A mass exploitation campaign against SonicWall SMA1000 appliances exposed a UK council to Active Directory credential theft, Cl0p claimed a 270GB data haul from Harley-Davidson, and a Twitch extension with about 30,000 users quietly forwarded live session tokens to a Russian bot service.
🟠 HIGH (1)
SonicWall SMA1000 flaw weaponised at scale, UK council breach tied to the campaign Confirmed
Hunt.io says an operator began scanning and exploiting SonicWall SMA1000 remote access appliances two days after SonicWall disclosed CVE-2026-15409, a critical server-side request forgery flaw, and that the campaign reached at least 250 devices across several countries. In the UK council case the attacker extracted LDAP credentials and ran DCSync against Active Directory, a route to domain-wide accounts, and credential theft has also been confirmed in France. Administrators running SMA1000 appliances should apply SonicWall’s updates now, rotate every credential the appliance can see including directory and service accounts, and hunt logs for DCSync and unusual directory queries.
🟡 MEDIUM (8)
Cl0p claims Harley-Davidson breach and posts 270GB of internal files Unconfirmed report
The Cl0p extortion group says it stole internal data from Harley-Davidson and has published roughly 270GB of files that appear to be engineering and product documents taken from Windchill product lifecycle management systems. The manufacturer has not confirmed the claim, so the volume and contents should be treated as unverified for now. Any organisation running PTC Windchill or a comparable engineering data platform should check it for internet exposure and for the file transfer flaws Cl0p has abused in earlier campaigns.
Sources Cybernews
Weekend leak-site claims name Kimberly-Clark, Turkish telco i2i-systems and French group CARIDRO Unconfirmed report
Ransomware trackers logged a cluster of new extortion claims over the weekend: ShinyHunters said it will publish data from consumer goods maker Kimberly-Clark after a final warning, a crew calling itself Barracuda claimed it exfiltrated more than 693GB including source code from Turkish telecommunications firm i2i-systems, and Qilin listed French organisation CARIDRO VAL DE LOIRE. None of the victims had confirmed the claims when the listings appeared, and leak-site posts often overstate what was taken. Treat these as unverified until a victim or regulator confirms, and use the reminder to test whether off-site backups and incident response plans would actually hold.
Sources DeXpose ransomware tracker
AWS patches SSM Agent flaw that could hand over instance IAM credentials Confirmed
Amazon fixed CVE-2026-89049, a server-side request forgery bug in the AWS Systems Manager Agent rated 9.9, where an authenticated remote user can bypass the destination denylist in remote-host port forwarding and reach link-local endpoints. That path can expose an instance’s temporary IAM role credentials, so a low-privilege foothold could be turned into cloud permissions. Upgrade SSM Agent to 3.3.4851.0 or later on every managed instance and review SSM session and port forwarding activity for unexpected destinations.
Sources AWS Security Bulletin|Rapid7
Progress Chef Automate carries a CVSS 10.0 authentication flaw, fixed in 4.13.520 Confirmed
Progress published a fix for CVE-2026-80462, a maximum severity flaw in Chef Automate’s API gateway and identity validation path that can let an unauthenticated actor reach protected functionality. Chef Automate coordinates configuration management and holds credentials for the systems it manages, so an intruder who reaches it can often move further than the appliance itself. Upgrade to 4.13.520 and confirm the service is not reachable from the internet.
Sources Daily CyberSecurity|CVE Brief
Forgejo patches CVSS 9.9 remote code execution in self-hosted Git servers Confirmed
Forgejo released versions 16.0.4 and 15.0.8 to fix CVE-2026-89094, a remote code execution flaw caused by improper handling of template expansion for files in a crafted repository’s .forgejo/template directory. A self-hosted code host tends to hold source, access tokens and deployment keys, so a compromised instance gives away more than code. Administrators should upgrade, review who can create repositories, and check recent template changes and pipeline activity.
