About this episode
This week, SOC Minute follows active attacks against edge infrastructure, identity and data breaches, AI-branded phishing, targeted malware, and three distinct ways attackers are poisoning trust across the open-source development ecosystem.
This episode brings together the week’s most relevant cybersecurity stories and their operational context for defenders.
Play the episode, then review the stories and chapter list for the reporting and topics covered.
Stories covered this week
New NetScaler Zero-Day Targeted Attacks Can Disrupt SAML Deployments
Citrix has patched a high-severity zero-day in NetScaler ADC and Gateway, actively exploited in targeted attacks. The memory overflow vulnerability carries a CVSS score of 8.7 and can disrupt SAML authentication services.
Source: The Hacker News
Critical Dell System Update Vulnerability Allows Root Privilege Escalation
Dell has issued an urgent patch for a critical privilege escalation flaw in its System Update CLI tool, which could allow attackers to gain root access on affected machines. Users are strongly advised to apply the update immediately to mitigate risk.
Source: BleepingComputer
Critical Buffer Overflow Found in Savannah lwIP SMTP Client v2.2.1
A critical buffer overflow vulnerability (CVE-2026-15340) affecting Savannah lwIP SMTP client version 2.2.1 could allow remote code execution and device crashes. A patch is available, and CISA urges users to apply mitigations to secure critical infrastructure.
Source: CISAn
Critical File-Access Flaw Found in Atlassian Jira and Confluence
Atlassian disclosed a critical vulnerability, CVE-2026-21589, allowing arbitrary file access in self-hosted Data Center products like Jira, Confluence, and Bitbucket. This flaw poses a significant security risk to enterprises using these platforms.
Source: BleepingComputer
Critical LMCache Flaw Allows Unauthenticated Remote Code Execution
An unpatched critical vulnerability in LMCache's multiprocess mode allows unauthenticated attackers to run code remotely on LLM cache servers. No fixed version is available, posing a high-risk security gap for deployments using LMCache.
Source: The Hacker News
Cisco warns of critical flaws allowing Nexus switch takeover
Cisco has disclosed five critical vulnerabilities in its NX-OS that could allow attackers to run arbitrary code with root privileges on Nexus switches. These flaws pose a significant risk to data center network security.
Source: BleepingComputer
Critical Vulnerabilities Found in Grid Protection Alliance openPDC and openHistorian
Multiple critical vulnerabilities affect Grid Protection Alliance's openPDC and openHistorian, including deserialization of untrusted data, missing authentication, SSRF, and use of hard-coded credentials. These vulnerabilities pose serious risks to energy sector infrastructure worldwide, with some fixes available but Docker images remaining unpatched.
Source: CISA
Max severity SonicWall SMA1000 flaw now exploited in attacks
A critical vulnerability (CVE-2026-102255) in SonicWall SMA1000 appliances patched recently is now actively exploited in the wild. Attackers are targeting unpatched devices just days after the fix was released.
Source: BleepingComputer
China-Aligned TA419 Targets U.S. AI Policy Experts with Microsoft AitM Phishing
China-linked cyber espionage group TA419 has launched credential phishing campaigns using Microsoft Account-in-the-Middle (AitM) tactics against U.S. AI policy experts at think tanks, universities, and legal organizations. They impersonate notable economists and Anthropic employees to gain access to sensitive AI research and policy information.
Source: The Hacker News
UAC-0099 Deploys ASHVEIN RAT Targeting Ukrainian Government Staff
The Russia-aligned threat actor UAC-0099 is using a new .NET infostealer and RAT named ASHVEIN in attacks against Ukrainian government personnel, hiding commands within HTML. TrendAI tracks this cluster as Earth Sirrush, highlighting an evolving state-sponsored cyber espionage campaign.
Source: The Hacker News
Chinese State-linked Hackers Use Automated Tools and Manual Exploits to Steal Data
Chinese government-linked threat actors, enabled by Integrity Technology Group, utilize automated scanning, botnets, and manual exploitation to breach global targets including US critical infrastructure. They exploit Microsoft Exchange vulnerabilities and maintain persistence via VPN software to exfiltrate sensitive emails and credentials.
Source: CISA
Realtek Jungle SDK Exploit Attempts Spread Cling Botnet via STUN C2
Threat actors are exploiting a patched critical flaw in the Realtek Jungle SDK to deploy the Cling botnet, which uses STUN protocol for command-and-control communication. This novel use of ordinary STUN behavior for C2 channels marks a notable evolution in malware tactics.
Source: The Hacker News
Linux Backdoors Evade Detection by Mimicking Email Security Tools in Asia
Linux backdoors targeting telecom and network devices in South Korea and Taiwan disguise their traffic as email services and legitimate processes to avoid detection. Threat actors use real operating system component names to blend their malicious activity into normal system operations.
Source: The Hacker News
PoeLLM Malware Infects Over 3,400 Servers to Expand Crypto Mining Botnet
The PoeLLM malware family targets exposed AI and large language model infrastructure to deploy cryptocurrency miners, expanding the Canto Incognito botnet. Over 3,400 servers have been compromised in this financially motivated campaign.
