For the latest discoveries in cyber research for the week of 6th July, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES River Bank & Trust, a US financial institution, has experienced a ransomware incident after an unauthorized actor accessed the network of parent company River Financial Corporation on June 16. The bank found ransomware on portions of its server environment and is assessing whether personal data was accessed or exfiltrated. Indra Group, a Spanish defense, aerospace, and technology contractor and NATO cyber coalition member, has confirmed a ransomware attack affecting one subsidiary. The Gentlemen ransomware gang threatened to leak allegedly stolen data, while Indra said the incident was contained and that service continuity was maintained. Check Point Threat Emulation and Harmony Endpoint provide protection against this threat Nidec, a Japanese electric motor and industrial manufacturer, has disclosed a ransomware attack affecting the network of its Taiwanese subsidiary, Nidec Chaun Choung Technology. BlackField group claimed responsibility and alleged theft of more than two terabytes of corporate data, including employee, financial, procurement, manufacturing, legal, and IT records. US insurance firm Aflac has disclosed a data breach affecting its Japan operations after attackers accessed its policyholder portal between June 15 and June 25. Personal and financial data of nearly 4.4 million customers was exposed, including policyholder information and premium payment account details. AI THREATS Check Point Research has demonstrated a browser-native ransomware technique generated by a large language model that abuses Chrome’s File System Access API. A fake image-enhancement page convinces users to grant folder access, then reads, exfiltrates, and encrypts photos inside the browser on Android and Windows. Researchers examined shell command injection weaknesses in open-source AI coding agents, finding that 10 out of 11 popular tools failed to block obfuscated destructive commands. Simple rewrites bypassed filters and enabled destructive actions, including file deletion, while only the Continue agent properly parsed commands. Researchers warned that attackers are exploiting LLM phantom squatting by registering AI-generated domains to hijack traffic and deliver phishing. They recorded 250,000 hallucinated domains and subsequent registrations, including an AI-built phishing kit, Montana Empire, using a postal-service domain for credential theft. VULNERABILITIES AND PATCHES Oracle E-Business Suite is affected by CVE-2026-46817, a critical remote code execution flaw reportedly exploited against about 950 internet-exposed instances worldwide. Successful exploitation can give attackers control over ERP systems. Check Point IPS provides protection against this threat (Oracle E-Business Suite Authentication Bypass (CVE-2026-46817)) Linux kernel maintainers patched CVE-2026-46242, a Bad Epoll privilege escalation flaw affecting Linux servers, desktops, and Android devices. The race-condition use-after-free vulnerability allows an unprivileged local user to gain root access, and a public exploit demonstrated reliable exploitation against vulnerable systems. Citrix has addressed CVE-2026-8451, a NetScaler ADC and NetScaler Gateway memory disclosure flaw affecting SAML Identity Provider configurations. Active exploitation was observed less than 24 hours after disclosure, with attacks able to leak session tokens from vulnerable appliances. Check Point IPS provides protection against this threat (Citrix NetScaler Out Of Bounds Read (CVE-2026-8451)) Progress has addressed CVE-2026-8037, a critical OS command injection flaw in Kemp LoadMaster load balancers with a CVSS score of 9.6. Exploitation attempts began on June 29 and could allow unauthenticated remote code execution against vulnerable systems. Check Point IPS provides protection against this threat (Progress Kemp LoadMaster Commad Injection (CVE-…
The DuneSlide vulnerabilities enable zero-click prompt injection attacks that escape Cursor's sandbox and execute arbitrary code on the underlying operating system. The post Critical Cursor AI Code Editor Flaws Could Lead to OS-Level Remote Code Execution appeared first on SecurityWeek .
CISA warned on Wednesday that attackers have begun exploiting a high-severity Microsoft SharePoint remote code execution vulnerability patched in May. [...]
CISA says threat actors are exploiting a recently patched SharePoint remote code execution vulnerability (CVE-2026-45659). The post CISA Warns of Actively Exploited Microsoft SharePoint Vulnerability appeared first on SecurityWeek .
Multiple weaponized proof-of-concept (PoC) exploits on GitHub were found delivering a Python-based remote access trojan (RAT) named ChocoPoC that can execute commands and steal sensitive data in a campaign believed to target cybersecurity researchers. [...]
ChocoPoC is a Python-based remote access trojan (RAT) distributed via trojanized proof-of-concept (PoC) exploit repositories on GitHub. The malware is delivered through malicious Python packages added as dependencies in these PoCs, which are hosted on the Python Package Index (PyPI). Once installed, the packages execute code that downloads and runs the ChocoPoC RAT, capable of executing arbitrary commands and stealing sensitive data such as browser credentials and network configurations. Multiple PoC repositories for various vulnerabilities have been identified as distributing this malware. The campaign primarily uses compromised accounts to publish malicious packages and PoCs, targeting security researchers and penetration testers who run untrusted code. Users are advised to avoid blindly trusting GitHub repositories and to execute unverified code only in isolated environments.
