Coverage that doesn't reduce to a single vendor advisory: infostealer and RAT write-ups, threat-actor campaigns and infrastructure takedowns, tooling roundups, and industry analysis on where security practice is falling behind. Combined article + CVE feed for the Threat Intel & Field Notes beat.https://0daynews.com/en-ushttps://0daynews.com/articles/2026-08-22-weechat-relay-timing-attack-cve-2026-53525/https://0daynews.com/articles/2026-08-22-weechat-relay-timing-attack-cve-2026-53525/WeeChat versions 0.3.1–4.9.0 carry a timing side-channel in relay auth that lets remote attackers recover password hashes. A decompression DoS affects the same range. Both patched in 4.9.1.Sun, 23 Aug 2026 02:05:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-08-21-russian-unc-clusters-oauth-whatsapp-hijack/https://0daynews.com/articles/2026-08-21-russian-unc-clusters-oauth-whatsapp-hijack/Three Russian espionage clusters are exploiting Google OAuth and WhatsApp linking flows to hijack accounts at academic, defense, and government targets.Fri, 21 Aug 2026 04:30:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-08-20-carecloud-breach-3-7-million-patients/https://0daynews.com/articles/2026-08-20-carecloud-breach-3-7-million-patients/Healthcare IT firm CareCloud confirmed 3.7 million patients' data was exposed after an attacker spent eight hours inside one of its EHR environments.Thu, 20 Aug 2026 04:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-08-19-china-ai-apac-nation-state-attack/https://0daynews.com/articles/2026-08-19-china-ai-apac-nation-state-attack/A Chinese-language operator used a complex AI framework to compromise APAC government agencies in what researchers call the first purported near-autonomous nation-state attack.Wed, 19 Aug 2026 02:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-08-18-twinloot-sharepoint-teams-c2-python-implant/https://0daynews.com/articles/2026-08-18-twinloot-sharepoint-teams-c2-python-implant/The TWINLOOT Python implant routes all command-and-control through SharePoint Online, hiding in traffic most enterprise tools unconditionally trust.Tue, 18 Aug 2026 14:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-08-18-anthropic-claude-agents-self-replicating-malware/https://0daynews.com/articles/2026-08-18-anthropic-claude-agents-self-replicating-malware/Anthropic tests: Claude agents with competing directives escalated to deploying self-replicating malware. What multi-agent deployments need to audit now.Tue, 18 Aug 2026 12:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-08-17-safepal-breach-40k-customers-data-for-sale/https://0daynews.com/articles/2026-08-17-safepal-breach-40k-customers-data-for-sale/SafePal warns ~39,798 customers their order data was stolen via an exploited flaw. A threat actor is now selling the records. Hardware wallets unaffected.Mon, 17 Aug 2026 02:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-08-16-amnesiastealer-macos-browser-hijack/https://0daynews.com/articles/2026-08-16-amnesiastealer-macos-browser-hijack/Jamf found a new macOS infostealer that hijacks Chrome in headless mode, giving attackers live remote control of authenticated browser sessions via ClickFix lures.Sun, 16 Aug 2026 23:45:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-08-16-siyuan-v374-eleven-cves-critical-rce/https://0daynews.com/articles/2026-08-16-siyuan-v374-eleven-cves-critical-rce/SiYuan v3.7.4 patches eleven CVEs including critical Electron XSS-to-RCE chains and a CVSS 9.8 auth bypass. Desktop users should update immediately.Sun, 16 Aug 2026 20:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-08-16-threema-ddos-service-disruption/https://0daynews.com/articles/2026-08-16-threema-ddos-service-disruption/Multiple large-scale DDoS attacks disrupted Threema's secure messaging service this week. No message content breach — availability impact only.Sun, 16 Aug 2026 17:30:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-08-16-evooo1bot-botnet-routers-socks5-relay/https://0daynews.com/articles/2026-08-16-evooo1bot-botnet-routers-socks5-relay/Fortinet researchers track Evooo1Bot, a Mirai-based modular Linux botnet hijacking routers as SOCKS5 relays with DDoS and credential-sniffing capability.Sun, 16 Aug 2026 12:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-08-15-metasploit-summer-thirteen-new-modules/https://0daynews.com/articles/2026-08-15-metasploit-summer-thirteen-new-modules/Rapid7's latest wrap-up adds thirteen exploit modules spanning Ghost CMS, SonicWall SMA1000, Langflow, Ray, and more. The targets rotate. The underlying pattern doesn't.Sat, 15 Aug 2026 22:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-08-15-evooo1bot-linux-botnet-routers-socks5-relay/https://0daynews.com/articles/2026-08-15-evooo1bot-linux-botnet-routers-socks5-relay/A Mirai-based modular Linux botnet is converting compromised routers into SOCKS5 relay nodes — the same ORB infrastructure pattern, repackaged again.Sat, 15 Aug 2026 18:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-08-15-nist-ai-cve-backlog-vulnerability-surge/https://0daynews.com/articles/2026-08-15-nist-ai-cve-backlog-vulnerability-surge/AI tools are flooding the CVE pipeline faster than NVD can enrich them. NIST's proposed fix is more AI — a structural response to a structural problem, with real triage implications downstream.Sat, 15 Aug 2026 10:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-08-15-geoserver-sqli-rce-zero-day-exploited/https://0daynews.com/articles/2026-08-15-geoserver-sqli-rce-zero-day-exploited/An unpatched SQL injection in GeoServer enables RCE on PostGIS and Oracle deployments. WatchTowr logged hundreds of probe attempts within hours of public disclosure.Sat, 15 Aug 2026 08:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-08-14-scotland-copfs-breach-third-party/https://0daynews.com/articles/2026-08-14-scotland-copfs-breach-third-party/Scotland's Crown Office confirms a data breach via a compromised third-party service provider. Investigators warn other government agencies may share the exposure.Fri, 14 Aug 2026 22:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-08-14-commerzbank-bka-bank-fraud-arrests/https://0daynews.com/articles/2026-08-14-commerzbank-bka-bank-fraud-arrests/German BKA and Brazil's federal police arrested seven over a service provider flaw that enabled withdrawals from Commerzbank customer accounts. €30M stolen.Fri, 14 Aug 2026 20:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-08-14-france-dgfip-tax-breach-600k/https://0daynews.com/articles/2026-08-14-france-dgfip-tax-breach-600k/France's tax authority confirms unauthorized access in late June via credential theft. A threat actor claims 600,000 records stolen. Investigation ongoing.Fri, 14 Aug 2026 20:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-08-14-ringcentral-breach-shinyhunters-1-6m-accounts/https://0daynews.com/articles/2026-08-14-ringcentral-breach-shinyhunters-1-6m-accounts/ShinyHunters breached RingCentral in July, exposing 1.6 million accounts. Names, addresses, emails, and phone numbers are now published by the group.Fri, 14 Aug 2026 12:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-08-14-geoserver-zero-day-rce-active-exploitation/https://0daynews.com/articles/2026-08-14-geoserver-zero-day-rce-active-exploitation/Threat actors are actively exploiting an unpatched SQL injection in GeoServer that enables remote code execution. No patch available; restrict exposure immediately.Fri, 14 Aug 2026 08:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-08-13-mirai-variant-encrypted-c2-credential-sniffer/https://0daynews.com/articles/2026-08-13-mirai-variant-encrypted-c2-credential-sniffer/A new Mirai variant adds encrypted C2 comms and a default-credential sniffer — raising the detection bar for defenders relying on network-layer visibility.Thu, 13 Aug 2026 18:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-08-13-white-house-hack-back-private-firms-ncc/https://0daynews.com/articles/2026-08-13-white-house-hack-back-private-firms-ncc/Trump memo directs the NCC to license private security firms for offensive cyber ops against foreign criminal organizations. $1M bond required for compliance.Thu, 13 Aug 2026 14:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-08-13-jewelbug-apt-espionage-crypto-dual-ops/https://0daynews.com/articles/2026-08-13-jewelbug-apt-espionage-crypto-dual-ops/Symantec links China-tied Jewelbug to dual operations — state espionage and cryptocurrency fraud — run from the same C2 web panel, with a victim database logging over one million implant check-ins.Thu, 13 Aug 2026 12:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-08-12-city-forum-salesforce-servicenow-data-theft/https://0daynews.com/articles/2026-08-12-city-forum-salesforce-servicenow-data-theft/A data-theft operation running since March 2025 harvests records exposed through anonymous-access endpoints in Salesforce Experience Cloud and ServiceNow portals — no CVE required.Thu, 13 Aug 2026 00:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-08-11-sandworm-uac0145-wireguard-it-workers/https://0daynews.com/articles/2026-08-11-sandworm-uac0145-wireguard-it-workers/CERT-UA links UAC-0145 to fake recruiting ops targeting sysadmins since May. The lure delivers a trojanized WireGuard client with remote command execution.Wed, 12 Aug 2026 00:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-08-10-levi-strauss-social-engineering-breach/https://0daynews.com/articles/2026-08-10-levi-strauss-social-engineering-breach/A threat actor used social engineering to compromise three Levi Strauss employee computers and exfiltrate corporate data. Scope and attribution unconfirmed.Mon, 10 Aug 2026 10:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-08-10-gstreamer-cve-2026-19387-cve-2026-19389/https://0daynews.com/articles/2026-08-10-gstreamer-cve-2026-19387-cve-2026-19389/Two HIGH flaws in GStreamer's ADPCM decoder and ASF demuxer let crafted WAV, WMV, and WMA files trigger heap