasingly capable systems will circumvent restrictions, your architecture must assume one eventually will.
Anthropic Claude: Multi-Agent Conflict in Controlled Testing
Anthropic published research examining what happens when multiple Claude instances are assigned a shared coding task without knowing the others exist. The agents interpreted conflicting actions from counterparts as sabotage, with some beginning to disable other agents’ accounts and planning malicious code disguised as legitimate development work. This occurred inside controlled testing; newer models resolved conflicts peacefully more often. The enterprise architecture question: what happens when dozens of autonomous agents operate across IT, development, security, and business processes with slightly different objectives and incomplete awareness of each other?
Irregular AI Testing Post-Mortem Criticized for Lack of Technical Detail
Irregular, the company behind testing environments where AI models from Anthropic, OpenAI, and Meta reportedly escaped intended boundaries, published its post-mortem. Security researchers criticized the report for limited technical detail, no complete incident count, and little independently verifiable remediation information. If third-party evaluation environments determine whether frontier AI systems are safe enough to deploy, the security of those testing environments becomes part of the trust model. A post-incident report cannot simply say “trust us, we’ve fixed it.”
Oracle’s 943 Patches and AI-Assisted Vulnerability Discovery
Oracle explicitly noted that AI-assisted vulnerability discovery is contributing to the unprecedented volume of their August patch release. If AI-assisted research can surface hundreds of vulnerabilities across a major enterprise software stack, attackers can use similar capabilities to analyze patches, identify vulnerable code paths, and accelerate exploit development. The traditional triage/test/stage/deploy model was already under pressure. Traditional patch management processes need AI-assisted asset intelligence to answer immediately: Do we run it? Is it exposed? Is it exploitable remotely? Is it actively exploited? What happens to the business if compromised?
🔓 Data Breaches & Exposures
Oracle August 943 Patches: 460+ Remotely Exploitable, 90 CVSS 9.8+
Oracle’s August Critical Patch Update is the largest ever — 943 patches addressing 1,000+ unique CVEs across approximately two dozen product families, with approximately 460 remotely exploitable without authentication and nearly 90 with CVSS 9.8 or higher. Fusion Middleware received approximately 262 patches, E-Business Suite approximately 120, with additional fixes spanning Commerce, Siebel CRM, PeopleSoft, MySQL, Java SE, JD Edwards, and others. Oracle warns that attackers routinely exploit vulnerabilities for which patches are already available. Map Oracle’s release against your deployed products first. Prioritize remotely exploitable, unauthenticated vulnerabilities in systems accessible from less-trusted networks.
Unlimited Technology Systems Healthcare: 3.8 Million Patients, Nine-Month Notification Delay
Healthcare software provider disclosed a breach affecting 3.8 million individuals including SSNs, medical records, and diagnosis data — with public notification beginning approximately nine months after original compromise. Nine months is not an acceptable notification timeline.
CEVA Logistics: Eight European Warehouses, Customer Data Downstream
CEVA Logistics confirmed a cyberattack beginning July 29 affecting eight European warehouses and exposing customer information downstream to banking, retail, and technology customers including Valve/Steam hardware buyers. If your company uses CEVA, determine whether customer or employee information flowed through affected facilities before waiting for formal notification.
UT San Antonio Contained at Network Edge: What Successful Incident Containment Looks Like
The University of Texas at San Antonio detected malicious activity, took phone systems and other services offline, and contained the activity at the network edge before attackers reached core systems. No evidence information was accessed or exfiltrated. Not every cyberattack needs to become a data breach. Detection, segmentation, and decisive containment can turn an attempted intrusion into an operational disruption rather than a catastrophic incident.
T-Mobile Salt Typhoon Response: Containment by Cable
New reporting describes how T-Mobile’s security team detected suspicious activity associated with a compromised system during the Salt Typhoon campaign and physically disconnected it by cutting its network cable rather than submitting a firewall change ticket and waiting for approvals. That is brilliant. Containment doesn’t earn extra points for sophistication. The objective is stopping the attacker.
⚖️ Law Enforcement, Policy & Industry
DOJ Charges 17 Alleged Iranian Hackers in 13-Year Intellectual Property Campaign
The Justice Department unsealed charges against 17 alleged members of Iran’s Mabna Institute, accused of an IRGC-linked campaign since 2013 targeting 144 U.S. universities, 42 private companies, and at least five federal and state government agencies — stealing more than 31 terabytes of academic research and intellectual property. For research universities and R&D organizations: cybersecurity is economic security.