Chris Thompson's journey took him from hacking game controls as a teenager to founding IBM’s X-Force Red team. The post Hacker Conversations: Chris Thompson, Former Head of IBM X-Force Red, Co-Founder of RemoteThreat appeared first on SecurityWeek .
Three vulnerabilities were discovered in Daktronics VFC-DMP-5000, DMP-5000, and DMP-8000 controllers used for large-scale LED displays such as highway signs and billboards. These include a path traversal vulnerability exploitable without authentication, an authenticated arbitrary file upload flaw, and default admin credentials that often remain unchanged. Exploiting these could allow attackers to gain root-level access, tamper with displayed content, or fully compromise the device. Patches have been released by Daktronics, and users are advised to change default passwords. The vulnerabilities were responsibly disclosed through CISA's VINCE platform. The impact ranges from reconnaissance to full device control, but exploitation requires internet exposure of the devices, which is the responsibility of the customers to manage.
Threat actors are increasingly abusing Shop, the order-tracking app from Shopify, by adding fake purchase receipts in users' order histories to trick them into providing sensitive data or installing remote access software. [...]
More than half of the bugs are use-after-free defects, which can potentially lead to remote code execution. The post Chrome 149 Update Resolves 18 Severe Vulnerabilities appeared first on SecurityWeek .
MCP Gateway allows easy and secure running and deployment of MCP servers. From 0.21.0 until 0.42.2, Docker MCP Gateway YAML-unmarshalled the attacker-controlled io.docker.server.metadata OCI image label into the broad catalog.Server structure for direct docker:// references and catalog snapshot imports in pkg/oci/self_contained.go and pkg/workingset/workingset.go. Runtime-shaping fields including Volumes, User, and ExtraHosts were then appended to the docker run argument vector without an origin allowlist, allowing a malicious image author to request host filesystem or Docker socket mounts and UID 0 execution when a victim selected or pulled the image. This container-creation-time boundary bypass can execute arbitrary code on the host and is not prevented by no-new-privileges because no in-container privilege escalation is required. This issue is fixed in version 0.42.2.
The flaws allow remote, unauthenticated attackers to make system changes, access underlying accounts, and inject commands. The post Critical Ubiquiti Vulnerabilities in Attackers’ Crosshairs appeared first on SecurityWeek .
A SQL injection vulnerability in Quest NetVault Backup's NVBUDashboard allows remote attackers to execute arbitrary code. Exploitation requires authentication, but the authentication mechanism can be bypassed. The vulnerability arises from improper validation of user-supplied strings used in SQL queries, enabling code execution with NETWORK SERVICE privileges. Quest has issued an update to address this issue.
CVE-2026-9780 is a vulnerability in Quest NetVault Backup's addclient3 webpage that allows remote attackers to bypass authentication by injecting arbitrary scripts due to improper validation of user-supplied data. Exploitation requires user interaction, such as visiting a malicious page or opening a malicious file. The vulnerability can be leveraged with other flaws to execute arbitrary code with SYSTEM privileges. Quest has issued an update to address this issue.
A critical SQL injection vulnerability exists in Quest NetVault Backup's NVBURASDevice JSON-RPC message processing. This flaw allows remote attackers to execute arbitrary code with NETWORK SERVICE privileges by exploiting improper validation of user-supplied strings used in SQL queries. Although authentication is nominally required, the authentication mechanism can be bypassed. Quest has issued an update to address this vulnerability.
A SQL injection vulnerability in Quest NetVault Backup's NVBUDeviceDrive JSON-RPC processing allows remote attackers to execute arbitrary code with NETWORK SERVICE privileges. Although exploitation requires authentication, the authentication mechanism can be bypassed. Quest has issued an update to address this vulnerability.
A SQL injection vulnerability in Quest NetVault Backup's NVBURemovableMedia JSON-RPC processing allows remote attackers to execute arbitrary code with NETWORK SERVICE privileges. Although exploitation requires authentication, the authentication mechanism can be bypassed. Quest has issued an update to address this vulnerability.
A critical SQL injection vulnerability in Quest NetVault Backup's NVBULibraryPort component allows remote attackers to execute arbitrary code. Exploitation requires authentication, but the authentication mechanism can be bypassed. The flaw stems from improper validation of user-supplied strings in JSON-RPC messages, enabling code execution with NETWORK SERVICE privileges. Quest has issued an update to address this issue.
A critical SQL injection vulnerability exists in Quest NetVault Backup's NVBULibrarySlot JSON-RPC message processing. This flaw allows remote attackers to execute arbitrary code with NETWORK SERVICE privileges by exploiting improper validation of user-supplied strings used in SQL queries. Although authentication is nominally required, the authentication mechanism can be bypassed. Quest has issued an update to address this vulnerability.