The recent week has underscored a stark reality in the cybersecurity landscape: costly attacks do not always stem from sophisticated techniques. Instead, they often exploit existing vulnerabilities and overlooked access points, leading to significant breaches. A closer examination reveals a pattern of small oversights snowballing into larger issues, as evidenced by several notable incidents this week.
⚡ Threat of the Week
A suspected advanced persistent threat (APT) group linked to China has been identified as the perpetrator behind the exploitation of a newly patched vulnerability in VMware vCenter. This flaw, designated CVE-2026-59310, boasts a critical CVSS score of 9.8 and presents a severe directory-traversal vulnerability. Malicious actors have leveraged this weakness to execute arbitrary code, leading to the deployment of a backdoor and a reverse SSH binary, ultimately resulting in the introduction of Babuk-derived ransomware. However, according to cybersecurity firm QUIRSO, the ransomware appears to serve as a distraction, obscuring the true nature of the intrusion and complicating forensic investigations by encrypting potential evidence.
🔔 Top News
- Apple macOS Flaw Exploited to Drop Crypto Miner — A recently patched vulnerability in Apple macOS has been actively exploited to deploy a cryptocurrency miner. The flaw, CVE-2026-65400, is a critical authentication issue affecting the Screen Sharing component, allowing attackers on the network to authenticate without valid credentials. Reports from the Netherlands National Cyber Security Center indicate that this vulnerability has been abused across multiple systems, leading to unauthorized root access and the installation of a Monero crypto miner.
- Lazarus Exploits New Windows 0-Day — The notorious Lazarus Group from North Korea has been linked to the exploitation of a newly patched zero-day vulnerability in Microsoft Windows. This attack targets defense and aerospace sectors in countries including France, Germany, Brazil, and India. The operation, dubbed “Dream Job,” employs social engineering tactics to lure professionals with fake job offers while delivering a new backdoor known as Troy.
- GeoServer Patches Critical Flaw Under Attack — GeoServer has issued patches for a critical SQL injection vulnerability that could lead to remote code execution. The issue, which has not yet received a CVE identifier, was actively exploited shortly after its disclosure, prompting swift action from the GeoServer project maintainers.
- Amnesia Stealer Goes Beyond Data Theft — A new macOS malware, Amnesia Stealer, has emerged, targeting users through ClickFix attacks. This malware not only steals data from various web browsers but also includes a streaming module that allows attackers to control the victim’s browser interactively. This innovative approach enables real-time access to authenticated sessions, marking a significant evolution in macOS malware.
- From GhostCommit to GhostSplice — A novel attack technique named GhostSplice has been discovered, capable of circumventing safeguards around AI coding assistants. By embedding malicious requests within benign content, attackers can manipulate the assistant’s memory, effectively stitching together harmful instructions from disparate sources.
- Using Chrome DevTools Protocol for Data Theft — Research from SpecterOps has unveiled a technique that exploits Chromium’s DevTools Protocol to extract sensitive data from compromised browsers. This method allows attackers to bypass cookie protections and access authenticated applications, highlighting a new phase in cookie theft.
️🔥 Trending CVEs
As vulnerabilities continue to surface at an alarming rate, the urgency to patch critical flaws has never been more pressing. The following CVEs are particularly noteworthy this week:
- CVE-2026-68820 (Microsoft Windows)
- CVE-2026-58231 (SAP Commerce Cloud)
- CVE-2026-48362
- CVE-2026-71398
- CVE-2026-27302 (Adobe)
- CVE-2026-20349 (Cisco Secure Firewall)
- CVE-2026-53413, CVE-2026-53414, CVE-2026-53415 (Zoom)
- CVE-2026-65400 (Apple macOS)
- CVE-2026-20337 through CVE-2026-20348 (ClamAV)
- CVE-2026-18412 (OpenCart)
- CVE-2026-66147, CVE-2026-66145 (SonicWall)
- CVE-2026-6726, CVE-2026-6727 (Trusted Platform Module)
- CVE-2026-26035, CVE-2026-70468, CVE-2026-70465 (Fortinet)
- CVE-2026-65640 (WordPress)
- CVE-2026-65321 (PyAthena)
- CVE-2026-43637 (Cornac)
- CVE-2026-63720 (datamodel-code-generator)
- SQL injection vulnerability in GeoServer
- Multiple vulnerabilities in WireShark
🎥 Cybersecurity Webinars
- How to Control the Open-Source Security Debt Created by AI Coding Tools → This webinar explores the challenges posed by AI coding tools in expanding unvetted open-source use and the resulting vulnerability backlogs.
- AI Can Build Exploits in Minutes. Can Your Security Team Keep Up? → A practical framework for enhancing visibility and response speed to counteract the rapid evolution of AI-driven cyber threats.
📰 Around the Cyber World
- Security Flaw in FileRun — A high-severity command injection flaw has been disclosed, allowing for remote code execution. The vulnerability affects versions up to 2026.2.0 and has been patched in 2026.2.1.
- ClickFix Leads to ACR Stealer and GhostPipe — An advanced ClickFix attack has been reported, deploying a sophisticated malware iteration targeting user credentials.
- Flaw in Citrix NetScaler — A heap overflow vulnerability in Citrix NetScaler has been quietly patched, with indications of active exploitation shortly after its disclosure.
- Ethereum Malware Loader Targets Portuguese-Speaking Users — A new malware loader utilizing the EtherHiding technique has been identified, capable of extensive data collection and remote command execution.
- Thousands of Exposed Fuel Gauges Dropped from the Internet — A significant reduction in exposed Automatic Tank Gauge systems has been observed, with a 55% drop in the U.S. alone.
- Phantom Enigma Campaign Targets Brazil — A phishing campaign leveraging compromised government infrastructure has been detected, targeting banking and public-sector organizations.
- F.B.I. Agent Charged With Unauthorized Crypto Withdrawals — An F.B.I. agent faces charges for illicitly obtaining cryptocurrency through unauthorized withdrawals.
- Ukraine Dismantles Fraudulent Call Centers — Authorities have disrupted numerous fraudulent call centers involved in various scams, resulting in significant seizures of equipment and funds.
- North Carolina Man Sentenced for Cyber Extortion Scheme — A man has been sentenced for conducting an extensive cyber extortion scheme against a technology company.
- ExfilSquad’s Access to Data from 13 Organizations — An analysis confirms unauthorized access to sensitive data by the ExfilSquad data extortion group.
- OpenAI Rolls Out Computer History in ChatGPT — OpenAI has introduced a new feature that tracks user activity across applications, raising privacy concerns.
- China-linked LightSpy Activity Detected in Over 13 Countries — A modular surveillance tool has been identified in multiple countries, expanding the scope of its potential impact.
- Trivy Supply Chain Attack Exposed 2,500+ Companies — A supply chain attack has revealed that many organizations were exposed prior to the compromise of the Trivy scanner.
- Massive Azure Exfiltration Campaign Exposes Millions of Enterprise Records — An ongoing campaign has resulted in the exposure of sensitive employee databases from numerous global enterprises.