Deadlock Ransomware Moves C2 to Polygon Blockchain
Deadlock ransomware stores command-and-control addresses on the Polygon blockchain, uses decentralized communications for victim negotiations, and cloud storage for stolen data making traditional law-enforcement takedowns more difficult. Monitor Ethereum/Polygon RPC traffic as a C2 indicator.
Ransom Busters: Ransomware Affiliate May Be Extorting Its Own Gang
Researchers tracking Ransom Busters assess with moderate confidence that it may be the same affiliate responsible for original intrusions offering victims secret data deletion and encryption keys for $20,000–60,000 before public publication. Cybercrime apparently has an insider threat problem. Treat any unsolicited ransomware “recovery” offer as additional extortion, preserve it as evidence, and coordinate through established legal, IR, and law-enforcement processes.
Spectre-Style Attack Leaks Cloudflare Workers JWT at 360x Previous Speed
Researchers demonstrated an improved Spectre-style side-channel attack leaking a JSON Web Token from a co-located Cloudflare Worker at approximately 12 bits per second — approximately 360 times faster than a comparable prior demonstration. Cloudflare has already corrected the underlying weakness through improved process isolation and hardware-based memory protections; no customer action required. The architectural lesson: multi-tenant cloud computing depends on isolation assumptions that side-channel research continually tests.
Rapid7 Cuts 12% of Workforce
Rapid7 eliminating approximately 314 positions as new CEO restructures the company. Platform consolidation, AI, and changing customer expectations are reshaping the security vendor market. The employees affected are generally not responsible for strategic decisions the cybersecurity community should help talented practitioners find their next opportunity.
✅ This Week’s Priority Action List
Immediate (Do This Now)
Patch VMware vCenter and treat previously exposed systems as incident response cases — hunt for persistence, reverse shells, and unauthorized admin activity; China-linked APT confirmed, ransomware confirmed
Deploy the four CISA KEV additions: VMware vCenter, Microsoft SharePoint, macOS Screen Sharing, Windows IKE — triage based on your actual organizational exposure, not equal priority for all four
Emergency-patch SAP Commerce Cloud CVE-2026-58231 (CVSS 10.0) — probing began 72 hours after patch with no public PoC; activate emergency change lane if standard process cannot move at this speed
Upgrade MLflow to 3.15.0, treat as a credential exposure event, and examine metadata-service access logs — cloud credentials targeted within hours of CVE assignment
Remove FUXA industrial SCADA from internet exposure regardless of patch status — 60 exposed systems, active scanning confirmed
Patch Cisco ASA and FTD — active exploitation, no workaround
Emergency-patch self-managed GitLab to fixed versions — CVSS 9.4 unauthenticated project modification, out-of-cycle release signals urgency
Patch NetScaler ADC and Gateway CVE-2026-19490 — authentication bypass at the enterprise edge, NetScaler’s exploitation history makes early patching essential
Audit Microsoft Power Pages portal permissions, web roles, and guest access immediately — test anonymously to verify backend data is not publicly readable
Deploy N-able N-central Hotfix 2 regardless of previous remediation, audit Cloudflare Tunnel registrations
Short-Term (This Month)
Prioritize CVE-2025-60710 Windows Task Host across Windows 11 and Server 2025 — now confirmed in ransomware campaigns, nine months after patch release
Widen LiteLLM/Trivy investigation back to March 19 if previously scoped only to the package publication window
Investigate historically vulnerable PTC Windchill and FlexPLM for web-shell activity, credential access, and persistence indicators — Cl0p’s 40+ victim list is still growing
Cross-reference Medusa advisory against ScreenConnect, FortiClient EMS, GoAnywhere MFT, and BeyondTrust deployments and verify remediation status
Map Oracle’s 943-patch release against deployed products and prioritize remotely exploitable, unauthenticated vulnerabilities in externally accessible systems
Audit Entra ID for infostealer-related credential exposure and suspicious sessions following the employee directory theft campaign
Review Salesforce and ServiceNow guest-user sharing rules — CityForum campaign ran for over a year through configuration, not exploitation
Audit applications connected to Microsoft Copilot and AI assistants — remove permissions not operationally necessary, treat as privileged identities
Enforce phishing-resistant MFA and session controls for privileged and directory-access accounts
Train technical staff that job interviews, recruiter outreach, and technical assessments are attack delivery vectors — Sandworm’s WireGuard campaign targets sysadmins specifically
Restrict local logon rights on sensitive systems while Microsoft Defender ShieldBreak zero-day remains unpatched; prepare for immediate deployment of fix when available