Source: The Hacker News
Eight Malicious npm Packages Delivered Overlord RAT and Stealer
Researchers uncovered 12 malicious npm packages, eight delivering Overlord RAT and stealers, downloaded over 40,000 times since August 2023. The MALFEX campaign is attributed to a likely lone threat actor targeting npm users.
Source: The Hacker News
FakeGit Malware Campaign Relaunches with Over 17,600 Malicious GitHub Repos
The FakeGit malware campaign has returned with 17,610 fake GitHub repositories distributing SmartLoader malware and the StealC infostealer. This surge continues to threaten developers and security teams monitoring open-source platforms.
Source: BleepingComputer
Hackers Use Google Ads and Bing Redirects to Spread Claude ClickFix Malware
Attackers exploit legitimate Bing search-result redirects in Google search ads to deliver fake Claude installers, leading to ClickFix malware infections. This method leverages trusted platforms to trick users into downloading malicious software.
Source: BleepingComputer
Credential-Stealing GitHub Actions Workflows Found in Thousands of Repos
Attackers compromised accounts of prominent open-source maintainers to plant malicious GitHub Actions workflows that steal credentials, affecting over 340 repositories. The campaign began with the account of Takashi Kitao, author of the popular pyxel game engine.
Source: The Hacker News
Danish University DTU Data Breach Exposes Up to 200,000 Users
The Technical University of Denmark experienced a breach where hackers accessed its identity and access management system, potentially exposing data of up to 200,000 users. The incident highlights risks to institutional IT security and sensitive personal information.
Source: BleepingComputer
Denmark's Population Registry Data Breach Affects 8.8 Million People
Denmark's Central Population Register suffered a data breach exposing personal information of approximately 8.8 million individuals. The breach raises serious privacy and security concerns given the scale and sensitivity of the data involved.
Source: BleepingComputer
ASOS confirms data breach after hacked in-app notifications
UK fashion retailer ASOS confirmed a data breach after hackers sent unauthorized push notifications via its mobile app, claiming to have accessed customer data stored in its Snowflake environment.
Source: BleepingComputer
Hackers Hijack Google Domains via ccTLD Registry Breaches
Hackers compromised third-party operators managing ccTLD registries for Ghana, American Samoa, and Sierra Leone, obtaining unauthorized HTTPS certificates and hijacking several Google domains. This attack involved modification of authoritative DNS records, posing significant risks to domain integrity and trust.
Source: BleepingComputer
Anthropic Launches Free AI Vulnerability Scanner for Open-Source
Anthropic has introduced OSS Scanner, an AI-powered vulnerability scanner for open-source projects. The opt-in service provides regular, thorough security scans using advanced AI at no cost.
Source: The Hacker News
Phishing Platform Targets Credentials via Fake AI Chatbot Ad Portals
Researchers uncovered a human-operated phishing platform impersonating AI chatbot ad portals for Google Gemini, ChatGPT, Claude, and others to steal credentials and MFA codes. These fake portals claim to offer campaign optimization and account management services but aim to capture sensitive user data.
Source: The Hacker News
Chapters
- Opening
- New NetScaler Zero-Day Targeted Attacks Can Disrupt SAML Deployments
- Max severity SonicWall SMA1000 flaw now exploited in attacks
- Cisco warns of critical flaws allowing Nexus switch takeover
- Realtek Jungle SDK Exploit Attempts Spread Cling Botnet via STUN C2
- Danish University DTU Data Breach Exposes Up to 200,000 Users
- Denmark's Population Registry Data Breach Affects 8.8 Million People
- ASOS confirms data breach after hacked in-app notifications
- Hackers Hijack Google Domains via ccTLD Registry Breaches
- China-Aligned TA419 Targets U.S. AI Policy Experts with Microsoft AitM Phishing
- Phishing Platform Targets Credentials via Fake AI Chatbot Ad Portals
- Hackers Use Google Ads and Bing Redirects to Spread Claude ClickFix Malware
- Linux Backdoors Evade Detection by Mimicking Email Security Tools in Asia
- UAC-0099 Deploys ASHVEIN RAT Targeting Ukrainian Government Staff
- Chinese State-linked Hackers Use Automated Tools and Manual Exploits to Steal Data
- Eight Malicious npm Packages Delivered Overlord RAT and Stealer
- FakeGit Malware Campaign Relaunches with Over 17,600 Malicious GitHub Repos
- Credential-Stealing GitHub Actions Workflows Found in Thousands of Repos
- Critical File-Access Flaw Found in Atlassian Jira and Confluence
- Anthropic Launches Free AI Vulnerability Scanner for Open-Source
- Critical Dell System Update Vulnerability Allows Root Privilege Escalation
- Critical Buffer Overflow Found in Savannah lwIP SMTP Client v2.2.1
- Critical Vulnerabilities Found in Grid Protection Alliance openPDC and openHistorian
- Critical LMCache Flaw Allows Unauthenticated Remote Code Execution
- PoeLLM Malware Infects Over 3,400 Servers to Expand Crypto Mining Botnet
- Closing