The daily cybersecurity brief
15 stories 4 critical 6 min read Updated 06:30 IST
Defenders should prioritize patching AhsayCBS to mitigate webshell and crypto mining risks. Additionally, vulnerabilities in Grid Protection Alliance openPDC and openHistorian require immediate attention. Monitoring for AI-assisted attacks targeting financial sectors is also advised.
Today in 60 seconds
- AhsayCBS Flaws Exploited for Webshells and Crypto Mining Threat actors are exploiting unpatched AhsayCBS vulnerabilities to gain access and deploy miners. Do this today Restrict access to the AhsayCBS management interface to trusted IP addresses only.
- Grid Protection Alliance: Multiple Vulnerabilities in openPDC and openHistorian Multiple vulnerabilities exist in Grid Protection Alliance openPDC and openHistorian affecting critical infrastructure. Do this today Patch openPDC and openHistorian to versions higher than the listed affected versions.
- ARTEX AI and Claude Agents Used in Cyberattacks on South Korean Banks A Chinese hacker utilized ARTEX AI and Claude agents to target South Korean financial institutions. Do this today Hunt for open directories containing Claude Code session histories, ARTEX configuration files, or Claude memory files.
No stories match your search.
Actively Exploited 4
-
AhsayCBS Flaws Exploited for Webshells and Crypto Mining Threat actors are exploiting unpatched AhsayCBS vulnerabilities to gain access and deploy miners.
Threat actors exploited CVE-2026-105133 and CVE-2026-105134 in the AhsayCBS backup management platform. The attack chained these flaws to bypass authentication and execute OS commands. Observed activity included deploying JSP webshells and the XMRig miner.
Why it matters. Compromise allows attackers to establish persistence, deploy miners, and potentially install additional backdoors. Full host restoration from a safe backup is recommended if compromise is confirmed.
Do this today Restrict access to the AhsayCBS management interface to trusted IP addresses only.
- Affected
- AhsayCBS
- CVE
- CVE-2026-105133, CVE-2026-105134
- Sat 10 OctAhsayCBS Vulnerabilities Exploited for Webshells and Crypto Mining
- TodayAhsayCBS Flaws Exploited for Webshells and Crypto Mining
Also covered by SecurityWeek, Huntress
{"coverage":1,"evidence":0.9,"freshness":0.229,"importance":0.75,"novelty":0.6,"quality":0.95,"total":0.778} -
Hitachi Energy SOI: RCE in Apache ActiveMQ Component CISA advises on an RCE vulnerability in Apache ActiveMQ within Hitachi Energy SOI product versions.
An improper input validation vulnerability (CVE-2026-34197) exists in the Apache ActiveMQ component used by Hitachi Energy SOI. This flaw allows for Remote Code Execution via the Jolokia JMX-HTTP bridge.
Why it matters. Exploitation can impact the confidentiality, integrity, and availability of the affected product. The vulnerability is listed in CISA KEV and has a CVSS score of 8.8.
Do this today Apply vendor-recommended mitigations for CVE-2026-34197.
- Affected
- Hitachi Energy SOI versions 2.0.0 through 2.2.0
- CVE
- CVE-2026-34197
{"coverage":0.387,"evidence":1,"freshness":0.048,"importance":0.75,"novelty":1,"quality":0.95,"total":0.733} -
FBI Details FortiBleed Persistence Tactics Affecting Firewalls Attackers using FortiBleed can establish persistence, enumerate environments, and lock out victims from their firewalls.
FBI investigation details show FortiBleed actors can lock out organizations from their own firewalls by deleting or changing existing accounts. Attackers create administrative accounts, enumerate Active Directory, and use compromised credentials for lateral movement.
Why it matters. The threat is characterized as a persistence issue, meaning credentials taken months ago may still be actively used for access and disruption.
Do this today Review Fortinet accounts and configurations for unauthorized changes, and check firewall, VPN, authentication, and domain controller logs for suspicious activity.
- Affected
- FortiGate devices
{"coverage":0.387,"evidence":0.9,"freshness":0.182,"importance":0.75,"novelty":1,"quality":0.8,"total":0.706} -
Langflow Vulnerability Allows Root RCE via Custom Component Editor Langflow allows unauthenticated RCE via a validate endpoint, enabling attackers to execute arbitrary code as root.
CVE-2026-0768 exists in Langflow's custom component editor validate endpoint. This endpoint executes submitted code directly using Python's exec() without input validation or authentication. Exploitation allows an attacker to execute arbitrary Python code as root.
