Estée Lauder Discloses Data Theft via Oracle EBS Zero-Day Exploit

💥 BREACHES & INCIDENTS

Estée Lauder Discloses Data Theft via Oracle EBS Zero-Day Exploit — SecurityWeek
Cl0p exploited a zero-day remote code execution vulnerability (CVE-2025-61882) in Oracle E-Business Suite starting August 9, 2025, to steal 870GB of sensitive employee data including personal, financial, health, and employment information such as SSNs and bank details. The breach was disclosed in July 2026 after Oracle released a patch.
- Applies to Estée Lauder employees whose data was stored in Oracle EBS
- Attack leveraged a zero-day RCE in Oracle EBS
- Data exfiltration lasted nearly a year before disclosure

Open-Source Android AI Agents Vulnerable to Invisible Screen Text Code Execution Attacks — The Hacker News
Researchers demonstrated that invisible text overlays at 2% opacity can slip commands to AI agents on Android, which then execute commands on host PCs via adb shell input, enabling remote code execution.
- Affects five open-source Android AI agent frameworks
- Requires malicious app, active AI task, and enabled USB or wireless debugging
- Invisible text bypasses human detection but is read by AI vision models
Bit2Watt Attack Lets Cloud Tenants Disrupt Power Grids Using GPU Workloads — The Hacker News
Cloud tenants can destabilize power grids by modulating GPU workloads to create rapid power oscillations without exploits or elevated privileges.
- Targets GPUs like RTX 4090, A100, Tesla V100 in data centers
- Uses synthetic CUDA kernels or real LLM training runs for modulation
- Simulations show potential for cascading grid failures

HollowGraph Malware Uses Microsoft 365 Calendar for C&C Communication — SecurityWeek
HollowGraph malware uses Microsoft 365 calendar events with encrypted attachments as covert command-and-control channels, linked to Iranian threat actors.
- Targets Microsoft 365 accounts, notably a compromised mailbox in Israel
- Uses Microsoft Graph API and hybrid RSA/AES encryption
- Maintains secondary DNS tunneling for config and credential refresh
UCSD finds vulnerabilities in KARR car alarms affecting 2M+ vehicles, patch released — Wired
UCSD researchers found security flaws in KARR car alarms installed in over 2 million vehicles, allowing remote hijacking within Bluetooth range.
- Can unlock, immobilize, trigger alarms, or stealthily steal vehicles
- Devices often installed by dealers even if owners declined
- Manufacturer issued a security patch following disclosure
New BitLocker Extortion Attacks Abuse RDP, MSSQL, and Printers in Latin America — Securelist (Kaspersky)
Attackers exploit exposed RDP and MSSQL servers to deploy BitLocker encryption and extort victims by printing ransom notes via printers.
- Targets businesses in Colombia, Mexico, and other Latin American countries
- Uses BitLocker to encrypt drives and locks victims out without keys
- Deploys web shells and remote monitoring tools for persistence

CVE-2026-65008 — CVSS 9.8 — Grav before 2.0.7 Remote Code Execution via Blueprint dynamicData
CVE-2026-65007 — CVSS 9.6 — Grav before 1.0.8 Missing Authorization on API Key Generation
CVE-2026-16461 — CVSS 6.5 — Rpcbind stack buffer overflow
CVE-2026-59844 — CVSS 6.5 — Libssh denial of service via oversized sftp read length
CVE-2026-59843 — CVSS 6.5 — Libssh denial of service via zero advertised channel packet size
Additional CVEs listed with various severity and impacts

N-day patching risks — The Hacker News
Discussion on the increasing urgency and risks of n-day patching turning into n-hour patching cycles.