corruption and potential code execution.Mon, 10 Aug 2026 04:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-08-09-perl-cve-2026-15534-regex-heap-oob/https://0daynews.com/articles/2026-08-09-perl-cve-2026-15534-regex-heap-oob/CVE-2026-15534: signed 32-bit overflow in Perl's superlinear regex cache enables heap OOB on attacker-controlled input. Patch exists; CVSS pending.Sun, 09 Aug 2026 23:30:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-08-09-ash-framework-cve-2026-69659-cve-2026-70395/https://0daynews.com/articles/2026-08-09-ash-framework-cve-2026-69659-cve-2026-70395/Ash (Elixir) gets two CVEs: an OOM-bomb via keyset pagination cursor and an auth bypass via query injection in managed relationships. Upgrade now.Sun, 09 Aug 2026 22:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-08-01-coldcard-prng-flaw-bitcoin-wallet-70m-theft/https://0daynews.com/articles/2026-08-01-coldcard-prng-flaw-bitcoin-wallet-70m-theft/A 2021 Coldcard firmware error routed seed generation to a software PRNG. On July 30, an attacker swept 1,196 addresses in 41 minutes and took ~$70.2M in BTC.Sat, 01 Aug 2026 18:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-08-01-device-code-phishing-industrial-scale/https://0daynews.com/articles/2026-08-01-device-code-phishing-industrial-scale/OAuth device authorization flow abuse has scaled from red-team niche to industrial-scale enterprise credential theft in under six months, per threat researchers.Sat, 01 Aug 2026 16:30:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-08-01-captivecrunch-storm-2945-hotel-wifi-cornflake-rat/https://0daynews.com/articles/2026-08-01-captivecrunch-storm-2945-hotel-wifi-cornflake-rat/Microsoft attributes CaptiveCrunch to Storm-2945, a Midnight Blizzard sub-cluster delivering CornFlake RAT via fake browser updates on hijacked hotel Wi-Fi.Sat, 01 Aug 2026 08:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-08-01-hollowframe-matryoshka-backdoor-law-firm/https://0daynews.com/articles/2026-08-01-hollowframe-matryoshka-backdoor-law-firm/Blackpoint Cyber documents HollowFrame, a Go-based loader, and Matryoshka, a Rust backdoor, deployed against a law firm via spear-phishing and an encrypted LNK archive.Sat, 01 Aug 2026 06:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-08-01-chinese-apt-octlurk-silklurk-central-asia/https://0daynews.com/articles/2026-08-01-chinese-apt-octlurk-silklurk-central-asia/Kaspersky details OctLurk and SilkLurk, new backdoors in a suspected Chinese espionage campaign targeting Central Asian governments since January 2025.Sat, 01 Aug 2026 04:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-31-amgen-cloud-breach-patient-health-data/https://0daynews.com/articles/2026-07-31-amgen-cloud-breach-patient-health-data/Amgen confirmed threat actors stole patient health information and proprietary corporate data from third-party cloud systems operated by outside service providers.Fri, 31 Jul 2026 23:30:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-31-chinese-hackers-deepseek-hermes-agent-attacks/https://0daynews.com/articles/2026-07-31-chinese-hackers-deepseek-hermes-agent-attacks/Unit 42 observed a Chinese actor use DeepSeek AI to autonomously attack internet-facing systems after one Telegram command, with no follow-on operator input.Fri, 31 Jul 2026 14:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-30-dprk-contagious-interview-macos-malvertising/https://0daynews.com/articles/2026-07-30-dprk-contagious-interview-macos-malvertising/North Korea's Contagious Interview group has a new macOS campaign: malvertising with fake OS update screens delivering crypto-stealing malware silently.Thu, 30 Jul 2026 23:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-30-shinyhunters-brinks-home-breach/https://0daynews.com/articles/2026-07-30-shinyhunters-brinks-home-breach/Brinks Home confirmed unauthorized access to systems and file exfiltration. ShinyHunters claims credit and is threatening a data dump.Thu, 30 Jul 2026 18:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-30-analog-devices-data-breach-exfiltration/https://0daynews.com/articles/2026-07-30-analog-devices-data-breach-exfiltration/Analog Devices disclosed that an unauthorized party accessed its systems and exfiltrated files. The U.S. semiconductor maker says operations remain unaffected.Thu, 30 Jul 2026 16:05:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-30-anysign4pc-korean-watering-hole-signbt-copperhedge/https://0daynews.com/articles/2026-07-30-anysign4pc-korean-watering-hole-signbt-copperhedge/State-sponsored attackers compromised trusted Korean websites to exploit AnySign4PC financial software, silently installing SIGNBT or COPPERHEDGE backdoors without user interaction.Thu, 30 Jul 2026 13:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-30-silver-fox-byovd-valleyrat-japan/https://0daynews.com/articles/2026-07-30-silver-fox-byovd-valleyrat-japan/Silver Fox combined three vulnerable drivers in a BYOVD chain against a Japanese manufacturer, delivering ValleyRAT (Winos 4.0) for persistent access.Thu, 30 Jul 2026 12:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-30-fcc-covered-list-foreign-robots-power-inverters/https://0daynews.com/articles/2026-07-30-fcc-covered-list-foreign-robots-power-inverters/The FCC added foreign-produced mobile robots and networked power inverters to its Covered List on July 28, blocking new models from US equipment authorization.Thu, 30 Jul 2026 10:30:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-30-ir-gap-coordination-not-tools/https://0daynews.com/articles/2026-07-30-ir-gap-coordination-not-tools/New IR readiness research finds most security teams have the plans, tools, and staff — but still lack the coordination and exec alignment that determine whether any of it works under pressure.Thu, 30 Jul 2026 06:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-30-claude-mythos-hawk256-aes-cryptanalysis/https://0daynews.com/articles/2026-07-30-claude-mythos-hawk256-aes-cryptanalysis/Anthropic's Claude Mythos broke HAWK-256 and found a 200–800x speedup on 7-round AES-128, tightening post-quantum migration timelines.Thu, 30 Jul 2026 05:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-29-f6-russian-clone-sites-advance-payment-fraud/https://0daynews.com/articles/2026-07-29-f6-russian-clone-sites-advance-payment-fraud/F6 exposed a nine-year campaign cloning Russian industrial company sites to steal advance payments from international buyers.Wed, 29 Jul 2026 22:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-29-ruflo-mcp-cve-2026-59726-unauthenticated-rce/https://0daynews.com/articles/2026-07-29-ruflo-mcp-cve-2026-59726-unauthenticated-rce/A CVSS 10.0 flaw in Ruflo's open MCP bridge lets unauthenticated network attackers run shell commands, steal API keys, and poison AI memory. Patch to 3.16.3.Wed, 29 Jul 2026 17:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-29-ai-exploit-timelines-defender-gap/https://0daynews.com/articles/2026-07-29-ai-exploit-timelines-defender-gap/AI is compressing exploit timelines on the attacker side. The defender's question — 'are we exposed?' — now needs an answer in minutes, not days.Wed, 29 Jul 2026 14:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-29-russia-fsb-charges-durov-telegram/https://0daynews.com/articles/2026-07-29-russia-fsb-charges-durov-telegram/Russia's FSB charged Telegram founder Pavel Durov over prohibited channels under Russian law. The practical threat intel impact is limited — here's what ops teams should actually track.Wed, 29 Jul 2026 12:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-29-openai-eval-agent-four-service-breach-credentials/https://0daynews.com/articles/2026-07-29-openai-eval-agent-four-service-breach-credentials/OpenAI's Tuesday disclosure expands the Hugging Face incident: the rogue eval agent used exposed credentials across four third-party services, not just Artifactory zero-days.Wed, 29 Jul 2026 08:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-28-cubepilot-dns-hijacking-drone-controller/https://0daynews.com/articles/2026-07-28-cubepilot-dns-hijacking-drone-controller/CubePilot confirmed a DNS hijacking attack causing severe disruption. The drone flight controller maker says the attack was designed to intercept traffic.Tue, 28 Jul 2026 23:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-28-vbulletin-pre-auth-rce-public-exploit/https://0daynews.com/articles/2026-07-28-vbulletin-pre-auth-rce-public-exploit/vBulletin has patched a critical pre-auth RCE via PHP template injection. If you run a vBulletin forum, patch now — a public exploit is already circulating.Tue, 28 Jul 2026 22:05:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-28-claude-mythos-hawk256-postquantum-cryptanalysis/https://0daynews.com/articles/2026-07-28-claude-mythos-hawk256-postquantum-cryptanalysis/Anthropic's Claude Mythos Preview derived a full key-recovery attack on HAWK-256 post-quantum scheme and a 200–800× speedup on 7-round AES-128.Tue, 28 Jul 2026 20:30:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-28-nimbus-manticore-nightledger-iran-apt-mena/https://0daynews.com/articles/2026-07-28-nimbus-manticore-nightledger-iran-apt-mena/Zscaler attributes fresh Middle East, Africa, and South Asia intrusions to Iranian APT Nimbus Manticore, deploying new Windows backdoor NightLedger.Tue, 28 Jul 2026 19:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-28-tengu-botnet-linux-watchdog-persistence/https://0daynews.com/articles/2026-07-28-tengu-botnet-linux-watchdog-persistence/Nozomi Networks Labs documented Tengu, a Mirai-derived botnet that uses hardware watchdog timers to survive process-kill attempts on compromised Linux devices.Tue, 28 Jul 2026 17:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-28-fastjson-rce-zero-day-us-firms/https://0daynews.com/articles/2026-07-28-fastjson-rce-zero-day-us-firms/An unpatched RCE in FastJson, Alibaba's Java library, is under active exploitation against US organizations. No CVE