Why it matters. Successful exploitation enables attackers to harvest sensitive credentials, including API keys, AWS credentials, and SSH keys, facilitating lateral movement. Compromised secrets remain useful even after patching.
Do this today Rotate every credential that touched an exposed Langflow instance.
- Affected
- Langflow versions up to and including 1.4.2
- CVE
- CVE-2026-0768
{"coverage":0.387,"evidence":0.9,"freshness":0.046,"importance":0.75,"novelty":1,"quality":0.8,"total":0.693}
Vulnerabilities & Patches 4
-
Grid Protection Alliance: Multiple Vulnerabilities in openPDC and openHistorian Multiple vulnerabilities exist in Grid Protection Alliance openPDC and openHistorian affecting critical infrastructure.
Grid Protection Alliance released advisories detailing several vulnerabilities in openPDC and openHistorian. These flaws include deserialization issues, missing authentication for critical functions, and SSRF.
Why it matters. Exploitation could impact critical infrastructure sectors, including energy, via multiple attack vectors. The highest assessed CVSS score is 9.8.
Do this today Patch openPDC and openHistorian to versions higher than the listed affected versions.
- Affected
- openPDC <2.9.477, <2.9.482; openPDC (Docker image) <2.9.477, <2.9.482; openHistorian <2.8.580, <2.8.585
- CVE
- CVE-2026-100730, CVE-2026-101022, CVE-2026-104629, +3 more
{"coverage":0.387,"evidence":0.7,"freshness":0.184,"importance":0.75,"novelty":1,"quality":0.95,"total":0.671} -
Savannah lwIP SMTP client: Buffer Overflow Allows Remote Code Execution A buffer overflow in the Savannah lwIP SMTP client permits unauthenticated remote code execution.
The lwIP SMTP client fails to check the size of inputs, leading to a buffer copy without size validation. This condition can result in a buffer overflow.
Why it matters. Successful exploitation could allow remote code execution or cause the targeted device to crash. This affects critical infrastructure sectors globally.
Do this today Apply the patch available at git commit 614420f82c8729d070e01464c0dddb3c9525c772.
- Affected
- Savannah lwIP SMTP client 2.2.1
- CVE
- CVE-2026-15340
{"coverage":0.387,"evidence":0.7,"freshness":0.048,"importance":0.75,"novelty":1,"quality":0.95,"total":0.658} -
AWS Bedrock AgentCore Vulnerability Allows Agent Takeover via Prompt A patched flaw in AWS Bedrock AgentCore permits attackers to compromise multiple AI agents using a single malicious prompt.
A vulnerability in AWS Bedrock AgentCore was disclosed, allowing an attacker to compromise an organization's AI agent fleet. The flaw permitted lateral movement and credential theft using a single malicious prompt.
Why it matters. Exploitation could lead to the compromise of multiple AI agents within the same AWS account and region.
- Affected
- AWS Bedrock AgentCore
Also covered by GBHackers
{"coverage":0.613,"evidence":0,"freshness":0.234,"importance":0.75,"novelty":1,"quality":0.85,"total":0.525} -
Cisco Finesse SSRF Vulnerability (CVE-2026-20362) Unauthenticated remote attackers can perform SSRF on Cisco Finesse via its web management interface.
Improper input validation in the web management interface of Cisco Finesse allows unauthenticated remote attackers to conduct Server-Side Request Forgery (SSRF) attacks. Successful exploitation can allow an attacker to obtain limited sensitive information associated with the affected device.
Why it matters. Defenders must prioritize patching to prevent unauthorized information disclosure via the management interface.
Do this today Upgrade Cisco Finesse to fixed releases: 12.6 and earlier to 15.0; Packaged CCE/Unified CCE to 15.0(1)ES202701; Unified CCX to 15.0(1) SU2.
- Affected
- Cisco Finesse, Packaged CCE, Unified CCE, Unified CCX
- CVE
- CVE-2026-20362
{"coverage":0.387,"evidence":0.4,"freshness":0.105,"importance":0.5,"novelty":1,"quality":0.95,"total":0.514}
Worth watching
-
Walkthrough Vercel paid a $50,000 bounty! 👀👀 -
-
Conference talk Black Hat Asia 2026 Highlights
Malware & Ransomware 1
-
ARTEX AI and Claude Agents Used in Cyberattacks on South Korean Banks A Chinese hacker utilized ARTEX AI and Claude agents to target South Korean financial institutions.