Sources Daily CyberSecurity|Red Hot Cyber
Malicious Twitch extension forwarded 30,000 users' live session tokens to a Russian bot service Confirmed
Socket’s threat research team found an extension called Twitch Enhanced Viewer, published under the JeetBot brand, live on the Chrome Web Store with about 30,000 users and on Firefox Add-ons with 552, forwarding each viewer’s live Twitch OAuth token to proxy servers run by a Russian bot service; a hardcoded list of ten Russian-language channels was exempt. Older builds posted tokens to a dedicated endpoint, and because the token now travels in a redirect query string it is written in clear text into proxy logs. Users should remove the extension and revoke Twitch authorisations, and reviewers should treat stream or ad-blocking extensions with broad host permissions as a supply-chain risk.
Sources Socket|Daily CyberSecurity
Sysdig: manual exploitation of a marimo notebook flaw led into a victim's cloud Confirmed
Sysdig’s threat research team documented an intrusion in which an attacker exploited CVE-2026-39987, a pre-authentication remote code execution flaw in the marimo Python notebook’s terminal websocket endpoint, to get a shell on a notebook host and pivot into the victim’s AWS infrastructure. The operator built custom Python tooling by hand rather than relying on AI agents, a reminder that flaws patched months ago still pay off for patient attackers. Patch marimo, keep notebooks off the public internet, and alert on notebook hosts calling cloud metadata and control plane endpoints.
Sources Sysdig
Cyberattack halts Mississippi student financial aid payments and applications Under investigation
The Mississippi Office of Student Financial Aid cannot process student applications or payments after a network security incident at the state’s Institutions of Higher Learning, reported during the past week. Officials have not said who is responsible or whether personal data was taken, and the state’s main aid portal stayed online while affected systems were isolated. Public sector teams should keep a manual fallback for benefit and payment workflows and rehearse notification duties while an incident is still being scoped.
Sources Mississippi Today|SuperTalk|Dysruption Hub
⚪ WATCH (4)
Exposed GitLab token carried write access toward GnuTLS and 55 related projects Confirmed
Truffle Security found a GitLab API token inside a public CI artifact from the openconnect/ocserv project that held Owner rights on 55 projects, among them GnuTLS, Nettle, libtasn1, libidn2 and ocserv. On the maintained GnuTLS release branch the token satisfied the push rules, so a commit could have landed without a merge request, and it had been leaking on every pipeline run since January before being revoked within hours of disclosure; a review found no commits attributed to the account. Maintainers of public projects should treat artifact uploads as publication and keep secrets out of environment dumps.
Sources Truffle Security|Cybernews
Check Point shows a hidden ChatGPT channel can leak one account's Gmail into another Confirmed
Check Point Research published a proof of concept in which a hidden cross-account channel between ChatGPT code execution environments let an attacker retrieve email data from a victim’s connected Gmail account while the victim’s own conversation looked normal. The channel existed because sandboxes belonging to different accounts shared infrastructure, so the exposure came from the assistant’s connected tools rather than a link the user clicked. Teams wiring assistants into mail, drives and internal tools should treat those connections as a monitored data path and scope app permissions narrowly.
Sources Check Point Research|CSO Online
GuardBreaker: decoy code comments derail AI-assisted malware analysis Confirmed
ESET researchers describe GuardBreaker, a technique that plants a benign-looking code comment in a malicious sample so that model-based analysis tools refuse or abandon the file, and say the Russia-aligned group UAC-0099 has begun using it. The trick turns a safety refusal into a blind spot, because a scanner that stops mid-analysis can look like a clean result. Teams using models for triage should keep human review on anything a model declines to analyse and log refusals as a signal worth chasing.
Sources WeLiveSecurity (ESET)
Anthropic's Amodei says AI safety work needs time to catch up with capability Confirmed
Anthropic chief executive Dario Amodei said the AI industry has to give safety measures room to catch up with rapidly improving models, and in the same interview warned that a rogue system could take over large parts of the internet within a year, as reported by Cybernews. The comments land in a week that also brought Anthropic’s own misuse reporting and several agentic security failures at other vendors. Enterprises deploying agents should pair them with least privilege, monitoring and human approval gates rather than assuming vendor guardrails are enough.
Sources SecurityWeek|Cybernews
Methodology: compiled from vendor advisories, government feeds (CISA KEV, MSRC), security news sources and on-chain/security-firm alerts. Grouping: one incident, one entry, with every source cited. Unconfirmed reports are labeled. Crypto items are incident reporting, not investment advice. Corrections from prior digests are noted at the top when applicable.