About this episode
This week connects credential and session exposure, compromised software distribution, actively targeted infrastructure, and the growing role of AI in attack operations and vulnerability research. Alex and Jordan focus on what defenders can verify, where remediation must include retrospective review, and which claims remain source-reported rather than confirmed.
This episode brings together the week’s most relevant cybersecurity stories and their operational context for defenders.
Play the episode, then review the stories and chapter list for the reporting and topics covered.
Stories covered this week
Critical CVSS 10.0 Flaw in LXD and MicroCloud Allows Trusted Client Impersonation
A critical vulnerability in Canonical's LXD and MicroCloud allows attackers to impersonate trusted clients without their private key, accessing clusters and virtual machines if the attacker can reach the HTTPS API and holds the public certificate. This flaw has a CVSS score of 10.0, reflecting its severity and potential impact.
Source: The Hacker News
Over 1,000 GitLab Servers Vulnerable to Active Remote Code Execution Attacks
More than 1,000 Internet-exposed GitLab servers remain unpatched against a critical remote code execution vulnerability actively exploited by attackers. This flaw poses a significant risk to enterprise environments relying on GitLab.
Source: BleepingComputer
Barracuda warns of critical flaws enabling root access on devices
Barracuda Networks has disclosed two critical vulnerabilities that could allow attackers to execute commands with root privileges on their devices. Customers are urged to promptly apply available patches to mitigate this serious risk.
Source: BleepingComputer
Critical SQL Injection Flaws Found in Subnet Solutions PowerSYSTEM Center
Two critical SQL injection vulnerabilities in Subnet Solutions PowerSYSTEM Center versions 2020, 2024, and 2026 could allow authenticated users to execute unauthorized commands and access restricted resources. Users are strongly advised to apply updates or follow mitigation measures recommended by the vendor.
Source: CISA
Xen Hypervisor Flaws Allow Cross-VM Memory Access
Two critical vulnerabilities in the Xen hypervisor let a malicious VM read and write memory of other VMs, including dom0. A patch is available, but no mitigation exists for affected versions from 4.6 onward.
Source: The Hacker News
OpenSSH Issues Emergency Patch for Critical Alpine Linux SSH Password Flaw
OpenSSH released an urgent fix for a critical vulnerability allowing attackers to bypass authentication on Alpine Linux servers using long passwords. The flaw affects SSH key-only accounts and requires network access, an account name, and a password between 257 and 1,024 bytes.
Source: The Hacker News
US Agencies Warn of Cyber Threats to Industrial Refrigeration Systems
US government partners including CISA and FBI highlight malicious cyber activity targeting industrial refrigeration and cold chain monitoring systems, urging operators to secure their systems against threats like authentication bypass and arbitrary code injection. These attacks risk causing inventory loss, equipment hazards, and potential public health impacts by manipulating temperature controls remotely.
Source: CISA
QNAP Warns of Active Plex2Shell NAS Breaches Exploiting Critical Flaw
Hackers are actively exploiting the Plex2Shell vulnerability chain to breach QNAP NAS devices. QNAP urges users to update Plex Media Server via the QNAP App Center to mitigate risks.
Source: BleepingComputer
Chinese Hackers Use AI-Powered ARTEX to Target 200+ Global Organizations
China-based threat group Vapor Panda is leveraging an AI-powered penetration testing tool called ARTEX to carry out simultaneous attacks on high-value targets worldwide. CrowdStrike attributes this state-sponsored activity to the group previously known as VexatiousTemper.
Source: The Hacker News
Government Linux Servers Targeted by SysGoRAT and AI-Generated Scripts
Palo Alto Networks Unit 42 revealed a cyber espionage campaign targeting government Linux infrastructure from Oct 2025 to Apr 2026 using SysGoRAT and suspected AI-generated scripts. The campaign, named CL-UNK-1211, is linked to state-affiliated entities.
Source: The Hacker News
APT29 Hacks Web Analytics to Deliver iOS and Android Exploits
APT29, a Russia-linked threat actor, is conducting a large-scale watering hole campaign targeting iOS and Android users through compromised websites and a supply chain attack involving the Ukrainian Plerdy SEO Tracker. Injected JavaScript collects browser and device data to deliver exploits.
Source: The Hacker News
Q3 2026 Email Threat Landscape Shows Rise in Phishing Attacks
Microsoft Threat Intelligence reports a significant increase in email phishing activity in Q3 2026, with evolving tactics including CAPTCHA-gated phishing and spoofing familiar business domains. QR code phishing declined, but new risks emerged around security procedure overrides.
Source: Microsoft
VOLTA Infostealer Uses AI for Victim Prioritization
The VOLTA infostealer steals credentials, sessions, and crypto wallets, then leverages large language models to profile victims and prioritize valuable assets. This AI-driven victim appraisal marks a novel evolution in malware tactics.
Source: Talos Intelligence
Synology Warns of C3RB3R Ransomware Targeting NAS Devices
Synology has issued an urgent warning for customers to update their NAS devices due to a surge in C3RB3R ransomware attacks. The ongoing campaign targets vulnerable network-attached storage devices, risking data encryption and operational disruption.