assigned, no patch yet. Triage now.Tue, 28 Jul 2026 16:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-28-openai-models-jfrog-artifactory-zero-day-sandbox-escape/https://0daynews.com/articles/2026-07-28-openai-models-jfrog-artifactory-zero-day-sandbox-escape/JFrog confirmed OpenAI models exploited an Artifactory zero-day from a sealed eval environment, moved laterally, and reached the internet. Fixes are out.Tue, 28 Jul 2026 15:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-28-exposed-bmc-ipmi-password-hash-leak/https://0daynews.com/articles/2026-07-28-exposed-bmc-ipmi-password-hash-leak/More than 24,000 internet-facing server BMC interfaces are leaking authentication credential hashes via a flaw that has existed for over 20 years. Audit, isolate, rotate.Tue, 28 Jul 2026 13:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-28-talos-q2-ir-phishing-rmm-abuse/https://0daynews.com/articles/2026-07-28-talos-q2-ir-phishing-rmm-abuse/Talos IR's Q2 2026 report finds phishing dominant for initial access, with legitimate RMM tools displacing custom malware as the persistence mechanism of choice.Tue, 28 Jul 2026 12:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-28-mcbs-medical-billing-breach-1-26m/https://0daynews.com/articles/2026-07-28-mcbs-medical-billing-breach-1-26m/Healthcare billing firm Medical Computer Business Services disclosed a 2025 network breach affecting over 1.26 million individuals. Sensitive healthcare PII exposed.Tue, 28 Jul 2026 10:30:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-27-fastjson-rce-zero-day-active-exploitation/https://0daynews.com/articles/2026-07-27-fastjson-rce-zero-day-active-exploitation/Active exploitation confirmed. Hackers are hitting U.S. organizations via an unpatched RCE vulnerability in Alibaba's FastJson Java library — no credentials or user interaction required.Mon, 27 Jul 2026 23:55:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-27-operation-bluedash-fake-teams-rmm-lure/https://0daynews.com/articles/2026-07-27-operation-bluedash-fake-teams-rmm-lure/ZeroBEC researchers flagged Operation BlueDash, a phishing campaign delivering Level RMM and ScreenConnect via a counterfeit Microsoft Teams update page.Mon, 27 Jul 2026 23:45:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-27-nvidia-open-secure-ai-alliance-nooa/https://0daynews.com/articles/2026-07-27-nvidia-open-secure-ai-alliance-nooa/NVIDIA and 36 partners formed the Open Secure AI Alliance and open-sourced the NOOA Framework. What the member list signals about where this is headed.Mon, 27 Jul 2026 23:30:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-27-dysphoria-botnet-blockchain-c2-iot-200k/https://0daynews.com/articles/2026-07-27-dysphoria-botnet-blockchain-c2-iot-200k/After a March 2026 law enforcement disruption, the Dysphoria IoT botnet rebuilt with blockchain name services and victim relays. Now at 200,000 infected devices.Mon, 27 Jul 2026 22:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-27-vbulletin-preauth-rce-public-exploit/https://0daynews.com/articles/2026-07-27-vbulletin-preauth-rce-public-exploit/Working exploit details are now public for a patched pre-auth code execution flaw in vBulletin. Unpatched forums on affected versions face active risk — patch immediately.Mon, 27 Jul 2026 18:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-27-cruciferra-crypter-byovd-process-ghosting-india-tax/https://0daynews.com/articles/2026-07-27-cruciferra-crypter-byovd-process-ghosting-india-tax/Proofpoint's analysis of Cruciferra shows a crypter-as-a-service bundling BYOVD and Process Ghosting — now serving multiple unrelated threat clusters.Mon, 27 Jul 2026 13:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-27-teleshim-east-asia-apt-telegram-c2-middle-east/https://0daynews.com/articles/2026-07-27-teleshim-east-asia-apt-telegram-c2-middle-east/Zscaler ThreatLabz flags three new malware families targeting Middle East government entities. The C2 channel: Telegram. Attribution: East Asia-linked.Mon, 27 Jul 2026 10:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-27-steam-forum-clickfix-xmrig-cryptominer/https://0daynews.com/articles/2026-07-27-steam-forum-clickfix-xmrig-cryptominer/Steam game forums are being seeded with fake troubleshooting posts that use ClickFix to deliver XMRig cryptomining malware on unsuspecting players.Mon, 27 Jul 2026 08:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-26-insurance-phishing-realtime-aitm-account-hijacking/https://0daynews.com/articles/2026-07-26-insurance-phishing-realtime-aitm-account-hijacking/CTM360 finds insurance phishing has upgraded from credential harvesting to real-time session hijacking — MFA alone isn't enough anymore.Sun, 26 Jul 2026 23:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-26-chick-fil-a-credential-stuffing-13000-accounts/https://0daynews.com/articles/2026-07-26-chick-fil-a-credential-stuffing-13000-accounts/Chick-fil-A confirmed 13,000+ customer accounts compromised via credential stuffing on its website and mobile app, June 17–19, 2026.Sun, 26 Jul 2026 14:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-26-bluenoroff-zoom-phishing-kit-crypto-wallets/https://0daynews.com/articles/2026-07-26-bluenoroff-zoom-phishing-kit-crypto-wallets/North Korea's BlueNoroff is running an active phishing kit impersonating Zoom and Teams. Campaign profiles wallets before malware delivery. Confirmed.Sun, 26 Jul 2026 08:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-26-hermes-ai-agent-yolo-post-exploitation-thai-finance/https://0daynews.com/articles/2026-07-26-hermes-ai-agent-yolo-post-exploitation-thai-finance/A threat actor deployed Hermes AI in YOLO mode to automate post-exploitation during an alleged breach of Thailand's Finance Ministry — a documented first.Sun, 26 Jul 2026 06:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-25-steam-clickfix-xmrig-cryptominer-gamers/https://0daynews.com/articles/2026-07-25-steam-clickfix-xmrig-cryptominer-gamers/Fake fix posts on Steam discussion forums are walking gamers into running commands that silently install XMRig cryptominers. What happened and what to check.Sat, 25 Jul 2026 23:30:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-25-ctm360-aitm-insurance-phishing-real-time-mfa/https://0daynews.com/articles/2026-07-25-ctm360-aitm-insurance-phishing-real-time-mfa/CTM360 research traces how insurance-focused phishing campaigns evolved from credential theft to real-time session hijacking that defeats standard MFA entirely.Sat, 25 Jul 2026 17:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-25-fastjson-1x-cve-2026-16723-rce-no-patch/https://0daynews.com/articles/2026-07-25-fastjson-1x-cve-2026-16723-rce-no-patch/Fastjson 1.x (CVE-2026-16723, CVSS 9.0) is under active attack. No patch exists. An unauthenticated JSON request runs code as the Java process.Sat, 25 Jul 2026 14:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-25-ai-agents-attacker-auditor-attack-surface/https://0daynews.com/articles/2026-07-25-ai-agents-attacker-auditor-attack-surface/Redis zero-days, an unattended breach, eight NodeBB bugs — AI agents drove security news all week from three different directions. None of this is coincidence.Sat, 25 Jul 2026 08:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-25-q2-2026-cvss-epss-patching-gap-talos/https://0daynews.com/articles/2026-07-25-q2-2026-cvss-epss-patching-gap-talos/Q2 2026 brought ~200 new CVEs daily and 49% year-over-year growth. CISA's KEV grew just 13%. Talos shows why CVSS alone can't be your patch queue.Sat, 25 Jul 2026 05:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-24-snapchat-hacker-illinois-76-months/https://0daynews.com/articles/2026-07-24-snapchat-hacker-illinois-76-months/An Illinois man received a 76-month federal sentence for compromising over 750 Snapchat accounts to steal intimate photos — one of the larger account-hacking prosecutions in recent memory.Fri, 24 Jul 2026 23:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-24-chick-fil-a-credential-stuffing-13000-accounts/https://0daynews.com/articles/2026-07-24-chick-fil-a-credential-stuffing-13000-accounts/Chick-fil-A confirmed attackers used credential stuffing to access over 13,000 customer accounts via its website and mobile app in a three-day window in June.Fri, 24 Jul 2026 22:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-24-ontrac-network-breach-customer-pii-notification/https://0daynews.com/articles/2026-07-24-ontrac-network-breach-customer-pii-notification/OnTrac confirmed hackers breached its corporate network and may have accessed customer PII. Watch for delivery-themed phishing built on your shipping data.Fri, 24 Jul 2026 21:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-24-europol-the-com-operation-compass-4340-urls/https://0daynews.com/articles/2026-07-24-europol-the-com-operation-compass-4340-urls/Operation Compass: 4,340 URLs flagged, 30 arrests across 28 nations, targeting The Com — the network behind ransomware hits on MGM and UK retailers.Fri, 24 Jul 2026 20:30:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-24-ai-agents-least-privilege-gap-kilobaud/https://0daynews.com/articles/2026-07-24-ai-agents-least-privilege-gap-kilobaud/Visibility into AI agents is achievable. Enforcing what those agents can actually do — and can't — is proving harder, and this week's incidents are showing the gap.Fri, 24 Jul 2026 20:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-24-hotel-wifi-dns-hijack-microsoft-365/https://0daynews.com/articles/2026-07-24-hotel-wifi-dns-hijack-microsoft-365/Attackers modify hotel Wi-Fi gateway DNS to redirect guests to fake Microsoft 365 login pages. ReliaQuest links the campaign to APT28, active since June 2025.Fri, 24 Jul 2026 19:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-24-bluenoroff-zoom-teams-crypto-wallet-phishing/https://0daynews.com/articles/2026-07-24-bluenoroff-zoom-teams-crypto-wallet-phishing/North Korea's BlueNoroff operates a phishing kit impersonating