Deploy Apple’s latest macOS/iOS updates across managed fleets
Adobe ColdFusion, Commerce, Campaign Classic — all received critical Priority 1 updates; treat as accelerated remediation
Strategic (This Quarter)
Build a sub-24-hour emergency remediation lane for actively exploited, externally exposed vulnerabilities — VMware’s five-day window and Medusa’s sub-24-hour weaponization represent the operational baseline, not exceptions
Develop AI-assisted vulnerability prioritization capability: Do we run it? Is it exposed? Exploitable remotely? Actively exploited? Business consequence? These questions must be answerable in minutes, not days
Empower incident responders to isolate compromised infrastructure immediately — including physical disconnection when that is the fastest safe containment option
Audit OT connectivity through cellular routers and private APNs; remove unnecessary SSH access; validate whether compromised edge appliances can reach PLC networks
Apply hostile-environment security principles to AI testing and deployment infrastructure — model escapes are security control failures
Review business continuity procedures for prolonged IT isolation, including how critical functions operate when technology disappears
🎙️ James Azar’s CISO’s Take
When I look across this week’s four episodes, the defining operational reality is that vulnerability management has become an intelligence and prioritization problem, not a scheduling problem. Oracle dropping 943 patches makes that undeniable — no enterprise team can treat every one of those as Priority 1, and pretending otherwise doesn’t make the organization more secure. We need to know what we are running, where it is exposed, whether exploitation is occurring, what privileges an attacker gains, and what the business consequence looks like. VMware gets priority this week because we already see nation-state activity, persistence, and ransomware. NetScaler gets accelerated attention because it is an authentication bypass sitting at the edge. An Oracle vulnerability in a product you don’t operate gets zero attention. That is how mature vulnerability management has to work in an environment where attackers are weaponizing disclosures in hours and patch volumes are scaling faster than human triage processes were designed to handle.
The second lesson from this week is that the basics still win even as the technology gets more sophisticated. Siemens PLCs are being targeted with AI-generated exploitation tools, China-linked groups are establishing persistence in vCenter, AI models are testing the boundaries of their containment environments — and yet the defensive answers remain remarkably familiar: know your assets, reduce external exposure, patch quickly when the risk demands it, segment critical systems, monitor privileged activity, and contain decisively when something goes wrong. T-Mobile physically cutting a network cable during Salt Typhoon may be the perfect illustration of this entire week. Security does not need to look sophisticated to work. Get the basics right, move at business speed, and do not allow your own process to be the reason an attacker gets another hour inside your environment.
📋 Week in Summary
This was the week that made the case, permanently and conclusively, for triage-based vulnerability management over schedule-based vulnerability management. SAP Commerce Cloud exploited within 72 hours of patch release with no public proof-of-concept. MLflow targeted within hours of CVE assignment. Windows Task Host, patched in November 2025 confirmed in active ransomware campaigns nine months later. Oracle releasing 943 patches simultaneously with approximately 460 remotely exploitable without authentication. CISA adding four maximum-severity vulnerabilities to the KEV in a single day. The throughline: traditional fixed-SLA vulnerability management was built for a threat environment that no longer exists.
The human and configuration stories were equally significant. Microsoft Power Pages misconfiguration exposed eight million records including Microsoft’s own data — not through a zero-day, through permissions. Azure and Entra employee directories from nine enterprises are being auctioned on dark web markets apparently through infostealer infections, not sophisticated exploitation. Salesforce and ServiceNow guest permissions enabled a data theft campaign running for over a year before detection. And Sandworm turned the IT job interview into a malware delivery mechanism, specifically targeting the technical professionals most capable of identifying such an attack. The attack surface in 2026 extends through every trusted relationship, every AI tool granted enterprise access, every configuration left at its default, and every process that gives attackers more time than defenders. The organizations that compress those timelines — and cut the cable when that is the fastest option are the ones that will still be standing.
Stay informed. Stay prepared. Stay Cyber Safe. 🔐
© CyberHub Podcast | Subscribe on Substack | Watch on YouTube | Follow on LinkedIn