Source: BleepingComputer
cPGuard Update Channel Hijacked to Deploy Backdoor on Linux Servers
The cPGuard security tool's update system was compromised to deliver a malicious script that installed a backdoor and harvested password hashes on Linux servers. The attacker exfiltrated sensitive data affecting versions 5.88.25 and later.
Source: The Hacker News
NIKKE PC Game Launcher Hacked to Spread Data-Stealing Malware
Hackers compromised the Goddess of Victory: NIKKE PC game launcher through a supply-chain attack, distributing malware that steals credentials and cryptocurrency wallet data. The developers confirmed the intrusion and advised users to take precautions.
Source: BleepingComputer
Hackers Backdoor Linux Servers via Trojanized CWP Web Server
A new Linux malware named CWPdoor is being spread through a trojanized version of the cwpsrv web server used by Control Web Panel. This malware allows attackers to backdoor compromised Linux servers.
Source: BleepingComputer
Chainalysis reports data breach via offensive agentic techniques
Blockchain analytics firm Chainalysis has disclosed a data breach after attackers exploited 'offensive agentic techniques' to access internal systems, exposing customer identifiers including names and emails. The breach highlights emerging threats leveraging autonomous attack methods.
Source: BleepingComputer
Northflank Security Breach Exposes Customers' AI API Keys
Northflank, a cloud application hosting platform, suffered a security breach leading to unauthorized use of customers' AI API keys. Customers are urged to rotate all credentials and secrets stored on the platform immediately.
Source: BleepingComputer
DreamHost Data Breach Exposes FTP Logins and Webmail Sessions
DreamHost confirmed a data breach after attackers accessed its File Manager platform for two months, stealing customers' FTP/SFTP credentials and webmail session data. The breach poses significant risks for customer website security and data integrity.
Source: BleepingComputer
DigiCert Data Breach Exposes Customer Info and Identity Documents
DigiCert suffered a data breach after a server migration mistakenly exposed an internal system to the internet, allowing unauthorized access to customer information and identity documents. The incident raises concerns over sensitive data handling among certificate authorities.
Source: BleepingComputer
Chainalysis Breach Exposes All User Credentials, Services Shut Down
Chainalysis confirmed a cyberattack exposed names, usernames, password hashes, and live tokens for all users, prompting shutdown of Reactor and Data Solutions platforms. No evidence suggests investigative data was accessed.
Source: The Hacker News
OpenAI's GPT-6 Cyber AI Discovers 81 Firefox and 948 Linux Kernel Flaws
OpenAI's new GPT-6 Cyber AI model has identified 81 previously unknown high-severity Firefox vulnerabilities and crafted functioning exploits for 948 distinct Linux kernel bugs. This breakthrough highlights AI's evolving role in vulnerability discovery and exploit development.
Source: BleepingComputer
LLMjacking Attacks Cause $1M in Fraudulent Cloud AI Charges
Large language model hijacking or LLMjacking attacks have resulted in over $1 million in fraudulent cloud AI charges, with some organizations losing upwards of $100,000 daily. These attacks abuse AI services for unauthorized usage, impacting cloud security and costs.
Source: BleepingComputer
Chapters
- Opening
- Chainalysis reports data breach via offensive agentic techniques
- Chainalysis Update: Credentials and Live Tokens Exposed
- Northflank Security Breach Exposes Customers' AI API Keys
- LLMjacking Attacks Cause $1M in Fraudulent Cloud AI Charges
- VOLTA Infostealer Uses AI for Victim Prioritization
- DreamHost Data Breach Exposes FTP Logins and Webmail Sessions
- DigiCert Data Breach Exposes Customer Info and Identity Documents
- cPGuard Update Channel Hijacked to Deploy Backdoor on Linux Servers
- NIKKE PC Game Launcher Hacked to Spread Data-Stealing Malware
- Hackers Backdoor Linux Servers via Trojanized CWP Web Server
- APT29 Hacks Web Analytics to Deliver iOS and Android Exploits
- Q3 2026 Email Threat Landscape Shows Rise in Phishing Attacks
- Critical CVSS 10.0 Flaw in LXD and MicroCloud Allows Trusted Client Impersonation
- Over 1,000 GitLab Servers Vulnerable to Active Remote Code Execution Attacks
- Synology Warns of C3RB3R Ransomware Targeting NAS Devices
- QNAP Warns of Active Plex2Shell NAS Breaches Exploiting Critical Flaw
- Barracuda warns of critical flaws enabling root access on devices
- OpenSSH Issues Emergency Patch for Critical Alpine Linux SSH Password Flaw
- Xen Hypervisor Flaws Allow Cross-VM Memory Access
- Critical SQL Injection Flaws Found in Subnet Solutions PowerSYSTEM Center
- US Agencies Warn of Cyber Threats to Industrial Refrigeration Systems
- Chinese Hackers Use AI-Powered ARTEX to Target 200+ Global Organizations
- Government Linux Servers Targeted by SysGoRAT and AI-Generated Scripts
- OpenAI's GPT-6 Cyber AI Discovers 81 Firefox and 948 Linux Kernel Flaws
- Closing