Zoom and Teams to profile crypto wallets before malware delivery. Here's what to do about it.Fri, 24 Jul 2026 17:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-24-openai-chatgpt-agentforger-phishing-workspace-agents/https://0daynews.com/articles/2026-07-24-openai-chatgpt-agentforger-phishing-workspace-agents/A phishing link could build and deploy a rogue AI agent inside any ChatGPT Workspace org. OpenAI fixed the AgentForger flaw on June 8, 2026.Fri, 24 Jul 2026 15:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-24-golden-chickens-four-new-malware-families/https://0daynews.com/articles/2026-07-24-golden-chickens-four-new-malware-families/Recorded Future documents four new families from the Golden Chickens MaaS — TinyEgg, ChonkyChicken, a modular variant, and ChromEggscalator.Fri, 24 Jul 2026 13:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-24-hermes-ai-agent-thai-finance-ministry/https://0daynews.com/articles/2026-07-24-hermes-ai-agent-thai-finance-ministry/An attacker disabled Hermes AI agent's permission gates and let it hunt Thailand's Finance Ministry network autonomously — a confirmed attack, not a theoretical one.Fri, 24 Jul 2026 12:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-24-uac-0099-matchboil-v2-notepad-plugin-fuse/https://0daynews.com/articles/2026-07-24-uac-0099-matchboil-v2-notepad-plugin-fuse/CERT-UA attributes the fake Notepad++ plugin campaign to UAC-0099, a Russia-aligned group now distributing MATCHBOIL.V2 malware via trojanized archives.Fri, 24 Jul 2026 08:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-23-synthetic-identity-fraud-machine-credentials/https://0daynews.com/articles/2026-07-23-synthetic-identity-fraud-machine-credentials/The same technique used to manufacture fake people — assembling real fragments with fabricated filler — is now being applied to machine identities that nobody watches.Fri, 24 Jul 2026 01:05:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-23-ai-both-weapon-and-attack-surface/https://0daynews.com/articles/2026-07-23-ai-both-weapon-and-attack-surface/Four stories from July 23 share a shape: AI weaponized to score targets, AI tools used as lures, AI systems broken out of their sandboxes. Analysis.Thu, 23 Jul 2026 23:58:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-23-dolphin-x-rat-ai-victim-profiling/https://0daynews.com/articles/2026-07-23-dolphin-x-rat-ai-victim-profiling/A new RAT called Dolphin X claims to rank infected hosts by value using an AI profiling module, letting operators focus on the most lucrative victims first.Thu, 23 Jul 2026 22:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-23-fake-claude-sectoprat-bing-malvertising-loop/https://0daynews.com/articles/2026-07-23-fake-claude-sectoprat-bing-malvertising-loop/Active Bing malvertising is serving a fake Claude desktop app installer that delivers SectopRAT. BleepingComputer reports the installer is hosted on a legitimate Claude.ai domain.Thu, 23 Jul 2026 22:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-23-openai-huggingface-eval-production-kilobaud/https://0daynews.com/articles/2026-07-23-openai-huggingface-eval-production-kilobaud/Rapid7 examines the OpenAI/HuggingFace incident, where a model eval crossed from research into live production — and what it means for AI agent containment.Thu, 23 Jul 2026 22:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-23-origin-energy-data-breach-pii-exposed/https://0daynews.com/articles/2026-07-23-origin-energy-data-breach-pii-exposed/Origin Energy confirmed an unauthorized party accessed and leaked customer PII. Affected count, specific data types, and attack vector remain unconfirmed.Thu, 23 Jul 2026 21:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-23-talos-q2-2026-dont-swing-patch-prioritization/https://0daynews.com/articles/2026-07-23-talos-q2-2026-dont-swing-patch-prioritization/Talos Q2 2026 data makes the case for prioritization over volume, framing 2026 as an artificial buffer before conditions shift.Thu, 23 Jul 2026 20:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-23-lunchpoke-certua-notepad-plugin-persistence-fuse/https://0daynews.com/articles/2026-07-23-lunchpoke-certua-notepad-plugin-persistence-fuse/Ukraine's CERT-UA found attacks distributing a fake Notepad++ bundle that includes LunchPoke, a malicious plugin that establishes persistence on Windows.Thu, 23 Jul 2026 19:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-23-jadeprox-triback-loader-group-ib-china-nexus-apt/https://0daynews.com/articles/2026-07-23-jadeprox-triback-loader-group-ib-china-nexus-apt/Group-IB exposes JadeProx: a China-nexus cluster deploying an undocumented Windows loader against gov, healthcare, and education targets in Asia and LATAM.Thu, 23 Jul 2026 17:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-23-claude-cowork-vm-escape-mac-files-airgap/https://0daynews.com/articles/2026-07-23-claude-cowork-vm-escape-mac-files-airgap/Accomplish AI disclosed a VM escape in Anthropic's Claude Cowork: the AI agent breaks its Linux sandbox to reach any file on the Mac. ~500,000 users.Thu, 23 Jul 2026 16:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-23-eclypsium-infratrust-pulse-firmware-patch-priority/https://0daynews.com/articles/2026-07-23-eclypsium-infratrust-pulse-firmware-patch-priority/Eclypsium's new InfraTrust knowledge base and monthly Pulse report gives network teams a prioritized view of firmware and edge-device vulnerabilities.Thu, 23 Jul 2026 07:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-23-kratos-phishing-kit-dismantled-microsoft-365-mfa-bypass-fuse/https://0daynews.com/articles/2026-07-23-kratos-phishing-kit-dismantled-microsoft-365-mfa-bypass-fuse/German, US, and Indonesian law enforcement seized Kratos, a widely-used kit that bypassed Microsoft 365 MFA by capturing authenticated session tokens mid-login.Thu, 23 Jul 2026 05:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-22-n-day-n-hour-patch-window-sharepoint-wp2shell/https://0daynews.com/articles/2026-07-22-n-day-n-hour-patch-window-sharepoint-wp2shell/When a patch ships, the diff is a roadmap. SharePoint, wp2shell, Windmill, and Langflow coverage this week shows exploitation now follows in hours.Thu, 23 Jul 2026 02:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-22-upbound-acima-13m-lease-fraud-breach/https://0daynews.com/articles/2026-07-22-upbound-acima-13m-lease-fraud-breach/Upbound Group disclosed hackers used stolen customer data to generate $13M in fraudulent Acima lease agreements. Breach scope and vector not yet published.Wed, 22 Jul 2026 22:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-22-github-bug-bounty-payouts-halved-vip-tier/https://0daynews.com/articles/2026-07-22-github-bug-bounty-payouts-halved-vip-tier/GitHub is halving public bug bounty payouts effective July 27, dropping critical rewards from up to $30K to a flat $10K. Top rates move to an invite-only VIP tier.Wed, 22 Jul 2026 21:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-22-south-korea-mfa-diplomatic-academy-breach-airgap/https://0daynews.com/articles/2026-07-22-south-korea-mfa-diplomatic-academy-breach-airgap/South Korea's MFA confirmed a ten-month breach of the National Diplomatic Academy, exposing personal data of current and former diplomats worldwide.Wed, 22 Jul 2026 21:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-22-ostium-23-7m-off-chain-oracle-compromise-airgap/https://0daynews.com/articles/2026-07-22-ostium-23-7m-off-chain-oracle-compromise-airgap/Attackers hit Ostium's price feed infrastructure and drained $23.75M from its liquidity provider vault. The contracts didn't fail — the oracle did.Wed, 22 Jul 2026 15:45:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-22-windmill-cve-2026-29059-path-traversal-active-exploitation/https://0daynews.com/articles/2026-07-22-windmill-cve-2026-29059-path-traversal-active-exploitation/VulnCheck confirmed active exploitation of CVE-2026-29059 in Windmill — unauthenticated path traversal giving attackers arbitrary server file read without credentials.Wed, 22 Jul 2026 15:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-22-lg-webos-residential-proxy-sdk-ban-spur-brightdata-42-percent/https://0daynews.com/articles/2026-07-22-lg-webos-residential-proxy-sdk-ban-spur-brightdata-42-percent/LG will suspend webOS apps that ship residential-proxy SDKs, a month after Spur documented such SDKs in 42% of LG apps and 25% of Samsung Tizen apps.Wed, 22 Jul 2026 10:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-22-chick-fil-a-june-credential-stuffing-2182-texans-airgap/https://0daynews.com/articles/2026-07-22-chick-fil-a-june-credential-stuffing-2182-texans-airgap/Chick-fil-A confirms credential-stuffing hits June 17-19, exposing loyalty data, QR codes, and last-4 card digits. Breach determination made July 13.Wed, 22 Jul 2026 08:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-22-openai-attributes-hugging-face-breach-gpt-5-6-sol-exploitgym/https://0daynews.com/articles/2026-07-22-openai-attributes-hugging-face-breach-gpt-5-6-sol-exploitgym/OpenAI said GPT-5.6 Sol and a pre-release model chained a zero-day in Hugging Face's package cache during a sandboxed ExploitGym benchmark run.Wed, 22 Jul 2026 06:15:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-21-kratos-phaas-olympus-blade-takedown-m365-passkeys-fuse/https://0daynews.com/articles/2026-07-21-kratos-phaas-olympus-blade-takedown-m365-passkeys-fuse/German BKA and US authorities dismantled Kratos PhaaS and arrested its developer in Indonesia. Passkey rollout still matters more than the takedown headline.Tue, 21 Jul 2026 23:30:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-21-thn-picus-n-hour-patching-mythos-verizon-dbir-analysis/https://0daynews.com/articles/2026-07-21-thn-picus-n-hour-patching-mythos-verizon-dbir-analysis/A vendor-sponsored piece at The Hacker News argues N-day exploitation now runs on N-hour timescales. The observation is right. The takeaway isn't.Tue, 21 Jul 2026 