Threat Library

A threat actor group calling itself 'Ransom Busters' is contacting organizations previously victimized by ransomware attacks, falsely claiming to have hacked the original ransomware operators' infrastructure and offering to delete stolen data for a fee of $20,000 to $60,000. This appears to be a secondary extortion scam preying on already-compromised victims rather than a legitimate data recovery or threat actor takedown service.

Threat actors are actively scanning for and exploiting a critical Server-Side Request Forgery (SSRF) vulnerability in MLflow, an open-source AI/ML lifecycle platform, to steal cloud credentials and secrets from exposed metadata services. A separate but related campaign is targeting FUXA, an open-source SCADA/HMI platform used in industrial automation. Both flaws are being weaponized in the wild according to watchTowr and VulnCheck.

Varonis Threat Labs disclosed three vulnerabilities, collectively named CoSnitch, in Microsoft Copilot Personal that could allow an attacker to exfiltrate data from a victim's connected apps and Copilot session with a single click on a crafted link. The flaws exploit an undocumented URL parameter surfaced by the assistant itself, enabling silent data leakage without further user interaction.

This is a vendor research report (Picus Security's Blue Report 2026) rather than an active threat, highlighting that security controls often block well-known attack signatures but fail to detect variant or behavioral approaches achieving the same malicious objective. The report underscores the need for continuous behavioral and adversarial testing rather than relying solely on signature- or IOC-based defenses.

The Clop ransomware gang has deployed a custom Java-based web shell specifically engineered to target PTC Windchill and FlexPLM product lifecycle management servers. The tool is purpose-built to decrypt stored credentials, enumerate file repositories, and exfiltrate sensitive design and engineering data for extortion purposes. This represents an evolution in Clop's tactics toward targeted, application-specific tooling rather than generic ransomware payloads.

This is a product feature announcement, not a security threat. Comcast is rolling out WiFi-based motion sensing (using channel state information from existing routers/wireless devices) as part of its Xfinity Shield home security platform, enabling presence/motion detection without dedicated cameras or sensors.

CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalog based on confirmed active exploitation: a Microsoft IKE double-free flaw, a SharePoint authentication bypass, a VMware vCenter path traversal bug, and a macOS improper authentication issue. Under BOD 26-04, FCEB agencies must remediate these on an expedited timeline, and CISA urges all organizations to prioritize patching given evidence of in-the-wild exploitation.

Multiple vulnerabilities have been disclosed in CISA's Malcolm network traffic analysis tool suite, including an unauthenticated-adjacent arbitrary PHP code execution flaw (CVE-2026-55676, CVSS 8.8), two nginx/Lua RBAC bypasses via URI normalization mismatches (CVE-2026-63177, CVE-2026-19670), a path traversal in archive extraction (CVE-2026-63134), and two resource-exhaustion/DoS flaws involving malicious archives and decompression bombs (CVE-2026-63133, CVE-2026-19671). Versions prior to 26.06.1/26.07.0/26.08.0 depending on the specific CVE are affected, with vendor patches available and no known public exploitation reported at this time.

Siemens Simcenter Femap and Simcenter Nastran versions prior to V2606 contain a stack-based buffer overflow vulnerability triggered when an application binary parses a malicious string as a file argument. Successful exploitation could allow an attacker to achieve remote code execution in the context of the current process, though exploitation requires user interaction (tricking a user into running the binary with a crafted argument).

A critical remotely exploitable stack-based buffer overflow has been discovered in TRENDnet TV-IP751WIC IP cameras running firmware 11.03.03, affecting multiple configuration-handling functions within the alphapd web server component. A public exploit exists, and given the device's end-of-life status, no vendor patch is expected, leaving all deployed units permanently vulnerable to remote compromise.

A critical stack-based buffer overflow vulnerability has been discovered in the nginx binary bundled with TRENDnet TEW-WLC100 wireless LAN controllers, triggered by manipulation of the HTTP Server header. The flaw allows unauthenticated remote attackers to execute arbitrary code on the device, and a public exploit is already available, making active exploitation highly likely.

Grav CMS before version 2.0.14 contains a broken access control flaw in the admin plugin's group blueprint, allowing a low-privileged delegated admin.users operator to modify the access field and grant themselves super-admin rights. This enables full administrative takeover of the Grav instance, including scheduler and Twig template evaluation capabilities that can be leveraged for remote code execution.

SpiderFoot fails to sanitize correlation titles derived from untrusted external scan data such as server banners and metadata, allowing attackers to inject malicious HTML/JavaScript. When an operator views the correlations dashboard, the injected script executes in their browser session, potentially exfiltrating stored API keys and session tokens.

A critical injection vulnerability in Red Hat Advanced Cluster Management's acm-search-v2-rhel9 component allows authenticated users, including hub administrators or Search Custom Resource editors, to execute arbitrary shell commands and SQL statements. The flaw stems from improper validation of the WORK_MEM string in the Search CR before it is embedded in a bash script and SQL query, enabling code execution within the privileged postgres pod.

CVE-2026-65400 is an improper authentication vulnerability in Apple macOS that allows a network-based attacker to authenticate to Screen Sharing without valid credentials. The flaw has been added to CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. Organizations running macOS with Screen Sharing enabled face an urgent risk of unauthorized remote access.

CVE-2026-33824 is a double free vulnerability in Microsoft's Internet Key Exchange (IKE) Service Extensions that can be exploited remotely to achieve code execution. It has been added to CISA's Known Exploited Vulnerabilities catalog with a short remediation window, indicating active or imminent exploitation in the wild.

A critical unauthenticated remote code execution vulnerability (CVE-2026-15748) has been disclosed in Forminator Forms, a WordPress plugin installed on over 600,000 sites. The flaw allows attackers to upload malicious PHP files without authentication, potentially leading to full site compromise. Given the plugin's massive install base, this represents a high-priority patching target for WordPress site operators.

Researchers at Wiz disclosed a GitHub Actions workflow injection vulnerability in Snowflake's public snowflake-connector-net repository, where a maliciously crafted GitHub issue could trigger command injection in a workflow that contained internal Jira credentials. Successful exploitation could allow an attacker to exfiltrate secrets and potentially compromise the CI/CD pipeline of a widely used Snowflake connector library.

GitLab disclosed a critical flaw (CVE-2026-19478, CVSS 9.4) in its GraphQL API affecting both Community Edition and Enterprise Edition, allowing unauthenticated attackers to remotely modify or delete public projects and user data. Organizations running self-managed GitLab instances are urged to patch immediately to prevent destructive attacks against source code repositories.

GitHub experienced a widespread outage affecting its website, API, Actions, Pull Requests, and other core services. This is a service availability incident rather than a malicious attack, but it disrupts development workflows, CI/CD pipelines, and any automated systems dependent on GitHub's infrastructure.