A Chinese hacker conducted cyberattacks against multiple South Korean banks using the ARTEX AI penetration testing suite and Claude agents. The activity exposed client personal data and credit card information and caused system outages.
Why it matters. The use of specialized AI tools for targeted attacks indicates a sophisticated threat actor capability against critical financial infrastructure.
Do this today Hunt for open directories containing Claude Code session histories, ARTEX configuration files, or Claude memory files.
- Affected
- South Korean banks
{"coverage":0.387,"evidence":0,"freshness":0.742,"importance":0.75,"novelty":1,"quality":0.95,"total":0.552}
Threat Actors & Campaigns 3
-
Hackers Hijack Google Domains and ccTLDs via DNS Compromise Threat actors compromised third-party DNS operators to obtain unauthorized HTTPS certificates for Google and various ccTLDs.
Hackers compromised third-party operators and modified authoritative DNS records for ccTLDs including .gh, .sl, and .as. This allowed them to request and obtain valid TLS certificates for domains they did not own, enabling impersonation.
Why it matters. Compromise of DNS records allows attackers to issue valid certificates for domains, enabling phishing and content serving from impersonated sites.
Do this today Publish restrictive Certification Authority Authorization (CAA) records for owned domains.
- Affected
- .gh, .sl, and .as ccTLDs; several Google domains
- Fri 9 OctHackers Hijack Google Domains via ccTLD Registry Compromise
- TodayHackers Hijack Google Domains and ccTLDs via DNS Compromise
Also covered by Ars Technica, SecurityWeek
{"coverage":1,"evidence":0,"freshness":0.059,"importance":0.75,"novelty":0.6,"quality":0.95,"total":0.536} -
DarkBlinders Hackers Use Fake App for Cyberespionage Targeting Government Data Hackers deployed a fake meeting app and abused GitHub to steal government data from targets in Israel and Iraq.
DarkBlinders hackers used a fake video meeting application, StarkMeet, and abused GitHub repositories in a cyberespionage campaign. The operation involved credential theft and exfiltrated government cloud data from a Kurdistan environment. Persistence was established via the Windows Run registry key, loading a backdoor that polled a separate repository.
Why it matters. The attack chain utilized multiple vectors, including webmail impersonation and a decoy meeting client, to achieve persistence and exfiltrate data while evading detection mechanisms.
{"coverage":0.387,"evidence":0,"freshness":0.618,"importance":0.75,"novelty":1,"quality":0.65,"total":0.51} -
FortiBleed Campaign Targets Fortinet Devices via Credential Theft Attackers are locking users out of Fortinet devices by deleting or changing accounts and passwords.
The FortiBleed campaign targets internet-accessible Fortinet devices using compromised credentials and brute-force techniques. Threat actors are observed deleting existing accounts or changing passwords to prevent legitimate access and maintain persistence. The FBI and US Secret Service issued advisories regarding this activity.
Why it matters. Compromise of management access can lead to complete denial of service for critical network infrastructure. Organizations must scope the intrusion and evict threat actors to prevent lateral movement.
Do this today Reset all Fortinet VPN and administrative passwords; implement phishing-resistant multifactor authentication (MFA).
- Affected
- Fortinet FortiGate firewalls, SSL VPN appliances
{"coverage":0.387,"evidence":0,"freshness":0.164,"importance":0.75,"novelty":1,"quality":0.9,"total":0.489}
Breaches & Incidents 2
-
GhostAction Campaign Compromises GitHub Accounts for Credential Theft GhostAction compromised over 500 GitHub accounts, injecting malicious workflows to steal secrets and API keys.
GhostAction injected malicious workflows into numerous repositories since October 7, 2026. These workflows run on push events and harvest credentials, including AWS, OpenAI, and GitHub tokens. The payloads also scan repository history for previously committed secrets.
Why it matters. Compromise of maintainer accounts allows attackers to access and exfiltrate sensitive credentials embedded in source code and repository history. This can lead to lateral movement across cloud and AI services.
Do this today Remove injected workflows, review execution logs, and rotate exposed credentials for affected repositories.
- Affected
- GitHub repositories, GitHub Actions secrets, cloud credentials, AI service API keys
{"coverage":0.387,"evidence":0,"freshness":0.642,"importance":0.75,"novelty":1,"quality":0.65,"total":0.512} -
FBI Reports Chinese-Linked Hackers Stealing Emails via Third-Party Portal Chinese-linked hackers stole emails from various Southeast Asian sectors using a third-party portal.
