Threat Intelligence Database

A Canadian cybersecurity executive, Edward Dubrovsky, was arrested in Pennsylvania linked to alleged extortion activities associated with the FBI's crackdown on the ShinyHunters hacking group. The arrest is part of law enforcement efforts targeting this criminal hacking organization.

PairDrop versions up to 1.11.2 have an IP spoofing vulnerability in the Peer._setIP function. This flaw allows remote attackers to join discovery rooms of other networks by forging the cf-connecting-ip header. Attackers who know a victim's public IP can impersonate a local device on self-hosted instances that are not behind Cloudflare, enabling unauthorized file send/receive actions. The vulnerability has a low CVSS score of 2.3 and is rated as low severity. A patch is available, and the product is a cloud service, so vendor-managed remediation is expected.

openapi-typescript-codegen versions up to 0.31.0 contain a critical code injection vulnerability. This flaw allows attackers who can control an OpenAPI document to inject arbitrary JavaScript code by supplying unescaped values within single-quoted string literals. The injection points include path keys, parameter names, servers[0].url, or info.version fields. Exploitation occurs when generated clients are imported or service methods are called, leading to arbitrary code execution.

SkillHub versions before 0.2.22 have an incorrect authorization vulnerability in the AccountMergeService and AccountMergeController. Authenticated attackers can exploit the merge flow to take over other user accounts by initiating a merge with a target username or OAuth identity, obtaining the verification token directly, and confirming the merge. This allows attackers to inherit the victim's API tokens, roles, and namespace ownership.

CVE-2026-108549 is a critical vulnerability in chenhg5 cc-connect up to version 1.5.0. The flaw is a missing authentication check in the MAX platform adapter webhook mode, allowing unauthenticated remote attackers to send forged updates. Attackers can exploit this by reaching the webhook listener on port 8080 and impersonating allowed or admin users to execute privileged commands such as /shell on the host system.

CVE-2026-108548 is an authentication bypass vulnerability in iflytek's AstronRPA up to version 1.1.6. The flaw exists in the OpenResty gateway's auth_handler.lua, which accepts any Bearer token without validation. This allows unauthenticated attackers to access sensitive API routes and impersonate any user by spoofing user identity headers.

CVE-2026-108547 is a high-severity vulnerability in iflytek's AstronRPA up to version 1.1.6. It involves a missing tenant authorization check in the robot-service component, allowing authenticated users to access shared variables belonging to other tenants. Attackers can enumerate shared variable IDs and decrypt variables re-encrypted with their own tenant key, exposing other tenants' credentials in plaintext.

A Chinese-speaking hacker used the ARTEX AI penetration testing suite and Claude agents to conduct cyberattacks on multiple South Korean banks, including Shinhan Bank, KB Kookmin Bank, and Hana Bank. The attacks exposed clients' personal data and credit card information and caused system outages. The attacker’s infrastructure and activities were analyzed by CrowdStrike, linking the attacks to previously reported financial-sector breaches. The ARTEX AI project has been made closed-source and discontinued by its developer following confirmation of its use in real-world attacks, but derivatives remain available. The attacker’s identity is uncertain but partially exposed through leaked resume data.

HighNewsSouth Korea

Kortix Suna versions from 0.10.7 up to but not including 0.13.52 contain a server-side request forgery (SSRF) vulnerability. This flaw allows project managers with write permissions on connectors to bypass IP address restrictions by using IPv6 6to4 or Teredo addresses that embed private IPv4 addresses. Exploiting this, attackers can set connector URLs to access internal services and cloud metadata endpoints and read their responses. The vulnerability has a low CVSS 4.0 score of 2.3, reflecting limited impact and attack complexity.

CVE-2026-66435 is a vulnerability in the WP Rollback plugin by Devin Walker that allows insertion of sensitive information into sent data. This issue affects versions from the initial release up to 3.1.2. The vulnerability can lead to unauthorized retrieval of embedded sensitive data. It has a medium severity with a CVSS score of 5.9.