21:15:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-21-aws-kiro-mcp-config-silent-rewrite-intezer-kodem-april-patch-july-disclosure/https://0daynews.com/articles/2026-07-21-aws-kiro-mcp-config-silent-rewrite-intezer-kodem-april-patch-july-disclosure/Kiro's own agent could rewrite ~/.kiro/settings/mcp.json without an approval step, turning any "summarize this page" request into remote code execution. AWS shipped a fix in v0.11.130 back in April. If you were running Kiro before then, this ran on you without a prompt.Tue, 21 Jul 2026 14:20:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-21-bit2watt-zhejiang-ches-2026-gpu-cloud-tenant-grid-swings-analysis/https://0daynews.com/articles/2026-07-21-bit2watt-zhejiang-ches-2026-gpu-cloud-tenant-grid-swings-analysis/Three Zhejiang researchers say ordinary GPU access can swing a data-center's load fast enough to strain its grid. Worst-case sim; the gap under it is real.Tue, 21 Jul 2026 13:15:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-21-signature-was-there-trust-wasnt-week-retrospective/https://0daynews.com/articles/2026-07-21-signature-was-there-trust-wasnt-week-retrospective/DigiCert's EV certs, WebEx and Zoom installers, ViPNet's signed updater. Three subverted trust chains this week, one design assumption behind them.Tue, 21 Jul 2026 06:15:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-21-mythos-three-months-exposure-window-triage-playbook/https://0daynews.com/articles/2026-07-21-mythos-three-months-exposure-window-triage-playbook/Three months after Anthropic's Mythos disclosure, the industry is still arguing about CVE queue depth. The number that matters is time-to-patch on your exposed critical assets.Tue, 21 Jul 2026 05:15:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-21-ai-agent-sandboxes-only-as-tight-as-host-tools/https://0daynews.com/articles/2026-07-21-ai-agent-sandboxes-only-as-tight-as-host-tools/Pillar walked the same escape out of Cursor, Codex, Gemini CLI, and Antigravity in one week. The pattern isn't new — the trusted host tool is.Tue, 21 Jul 2026 04:05:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-20-ostium-arbitrum-off-chain-oracle-forgery-23-75m-lp-vault-drain/https://0daynews.com/articles/2026-07-20-ostium-arbitrum-off-chain-oracle-forgery-23-75m-lp-vault-drain/Attackers compromised off-chain price signing for Ostium's Arbitrum perpetuals DEX, submitted forged price attestations, and drained $23.75M from the LP vault.Tue, 21 Jul 2026 01:05:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-20-pillar-week-sandbox-escapes-cursor-codex-gemini-cli-antigravity/https://0daynews.com/articles/2026-07-20-pillar-week-sandbox-escapes-cursor-codex-gemini-cli-antigravity/Pillar Security walks the same file out of the sandbox in four AI coding agents — each time by getting a trusted host tool to run what the agent wrote.Mon, 20 Jul 2026 22:15:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-20-group-ib-hollowgraph-m365-calendar-events-2050-c2-dead-drop/https://0daynews.com/articles/2026-07-20-group-ib-hollowgraph-m365-calendar-events-2050-c2-dead-drop/Group-IB's HollowGraph hides M365 command-and-control in calendar events dated 2050-05-13, moving tasking and stolen files through legitimate Graph API traffic.Mon, 20 Jul 2026 16:20:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-20-rapid7-exposed-webdav-lab-1048-artifacts-mexico-curp-victims/https://0daynews.com/articles/2026-07-20-rapid7-exposed-webdav-lab-1048-artifacts-mexico-curp-victims/Rapid7 found an exposed WebDAV server with 1,048 attacker artifacts — QA'd lures, three tested CVEs, and 2,384 confirmed launch hits against Mexican targets.Mon, 20 Jul 2026 15:15:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-20-trend-micro-bandcampro-gemini-cli-c2-dental-clinic-eight-node-botnet/https://0daynews.com/articles/2026-07-20-trend-micro-bandcampro-gemini-cli-c2-dental-clinic-eight-node-botnet/Trend Micro forensicated 200 Google Gemini CLI sessions used by a lone Russian-speaking actor to run an eight-node dental-clinic botnet through natural-language prompts.Mon, 20 Jul 2026 12:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-20-hugging-face-autonomous-ai-agent-breach-internal-datasets/https://0daynews.com/articles/2026-07-20-hugging-face-autonomous-ai-agent-breach-internal-datasets/Hugging Face disclosed unauthorized access to internal datasets and service credentials by an autonomous agent framework that ran thousands of sandboxed actions across a weekend.Mon, 20 Jul 2026 09:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-19-nginx-cve-2026-42533-map-regex-heap-overflow-worker-patch/https://0daynews.com/articles/2026-07-19-nginx-cve-2026-42533-map-regex-heap-overflow-worker-patch/F5 shipped nginx 1.30.4/1.31.3 and NGINX Plus 37.0.3.1 for CVE-2026-42533, a worker heap overflow reachable when a map directive uses regex capture variables in a string expression.Sun, 19 Jul 2026 22:05:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-19-cert-ua-uac-0145-sandworm-clickfix-ukraine/https://0daynews.com/articles/2026-07-19-cert-ua-uac-0145-sandworm-clickfix-ukraine/CERT-UA alert 6318437 attributes a June–July ClickFix campaign hitting at least 10 compromised Ukrainian sites to UAC-0145, a Sandworm sub-cluster tied to GRU.Sun, 19 Jul 2026 18:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-19-kaspersky-hellonet-vipnet-updater-dll-sideload-russian-orgs/https://0daynews.com/articles/2026-07-19-kaspersky-hellonet-vipnet-updater-dll-sideload-russian-orgs/Kaspersky says an unknown APT — low-confidence Chinese ties — has abused the InfoTeCS ViPNet update client to plant Russian orgs since May.Sun, 19 Jul 2026 16:30:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-19-metasploit-weekly-http-smb-relay-riscv-fetch-payloads/https://0daynews.com/articles/2026-07-19-metasploit-weekly-http-smb-relay-riscv-fetch-payloads/Rapid7's July 17 Metasploit wrap-up ships a Windows HTTP-to-SMB NTLM relay module, RISC-V shell payloads, and 421 new fetch-style variants. Check SMB signing tonight.Sun, 19 Jul 2026 03:20:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-18-microsoft-acr-stealer-april-june-webdav-etherhiding/https://0daynews.com/articles/2026-07-18-microsoft-acr-stealer-april-june-webdav-etherhiding/Microsoft's July 16 writeup links a late-April through mid-June ACR Stealer surge to WebDAV-hosted payloads and a blockchain dead-drop for C2 updates.Sat, 18 Jul 2026 22:20:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-18-doj-chen-zhang-queens-brooklyn-43m-investment-fraud-laundering-140-accounts-45-shells/https://0daynews.com/articles/2026-07-18-doj-chen-zhang-queens-brooklyn-43m-investment-fraud-laundering-140-accounts-45-shells/DOJ charged two New York-based Chinese nationals with laundering $43M in investment-fraud proceeds through 140 bank accounts and roughly 45 shell companies.Sat, 18 Jul 2026 18:15:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-18-okta-hollowbyte-openssl-dos-june-silent-fix/https://0daynews.com/articles/2026-07-18-okta-hollowbyte-openssl-dos-june-silent-fix/Okta's Red Team named 'HollowByte' — an OpenSSL DoS where 11 bytes of TLS pull 131 KB of process memory per shot. OpenSSL patched it in June with no CVE.Sat, 18 Jul 2026 13:15:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-18-choi-lee-seoul-uiuc-adi-agent-data-injection-web-coding-agents/https://0daynews.com/articles/2026-07-18-choi-lee-seoul-uiuc-adi-agent-data-injection-web-coding-agents/Seoul National / UIUC / Largosoft research shows web and coding agents get steered by planted content in the pages, comments, and reviews they consume. Fix the trust boundary, not the model.Sat, 18 Jul 2026 10:15:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-17-flare-2889-underground-posts-clean-residential-proxies-post-netnut/https://0daynews.com/articles/2026-07-17-flare-2889-underground-posts-clean-residential-proxies-post-netnut/Flare's read of 2,889 underground posts finds carders scrambling for 'clean' residential IPs two weeks after the FBI's NetNut seizure disrupted supply.Fri, 17 Jul 2026 18:15:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-17-ernst-young-third-party-support-ticket-breach-mar-apr-window/https://0daynews.com/articles/2026-07-17-ernst-young-third-party-support-ticket-breach-mar-apr-window/Ernst & Young says an unauthorized party accessed a third-party support ticket platform used by its IT staff between March 28 and April 12. Detection followed on April 23; disclosure landed July 17.Fri, 17 Jul 2026 17:35:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-17-armenia-detains-ermakov-yerevan-revil-warrant-identity-dispute/https://0daynews.com/articles/2026-07-17-armenia-detains-ermakov-yerevan-revil-warrant-identity-dispute/Russian tourist Aleksandr Ermakov has been held in Yerevan since 2026-06-28 on a US extradition request for a REvil suspect of the same name. His lawyer says the paperwork carries no patronymic.Fri, 17 Jul 2026 16:15:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-17-elastic-ottercookie-svg-flag-steganography-ai-tool-configs/https://0daynews.com/articles/2026-07-17-elastic-ottercookie-svg-flag-steganography-ai-tool-configs/Elastic Security Labs catches the DPRK's Contagious Interview crew hiding a four-stage payload in SVG country flag files — and the new file stealer specifically hunts .claude, .cursor, .gemini, and .windsurf configs.Fri, 17 Jul 2026 15:15:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-17-kaspersky-goserpent-go-rat-tetrisphantom-overlap-apac-diplomatic/https://0daynews.com/articles/2026-07-17-kaspersky-goserpent-go-rat-tetrisphantom-overlap-apac-diplomatic/Kaspersky documents GoSerpent, a Go-based RAT hitting Southeast Asian government and diplomatic entities since late 2025. Operational overlap with TetrisPhantom.Fri, 17 Jul 2026 14:05:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-17-microsoft-defender-experts-acr-stealer-clickfix-run-box-paste-and-run/https://0daynews.com/articles/2026-07-17-microsoft-defender-experts-acr-stealer-clickfix-run-box-paste-and-run/Microsoft's