The FBI and six other agencies reported that hackers linked to Integrity Technology Group stole emails. The compromised data originated from government, law enforcement, healthcare, and religious institutions in Southeast Asia.
Why it matters. Third-party portals can serve as an indirect vector for data exfiltration, bypassing direct network defenses.
Do this today Investigate for unauthorized access to third-party portals handling sensitive organizational data.
- Affected
- Government organizations, law enforcement agencies, healthcare systems, and religious institutions in Southeast Asia
{"coverage":0.387,"evidence":0,"freshness":0.22,"importance":0.75,"novelty":1,"quality":0.8,"total":0.485}
AI Security 1
-
Anthropic Launches Program for Critical Infrastructure and OSS Security Anthropic is launching a program to use its AI models and research to help secure critical infrastructure and open-source software.
Anthropic announced a new program pairing its Claude models and engineers with cybersecurity firms to find and fix vulnerabilities. The program includes an opt-in scanning service for open-source software, providing free, periodic scans with suggested patches.
Why it matters. The initiative aims to assist in securing critical infrastructure and OSS against vulnerabilities, though provided reports may contain inaccuracies.
Also covered by SecurityWeek, The Register
{"coverage":1,"evidence":0,"freshness":0.067,"importance":0.5,"novelty":1,"quality":0.9,"total":0.497}
CVE spotlight
| CVE | Affects | CVSS | EPSS | Status |
|---|---|---|---|---|
| CVE-2015-3306 | ProFTPDThe mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands. | 10.0 | 98% | Exploited (KEV)CISA due 11 Oct |
| CVE-2016-3081 | Apache StrutsApache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attacker… | 8.1 | 95% | Exploited (KEV)CISA due 11 Oct |
| CVE-2015-5477 | ISC BINDnamed in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion fa… | 7.5 | 92% | Exploited (KEV)CISA due 11 Oct |
| CVE-2021-3199 | ONLYOFFICE DocsDirectory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /.. … | 9.8 | 15% | Exploited (KEV)CISA due 11 Oct |
| CVE-2023-22894 | StrapiStrapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. Th… | 4.9 | 3% | Exploited (KEV)CISA due 11 Oct |
| CVE-2026-34197 | Apache ActiveMQImproper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveM… | 8.8 | 15% | Exploited (KEV)CISA due 30 Apr (passed) |
Quiz
Yesterday's answer
According to the security advisory, what specific component is affected by the SSRF vulnerability (CVE-2026-102255)??
The SMA1000 Appliance Work Place interface
The story explicitly states that the vulnerability impacts the SMA1000 Appliance Work Place interface.
Today's question
According to the report, what specific malicious payloads were observed during the exploitation of the AhsayCBS platform?
Locked in. The answer is in tomorrow's brief.
On the radar tomorrow
- KEV deadline Tue 13 OctCVE-2026-86950 · Apple Multiple Products
- Patch Tuesday in 2 daysTuesday 13 October
- WatchingLow-cost Android phones ship with residential proxy malware
- WatchingCyber exec arrested in case allegedly tied to ShinyHunters hackers
Also worth your time
Exploits
Tools
- foundry-rs/foundryFoundry is a blazing fast, portable and modular toolkit for Ethereum application development written in Rust.
- HypothesisWorks/hypothesisThe property-based testing library for Python
- trickest/cveGather and update all available and newest CVEs with their PoC.
- yaklang/yakitCyber Security ALL-IN-ONE Platform
- AFLplusplus/AFLplusplusAFL++ is a state-of-the-art fuzzer, and #1 in benchmarks. It was originally based on AFL. Today it comes with qemu 5.1, …
- Pennyw0rth/NetExecThe Network Execution Tool
Community
- A story of wifi secrets, UART lockdowns and a damaged flash memory chip
- AI Agent Security: Six Controls From Nine Real Incidents
- GitHub Actions leaking secrets when Miri output is cached
- Smashing the token limit with overlapping fragments (CSS injection token exfiltration, PortSwigger Research)
- Death By A Thousand PaperCuts (PaperCut Pre-Auth RCE Chain and Patch Bypasses WT-2026-0141-0144/CVE-2026-82077/CVE-2026-82078/CVE-2026-81578) - watchTowr Labs
Podcasts
That's today's brief.
The next brief lands at 06:30 IST.