Threats Affecting New Zealand

Mathspace, an online mathematics platform, suffered a data breach impacting over 1 million individuals due to exploitation of a critical SQL injection vulnerability (CVE-2026-72898) in its self-hosted Metabase instance. The breach involved unauthorized access and data exfiltration of personal information including names, user IDs, usernames, email addresses, and related metadata of students, teachers, staff, and parents/guardians primarily from Australia and New Zealand. No sensitive academic records, passwords, or authentication credentials were exposed. The incident was discovered weeks after exploitation began, and remediation was delayed beyond the patch release date. Mathspace has taken steps to secure the environment and is investigating the incident while notifying affected individuals.

HighBreachAustraliaNew Zealand

BigBear 2.0 is a phishing-as-a-service framework based on Evilginx2, targeting Microsoft 365 credentials globally. It uses adversary-in-the-middle techniques with geo-matched residential proxies to bypass multi-factor authentication (MFA), including disabling FIDO2/WebAuthn MFA. The campaign exfiltrated thousands of credential records and session cookies, affecting over 3,300 unique victim IPs across more than 40 countries. The platform is operated by 'General Boss' and leased to multiple affiliates, leveraging automated cookie replay and real-time exfiltration via Telegram.

MediumCampaignBritish Indian Ocean TerritoryFranceGermany+3#phishing-as-a-service#evilginx2#microsoft 365

PaperCut is warning that hackers are actively exploiting a vulnerability in all versions of its PaperCut NG and PaperCut MF print management software in zero-day attacks. [...]

CriticalExploitUnited StatesUnited KingdomAustralia+9#zero-day

A Chinese web-development framework called DCloud Uni-App has become the technical foundation for over 236,000 scam domains since 2022, powering fake cryptocurrency exchanges, pig-butchering operations, wallet drainers, gambling platforms, and brand-impersonation sites. The framework gained prominence after the 2024 RainbowEx cryptocurrency scam in Argentina, which defrauded residents of San Pedro. Similar operations include the Lightning Shared Scooter Co. (LSSC) scam in the United States, which caused millions in losses across multiple states, and the currently-active Yuechi Sharing Technology Ltd. bicycle-sharing investment scam. These operations use legitimate hosting providers, with approximately 6% utilizing bulletproof hosting, particularly CTG Server. The scams target victims globally through WhatsApp, Telegram, and social media, converting victims into recruiters for pyramid-style operations. Enterprise exposure reaches over 985 distinct organizations across 25 industry verticals, with over five m...

MediumCampaignUnited StatesArgentinaAustralia+2#dcloud#uni-app#lssc

The FBI has issued a warning about data security risks associated with mobile applications developed in China, highlighting concerns over potential unauthorized data access and privacy violations. Although specific apps were not named, popular applications like TikTok and Temu are implied as examples. These apps may collect extensive user data, which could be accessed or exploited by foreign entities, raising national security and privacy concerns. The threat primarily targets mobile users globally, with a focus on apps that have significant user bases and data collection capabilities. Exploitation does not require known vulnerabilities but stems from inherent risks in data handling and potential government influence over app developers. The FBI's warning underscores the need for organizations and individuals to scrutinize the apps they use, especially those originating from jurisdictions with adversarial geopolitical relations. Mitigation involves restricting or monitoring the use of such apps within sensitive environments, implementing strict data access controls, and enhancing user awareness. Countries with high adoption rates of these apps and strategic geopolitical tensions with China are at greater risk. The threat is assessed as medium severity due to the potential impact on confidentiality and privacy, moderate ease of exploitation through data collection practices, and the broad scope of affected users without requiring direct exploitation of software vulnerabilities.

MediumNewsUnited StatesCanadaUnited Kingdom+7#mobile

An arbitrary file overwrite vulnerability in Tinybeans Private Family Album App v5.9.5-prod allows attackers to overwrite critical internal files via the file import process, leading to arbitrary code execution or information exposure.

HighVulnerabilityUnited StatesCanadaUnited Kingdom+7#cve#cve-2026-30289

Cross-Site Request Forgery (CSRF) vulnerability in Drupal Theme Negotiation by Rules allows Cross Site Request Forgery.This issue affects Theme Negotiation by Rules: from 0.0.0 before 1.2.1.

MediumVulnerabilityUnited StatesGermanyUnited Kingdom+11#cve#cve-2026-3211#cwe-352

Non-relational SQL injection vulnerability (NoSQLi) in the Wakyma web application, specifically in the endpoint 'vets.wakyma.com/pets/print-tags'. This vulnerability could allow an authenticated user to alter a POST request to the affected endpoint for the purpose of injecting NoSQL commands, allowing them to list both pets and owner names.

MediumVulnerabilityUnited StatesCanadaUnited Kingdom+7#cve#cve-2026-3023#cwe-943

Umbraco is an ASP.NET CMS. From 14.0.0 to before 16.5.1 and 17.2.2, A broken object-level authorization vulnerability exists in a backoffice API endpoint that allows authenticated users to assign domain-related data to content nodes without proper authorization checks. The issue is caused by insufficient authorization enforcement on the affected API endpoint, whereby via an API call, domains can be set on content nodes that the editor does not have permission to access (either via user group privileges or start nodes). This vulnerability is fixed in 16.5.1 and 17.2.2.

MediumVulnerabilityUnited StatesUnited KingdomGermany+7#cve#cve-2026-31832#cwe-639

Users are being tricked into enabling unwanted browser notifications through quiz websites. These sites challenge visitors with quizzes on various topics, but their main goal is to get users to click 'Start the quiz' button. This action triggers a misleading prompt that tricks users into allowing notifications. Once enabled, these notifications can display advertisements, scams, or unwanted downloads even when the user is not on the original website. The article provides instructions on how to remove and block web push notifications across different browsers, including Chrome, Firefox, Opera, Edge, and Safari. It also lists several domains associated with this deceptive campaign.

MediumCampaignNew ZealandIndiaSouth Africa#browser notifications#user deception#social engineering