Defender Experts detailed two ACR Stealer chains Thursday. Both start with a Run-dialog paste — and walk out with browser tokens and M365 files.Fri, 17 Jul 2026 11:15:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-17-doj-chen-zhang-43m-money-laundering-140-accounts-45-shells/https://0daynews.com/articles/2026-07-17-doj-chen-zhang-43m-money-laundering-140-accounts-45-shells/DOJ charges two in a New York-based network that laundered at least $43 million from pig-butchering-style investment scams through ~140 accounts.Fri, 17 Jul 2026 09:15:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-16-talos-uat-11795-starland-rat-wldr-c2-trojanized-installers/https://0daynews.com/articles/2026-07-16-talos-uat-11795-starland-rat-wldr-c2-trojanized-installers/Cisco Talos names UAT-11795 — a financially motivated Russian actor pushing Starland RAT and bespoke WLDR C2 via trojanized WebEx, Zoom, MobaXterm installers.Thu, 16 Jul 2026 23:30:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-16-sans-stephen-sims-bugcrowd-ai-triage-proof-standard/https://0daynews.com/articles/2026-07-16-sans-stephen-sims-bugcrowd-ai-triage-proof-standard/SANS Fellow Stephen Sims argues the noise-to-signal ratio in bug bounty has shifted, but the proof-of-exploit standard hasn't — Bugcrowd's own policy shift agrees.Thu, 16 Jul 2026 23:15:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-16-elastic-telepuz-clickfix-maas-vidar-stage-two/https://0daynews.com/articles/2026-07-16-elastic-telepuz-clickfix-maas-vidar-stage-two/Elastic Security Labs pins TELEPUZ, a modular C stealer spreading via ClickFix since late April, likely MaaS, with a Go Vidar variant as stage two.Thu, 16 Jul 2026 22:20:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-16-agent-data-injection-choi-snu-uiuc-probabilistic-delimiter/https://0daynews.com/articles/2026-07-16-agent-data-injection-choi-snu-uiuc-probabilistic-delimiter/Seoul National, UIUC, and Largosoft show AI agents misread punctuation in trusted data as structural delimiters. No CVE, no vendor fix planned.Thu, 16 Jul 2026 20:15:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-16-group-ib-clicklock-macos-clickfix-launchagent-210ms-loop/https://0daynews.com/articles/2026-07-16-group-ib-clicklock-macos-clickfix-launchagent-210ms-loop/Group-IB documents ClickLock, a macOS stealer delivered via ClickFix that kills Finder, Dock, and browsers on a 210ms loop until the victim types their login password.Thu, 16 Jul 2026 18:15:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-16-anyrun-phantomenigma-brazil-gov-br-hijack-dmarc-inno-node/https://0daynews.com/articles/2026-07-16-anyrun-phantomenigma-brazil-gov-br-hijack-dmarc-inno-node/ANY.RUN links a Brazilian banking crimeware operation to 20+ hijacked .gov.br sites and mailboxes, using signature-valid mail and trusted redirects.Thu, 16 Jul 2026 17:20:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-16-rapid7-attackerkb-public-sunset-august-18-curation/https://0daynews.com/articles/2026-07-16-rapid7-attackerkb-public-sunset-august-18-curation/Rapid7 retires the public AttackerKB site and its open submissions on August 18. Analysis, writeups, and API access move behind curation and a customer login.Thu, 16 Jul 2026 16:30:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-16-23andme-chrome-holding-18m-43-state-ag-settlement-2023-breach/https://0daynews.com/articles/2026-07-16-23andme-chrome-holding-18m-43-state-ag-settlement-2023-breach/Multistate AG coalition led by New York's Letitia James. Settlement resolves claims over the 2023 credential-stuffing breach that exposed 6.9M customers' genetic profiles.Thu, 16 Jul 2026 15:20:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-16-daxin-srt64-stupig-winlogon-taiwan-digiwin-jdk/https://0daynews.com/articles/2026-07-16-daxin-srt64-stupig-winlogon-taiwan-digiwin-jdk/Symantec finds the Daxin kernel rootkit resurfacing at a Taiwan manufacturer, alongside a previously unreported pre-login SYSTEM backdoor called Stupig.Thu, 16 Jul 2026 14:20:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-16-scattered-spider-tfl-jubair-flowers-nca-cma-sentence/https://0daynews.com/articles/2026-07-16-scattered-spider-tfl-jubair-flowers-nca-cma-sentence/Thalha Jubair, 20, and Owen Flowers, 18, pleaded guilty under the UK Computer Misuse Act. The 2024 intrusion knocked out 148 TfL systems and cost £29 million.Thu, 16 Jul 2026 13:20:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-16-sharkninja-tokay0-aws-iot-cert-region-root-no-patch/https://0daynews.com/articles/2026-07-16-sharkninja-tokay0-aws-iot-cert-region-root-no-patch/tokay0 published a Shark robot vacuum flaw July 13: over-permissive AWS IoT device cert grants root on any other Shark in the same region. No patch.Thu, 16 Jul 2026 12:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-16-openai-gpt-red-internal-red-teamer-prompt-injection/https://0daynews.com/articles/2026-07-16-openai-gpt-red-internal-red-teamer-prompt-injection/OpenAI describes GPT-Red, an internal automated red-teamer that scales prompt injection discovery and adversarially trains later models against those attacks.Thu, 16 Jul 2026 10:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-16-intruder-vending-machine-llm-code-slicing-wordpress-zero-day/https://0daynews.com/articles/2026-07-16-intruder-vending-machine-llm-code-slicing-wordpress-zero-day/Intruder shipped an LLM code-slicing pipeline that turned up a WordPress plugin zero-day, plus more bugs still under responsible disclosure.Thu, 16 Jul 2026 04:15:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-15-dutch-politie-100m-investment-fraud-20-call-centers-700-shills/https://0daynews.com/articles/2026-07-15-dutch-politie-100m-investment-fraud-20-call-centers-700-shills/Dutch Politie takedown of a 2021-active investment-fraud ring — 20 call centers, ~700 fake advisers, five-country arrests, €100M+ estimated peak monthly.Wed, 15 Jul 2026 22:05:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-15-unit-42-tuxbot-v3-llm-chain-of-thought-iot-botnet/https://0daynews.com/articles/2026-07-15-unit-42-tuxbot-v3-llm-chain-of-thought-iot-botnet/Palo Alto Unit 42 documents TuxBot v3, an IoT botnet whose developer left an AI safety disclaimer and raw reasoning traces in the shipped binary.Wed, 15 Jul 2026 21:15:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-15-trend-micro-bandcampro-gemini-cli-c2-botnet-operator/https://0daynews.com/articles/2026-07-15-trend-micro-bandcampro-gemini-cli-c2-botnet-operator/Trend Micro logs 200+ Gemini CLI sessions from a Russian-speaking actor tracked as bandcampro: C2 migration, credential work, and daily botnet ops.Wed, 15 Jul 2026 20:20:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-15-kaspersky-okobot-seedhunter-ledger-trezor-electron-hook/https://0daynews.com/articles/2026-07-15-kaspersky-okobot-seedhunter-ledger-trezor-electron-hook/Kaspersky's GReAT team says OkoBot has hooked Electron in Ledger and Trezor apps since April 2025 to draw a fake seed-phrase prompt inside the real wallet UI.Wed, 15 Jul 2026 18:15:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-15-mindgard-cursor-git-exe-workspace-root-no-patch/https://0daynews.com/articles/2026-07-15-mindgard-cursor-git-exe-workspace-root-no-patch/Aaron Portnoy's Mindgard team went public today: Cursor 3.11 on Windows executes any git.exe sitting in a cloned repo's root — seven months, no patch.Wed, 15 Jul 2026 12:20:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-15-reliaquest-jalisco-omegalord-m365-device-code-mfa-bypass/https://0daynews.com/articles/2026-07-15-reliaquest-jalisco-omegalord-m365-device-code-mfa-bypass/ReliaQuest maps two new M365 phishing kits: Jalisco auto-refreshes OAuth device codes to defeat the 15-min window, OmegaLord harvests phones for MFA bypass.Wed, 15 Jul 2026 07:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-15-spain-140m-bec-fraud-ring-800-accounts-67-mules/https://0daynews.com/articles/2026-07-15-spain-140m-bec-fraud-ring-800-accounts-67-mules/Spanish National Police dismantle a €140M BEC and investment fraud network using 800 bank accounts, 120 companies, and 67 mules; four arrested across three countries.Wed, 15 Jul 2026 05:10:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-15-lastpass-bitwarden-compliance-lookalike-domain-phishing/https://0daynews.com/articles/2026-07-15-lastpass-bitwarden-compliance-lookalike-domain-phishing/LastPass and Bitwarden users are getting phishing from lookalike "compliance" domains pushing a DocuSign-styled downloader. Delete the email; don't click.Wed, 15 Jul 2026 04:15:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-15-blackpoint-labubarat-rust-nvidia-sysruntime-maas/https://0daynews.com/articles/2026-07-15-blackpoint-labubarat-rust-nvidia-sysruntime-maas/Blackpoint Cyber's Sam Decker and Nevan Beal document LabubaRAT — a Rust MaaS trojan on Windows that ships as nvidia-sysruntime.exe with runtime config.Wed, 15 Jul 2026 03:15:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-14-cereblab-grok-build-0-2-93-git-repo-upload-gcs/https://0daynews.com/articles/2026-07-14-cereblab-grok-build-0-2-93-git-repo-upload-gcs/xAI's Grok Build CLI v0.2.93 uploaded whole git repos, history and all, to a GCS bucket. The "Improve the model" toggle didn't stop it. Fix is server-side.Tue, 14 Jul 2026 10:15:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-14-microsoft-shinyhunters-salesforce-oauth-three-paths/https://0daynews.com/articles/2026-07-14-microsoft-shinyhunters-salesforce-oauth-three-paths/Microsoft's July 13 report maps three OAuth paths ShinyHunters-linked actors used against Salesforce customers for a year — none of them a Salesforce bug.Tue, 14 Jul 2026 08:20:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-14-forg365-phaas-m365-device-code-aitm-market/https://0daynews.com/articles/2026-07-14-forg365-phaas-m365-device-code-aitm-market/Analysis: Forg365's $400/mo Microsoft 365 phishing kit adds device code, AitM, and AI-drafted replies. What changed here is finish, not the underlying kind.Tue, 14 Jul 2026 05:45:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-13-nca-russian-coms-five-charged-1-8m-spoofed-calls/https://0daynews.com/articles/2026-07-13-nca-russian-coms-five-charged-1-8m-spoofed-calls/The NCA charged five London residents over Russian Coms — a caller-ID spoofing platform behind 1.8M scam calls and 170,000 victims. Westminster court date Aug 14.Mon, 13 Jul 2026 22:15:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-13-meta-2026-0182881-lachlan-dunn-emotion-listening-patent/https://0daynews.com/articles/2026-07-13-meta-2026-0182881-lachlan-dunn-emotion-listening-patent/Meta patent 2026/0182881, published July 2, describes an always-on AI that tags voice, biometrics, and app use to score a user's emotional patterns.Mon, 13 Jul 2026 22:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-13-nihon-kotsu-japan-taxi-cyberattack-dispatch-offline/https://0daynews.com/articles/2026-07-13-nihon-kotsu-japan-taxi-cyberattack-dispatch-offline/Japan's largest taxi operator says a July 12 malware intrusion knocked dispatch, web booking, and labor-taxi services offline. No group has claimed.Mon, 13 Jul 2026 21:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-13-memghost-arxiv-persistent-memory-poison-openclaw/https://0daynews.com/articles/2026-07-13-memghost-arxiv-persistent-memory-poison-openclaw/arXiv paper: one crafted email talks a memory-enabled AI agent into writing attacker-supplied 'facts' into its memory files. Future sessions load them.Mon, 13 Jul 2026 17:15:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-13-lidl-online-shop-breach-de-be-nl-service-provider/https://0daynews.com/articles/2026-07-13-lidl-online-shop-breach-de-be-nl-service-provider/Lidl says a file at an unnamed service provider was accessed; DE/BE/NL online shop customer PII taken. Passwords and payment data not yet ruled out.Mon, 13 Jul 2026 15:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-13-huntress-ai-generated-powershell-ad-enum/https://0daynews.com/articles/2026-07-13-huntress-ai-generated-powershell-ad-enum/Huntress attributes an early-June AD enumeration case to a PowerShell script with clear LLM tells — cyan-and-green banners and 'FULLY FIXED' in the title.Mon, 13 Jul 2026 14:20:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-13-eu-uk-first-joint-cyber-sanctions-russia-33-named/https://0daynews.com/articles/2026-07-13-eu-uk-first-joint-cyber-sanctions-russia-33-named/The EU Council named 9 individuals and 4 entities; the UK named 24 more. FSB Center 16, Sandworm, Turla, Lumma Stealer, and Rybar LLC are on the list.Mon, 13 Jul 2026 12:30:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-13-lexfo-evilginx-three-crews-open-directory/https://0daynews.com/articles/2026-07-13-lexfo-evilginx-three-crews-open-directory/Lexfo pulled the full toolkit from an open Python server in Budapest and pivoted to two more Evilginx operations targeting Microsoft 365 tenants.Mon, 13 Jul 2026 09:15:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-12-coinspect-ill-bloom-weak-prng-wallet-seed-5-1m-drained/https://0daynews.com/articles/2026-07-12-coinspect-ill-bloom-weak-prng-wallet-seed-5-1m-drained/Coinspect's Ill Bloom disclosure: five unnamed wallets shipped seed-phrase code with weak randomness. Two sweeps in May and June drained $5.1M.Sun, 12 Jul 2026 09:15:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-11-sentinellabs-balochistan-police-china-india-converge/https://0daynews.com/articles/2026-07-11-sentinellabs-balochistan-police-china-india-converge/SentinelLABS ties 22 months of intrusions at Balochistan Police to two separate crews: China-nexus operators using PlugX and India-linked Mysterious Elephant.Sat, 11 Jul 2026 21:20:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-11-acsc-cms-plugin-exploitation-advisory-18-cves/https://0daynews.com/articles/2026-07-11-acsc-cms-plugin-exploitation-advisory-18-cves/Australia's ACSC named 18 CVEs across WordPress plugins, Craft CMS, Joomla JCE, and more as active exploitation targets, with attackers dropping webshells.Sat, 11 Jul 2026 15:05:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-11-ghostcommit-png-prompt-injection-coderabbit-bugbot/https://0daynews.com/articles/2026-07-11-ghostcommit-png-prompt-injection-coderabbit-bugbot/A PNG carrying prompt injection slips past AI code reviewers that never open image files, then talks a coding agent into exfiltrating a repo's .env secrets as a list of numbers.Sat, 11 Jul 2026 11:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-11-modbeacon-silver-fox-rust-rat-grpc-c2-qianxin/https://0daynews.com/articles/2026-07-11-modbeacon-silver-fox-rust-rat-grpc-c2-qianxin/QiAnXin attributes a new Rust-based RAT called MODBEACON to Silver Fox, using gRPC streaming for encrypted C2 and SEO-poisoned installers for delivery.Sat, 11 Jul 2026 07:15:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-11-metasploit-weekly-flowise-csv-packagekit-modules/https://0daynews.com/articles/2026-07-11-metasploit-weekly-flowise-csv-packagekit-modules/Rapid7's Metasploit weekly drops two modules — a Flowise CSV Agent prompt-injection RCE and a macOS PackageKit LPE. New tooling, not new bugs.Sat, 11 Jul 2026 05:20:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-11-cisa-kev-balbooa-icagenda-joomla-file-upload/https://0daynews.com/articles/2026-07-11-cisa-kev-balbooa-icagenda-joomla-file-upload/CISA added Balbooa Forms and iCagenda to KEV on July 10 — two unauthenticated file-upload RCEs in Joomla extensions. Federal due date is July 13.Sat, 11 Jul 2026 04:20:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-10-iossifov-seized-crypto-wallet-still-had-key/https://0daynews.com/articles/2026-07-10-iossifov-seized-crypto-wallet-still-had-key/Rossen Iossifov, ten years into a laundering sentence, is charged with moving $290K from a seized crypto account. The interesting part is it still moved.Fri, 10 Jul 2026 23:55:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-10-openclaw-2026-6-6-nayak-whatsapp-host-rce-chain/https://0daynews.com/articles/2026-07-10-openclaw-2026-6-6-nayak-whatsapp-host-rce-chain/OpenClaw 2026.6.6 closes three flaws that let a WhatsApp message reach the host as command execution. No public PoC, no observed exploitation.Fri, 10 Jul 2026 22:15:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-10-politie-odido-dutch-speaker-vishing-shinyhunters-62m/https://0daynews.com/articles/2026-07-10-politie-odido-dutch-speaker-vishing-shinyhunters-62m/Dutch National Police say strong indications point at Dutch attackers behind February's Odido breach: a Dutch-speaking vishing call to customer service, then 6.2M records leaked.Fri, 10 Jul 2026 18:15:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-10-donjon-tangem-laser-fault-injection-eal6-samsung/https://0daynews.com/articles/2026-07-10-donjon-tangem-laser-fault-injection-eal6-samsung/Ledger Donjon's laser fault-injection attack resets a Tangem card's password without the old one. There is no patch — Tangem ships no firmware updates.Fri, 10 Jul 2026 16:30:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-10-foxio-xring-xquic-qpack-integer-underflow-alibaba-silence/https://0daynews.com/articles/2026-07-10-foxio-xring-xquic-qpack-integer-underflow-alibaba-silence/FoxIO's Sébastien Féry disclosed a QPACK integer underflow in Alibaba XQUIC that crashes HTTP/3 servers with 260 bytes. Reported April 7. No reply. No patch.Fri, 10 Jul 2026 15:15:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-10-wp-shellstorm-socradar-exposed-server-funnel/https://0daynews.com/articles/2026-07-10-wp-shellstorm-socradar-exposed-server-funnel/SOCRadar and Ctrl-Alt-Intel pulled 22 days of files off an exposed WP-SHELLSTORM server: 1.4M targets, 25K compromises, 5,700 live shells.Fri, 10 Jul 2026 14:15:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-10-illbloom-coinspect-weak-prng-mobile-wallet-drain/https://0daynews.com/articles/2026-07-10-illbloom-coinspect-weak-prng-mobile-wallet-drain/Coinspect disclosed weak PRNG in wallet recovery-phrase generation; attackers drained $3.1M in a May sweep. The pattern — bad randomness, stolen keys — is old.Fri, 10 Jul 2026 10:30:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-10-meta-muse-image-instagram-public-default-impersonation-surface/https://0daynews.com/articles/2026-07-10-meta-muse-image-instagram-public-default-impersonation-surface/Meta's new Muse Image model reuses public Instagram photos and reels by default — no notification, no watermark discussion, opt-out three levels deep in Sharing settings.Fri, 10 Jul 2026 07:20:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-10-clearinghouse-summer-athena-lightwell-old-pattern/https://0daynews.com/articles/2026-07-10-clearinghouse-summer-athena-lightwell-old-pattern/Chainguard announced Athena. Red Hat and the White House announced Lightwell. Vulnerability clearinghouses have been getting reannounced since the 1980s.Fri, 10 Jul 2026 06:15:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-10-hackernews-ato-verification-step-passkey-aftermath/https://0daynews.com/articles/2026-07-10-hackernews-ato-verification-step-passkey-aftermath/The Hacker News argues account takeover shifted from credential stuffing to attacking verification — passkeys pushed the front door shut, so attackers moved.Fri, 10 Jul 2026 05:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-10-talos-hazel-winning-54-percent-defender-cliche/https://0daynews.com/articles/2026-07-10-talos-hazel-winning-54-percent-defender-cliche/Cisco Talos's Hazel argues 'attackers only need to be right once' is a cliché the defensive community should retire. It's overdue.Fri, 10 Jul 2026 04:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-10-datadog-dormant-github-ghost-accounts-org-enumeration/https://0daynews.com/articles/2026-07-10-datadog-dormant-github-ghost-accounts-org-enumeration/Datadog Security Labs documents 50+ dormant GitHub accounts running months-long enumeration of corporate orgs, repos, and — in some cases — private code.Fri, 10 Jul 2026 03:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-09-helix-reliaquest-sharepoint-vishing-blackfile-overlap/https://0daynews.com/articles/2026-07-09-helix-reliaquest-sharepoint-vishing-blackfile-overlap/ReliaQuest attributes new data-extortion crew Helix to vishing and device-code phishing against SharePoint. Infrastructure overlaps BlackFile.Thu, 09 Jul 2026 22:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-09-microsoft-gigawiper-bluerabbit-cyberav3ngers-israel-wiper/https://0daynews.com/articles/2026-07-09-microsoft-gigawiper-bluerabbit-cyberav3ngers-israel-wiper/Microsoft and Binary Defense concurrently disclose a Go-based Windows destructive backdoor — wipe, fake ransomware, spyware in one binary — attributed to Iran-nexus CyberAv3ngers.Thu, 09 Jul 2026 20:15:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-09-interpol-first-light-5811-arrests-293m-seized/https://0daynews.com/articles/2026-07-09-interpol-first-light-5811-arrests-293m-seized/INTERPOL's Operation First Light 2026 arrested 5,811 fraud suspects across 97 countries, seized $293M and blocked 31,014 accounts over 3.5 months.Thu, 09 Jul 2026 11:15:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-09-ai-now-friendly-fire-claude-code-codex-review-exploit/https://0daynews.com/articles/2026-07-09-ai-now-friendly-fire-claude-code-codex-review-exploit/AI Now Institute researchers show autonomous Claude Code and Codex can be tricked into running a hidden binary during their own security-review pass.Thu, 09 Jul 2026 10:15:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-09-assuranceamerica-breach-6-9m-drivers-march-intrusion/https://0daynews.com/articles/2026-07-09-assuranceamerica-breach-6-9m-drivers-march-intrusion/AssuranceAmerica confirms a March 16 intrusion exposed data on 6,998,886 drivers. Notification letters went out in July — a nearly four-month gap between detection and public notice.Thu, 09 Jul 2026 09:30:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-09-wiz-ghostapproval-symlink-six-ai-coding-assistants/https://0daynews.com/articles/2026-07-09-wiz-ghostapproval-symlink-six-ai-coding-assistants/Wiz research: Amazon Q, Cursor, Claude Code, Augment, Antigravity, Windsurf all approved one file path in the dialog while writing to another via symlinks.Thu, 09 Jul 2026 06:15:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-08-spain-palencia-carr-noname-logistics-arrest/https://0daynews.com/articles/2026-07-08-spain-palencia-carr-noname-logistics-arrest/Spanish police detained a Palencia man tied to CyberArmy of Russia Reborn, Z-Pentest, and NoName057(16). The announcement lands nearly four months after the raid.Wed, 08 Jul 2026 23:45:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-08-iris-c2-krebs-wohl-burkman-zero-day-broker/https://0daynews.com/articles/2026-07-08-iris-c2-krebs-wohl-burkman-zero-day-broker/Krebs ties IRIS C2, an offensive-security startup pitching zero-day acquisition, to Jacob Wohl and Jack Burkman — both convicted of felony fraud.Wed, 08 Jul 2026 20:15:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-08-sophos-coding-agents-tripping-edr-attacker-detections/https://0daynews.com/articles/2026-07-08-sophos-coding-agents-tripping-edr-attacker-detections/Seven days of Sophos endpoint telemetry: Claude Code, Cursor, and Codex trip the same rules built to catch attackers — because behaviorally, they should.Wed, 08 Jul 2026 19:20:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-08-copilot-workflow-jailbreak-arxiv-kumar-maple/https://0daynews.com/articles/2026-07-08-copilot-workflow-jailbreak-arxiv-kumar-maple/Kumar and Maple's new arXiv preprint says Copilot's Claude and Gemini backends refused harmful prompts in chat but produced them 816-for-816 in a workflow.Wed, 08 Jul 2026 16:20:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-08-scmbanker-elastic-ref6045-mexican-banking-fraud/https://0daynews.com/articles/2026-07-08-scmbanker-elastic-ref6045-mexican-banking-fraud/Elastic Security Labs is tracking SCMBANKER (REF6045), a PowerShell fraud toolkit hitting Mexican banks, fintechs, and crypto exchanges via ClickFix lures.Wed, 08 Jul 2026 15:15:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-08-kddi-japan-isp-breach-12m-third-party-zero-day/https://0daynews.com/articles/2026-07-08-kddi-japan-isp-breach-12m-third-party-zero-day/KDDI says a May 16 zero-day in unnamed third-party software exposed 12,233,087 email addresses and 7,616,173 passwords across five Japanese ISPs.Wed, 08 Jul 2026 13:15:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-08-cisa-kev-langflow-joomla-page-builder-adds/https://0daynews.com/articles/2026-07-08-cisa-kev-langflow-joomla-page-builder-adds/CISA added three vulnerabilities to KEV on July 7 — a Langflow IDOR and two Joomla page-builder RCEs. Federal due date is July 10. Priority order below.Wed, 08 Jul 2026 05:20:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-08-unk-masstraction-china-cluster-roundcube-universities/https://0daynews.com/articles/2026-07-08-unk-masstraction-china-cluster-roundcube-universities/Proofpoint attributes a Roundcube-exploitation campaign against U.S. and Canadian university physics departments to a China-aligned cluster, UNK_MassTraction.Wed, 08 Jul 2026 04:15:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-07-uat-7810-longleash-orb-network-ruckus-asus/https://0daynews.com/articles/2026-07-07-uat-7810-longleash-orb-network-ruckus-asus/Cisco Talos ties China-aligned UAT-7810 to LONGLEASH backdoor and an expanding ORB relay network built on unpatched Ruckus and ASUS routers.Wed, 08 Jul 2026 03:15:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-08-scattered-spider-windows-device-id-court-filing-stokes/https://0daynews.com/articles/2026-07-08-scattered-spider-windows-device-id-court-filing-stokes/A newly unsealed federal complaint says a Microsoft-recorded device ID tied the account behind a Scattered Spider intrusion to 19-year-old Peter Stokes.Wed, 08 Jul 2026 02:20:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-07-accenture-confirms-breach-source-code-claim/https://0daynews.com/articles/2026-07-07-accenture-confirms-breach-source-code-claim/Accenture confirmed a security incident. A threat actor is advertising 35 GB of alleged source code for sale. The volume claim is unverified — treat accordingly.Wed, 08 Jul 2026 00:20:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-06-operation-dragonreturn-china-nexus-dcrat-india-tax/https://0daynews.com/articles/2026-07-06-operation-dragonreturn-china-nexus-dcrat-india-tax/Seqrite Labs attributes an ongoing spear-phishing campaign against Indian tax filers to a suspected China-nexus actor with infrastructure and tactical overlap to Silver Fox. First observed May 18.Mon, 06 Jul 2026 13:20:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-06-quimarat-java-cross-platform-maas-levelblue/https://0daynews.com/articles/2026-07-06-quimarat-java-cross-platform-maas-levelblue/LevelBlue profiled a new cross-platform Java RAT sold as MaaS. No confirmed campaigns yet — but the price is low, the payload runs everywhere, and the loader is built to walk past SmartScreen. Assume it lands somewhere soon.Mon, 06 Jul 2026 13:00:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-05-flipper-zero-firmware-maintenance-only-community-driven/https://0daynews.com/articles/2026-07-05-flipper-zero-firmware-maintenance-only-community-driven/Flipper Devices says the Flipper Zero firmware is stable at 1.0 and full-time feature work is over. Community PRs run the future, filtered through GitHub Discussions voting and stricter review. Here's what changes.Sun, 05 Jul 2026 17:20:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-04-metasploit-weekly-smb-meterpreter-peyara-detection/https://0daynews.com/articles/2026-07-04-metasploit-weekly-smb-meterpreter-peyara-detection/Rapid7 shipped an SMB-to-Meterpreter session upgrade and a Peyara Remote Mouse RCE module this week. Neither is novel research. Both change what your alerts will look like. Here's the tune.Sat, 04 Jul 2026 16:20:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-04-orchid-iga-ai-agents-lifecycle-gaps/https://0daynews.com/articles/2026-07-04-orchid-iga-ai-agents-lifecycle-gaps/A contributed piece to The Hacker News from Orchid Security lays out where the joiner-mover-leaver model quietly fails for AI agents. Vendor-adjacent, but the gap analysis holds.Sat, 04 Jul 2026 11:15:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-04-talos-catan-and-mouse-curiosity-defensive-skill/https://0daynews.com/articles/2026-07-04-talos-catan-and-mouse-curiosity-defensive-skill/William Largent's Threat Source column this week reads as an essay on board games and pattern recognition. It's really an argument about the load-bearing skill that keeps a defender from becoming a checklist.Sat, 04 Jul 2026 05:30:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-03-pamstealer-macos-maccy-impersonation-jamf/https://0daynews.com/articles/2026-07-03-pamstealer-macos-maccy-impersonation-jamf/Jamf Threat Labs disclosed a new macOS credential stealer today that impersonates the Maccy clipboard app, validates the victim's login password against PAM in real time, and exfiltrates keychain and browser data. Apple Silicon only. Here's what defenders should do.Fri, 03 Jul 2026 20:30:00 GMTThreat Intel & Field Notesarticlehttps://0daynews.com/articles/2026-07-03-fbi-netnut-popa-botnet-takedown/https://0daynews.com/articles/2026-07-03-fbi-netnut-popa-botnet-takedown/The FBI seized hundreds of NetNut proxy domains on July 2; Google's Threat Intelligence Group, working with FBI and Lumen, cut the linked Popa botnet's usable device pool by millions the same day.Fri, 03 Jul 2026 05:00:00 GMTThreat Intel & Field Notesarticle