🚨 ACTIVE EXPLOITATION
🚨 7 | CryptoJS Weak RNG Linked to $5.7 Million Drained From Five Wallet Apps Attackers drained about $5.7 million from wallets using CryptoJS's weak random generator.
- RRWallet, Bexo Wallet, NanChat, Bitcoin Libre, and Milo were affected; RRWallet and Milo are discontinued.
- CryptoJS.lib.WordArray.random() generated weak recovery phrases; NanChat versions before 1.3.0 and Bexo versions before 20.1.0 were affected.
- The vulnerable generator used a Multiply-With-Carry algorithm seeded by Math.random(), reducing 128- and 256-bit entropy to roughly 39 and 47 bits.
- Attackers enumerated outputs, converted them into BIP39 phrases, derived wallet addresses, and matched them against blockchain data; two drain waves stole at least $5,690,922. :page_facing_up: Source: github.com · :paperclip: Coverage: thehackernews.com · :eye: via The Hacker News
⚠️ 6 | Remus Stealer Hides C2 in Ethereum While Draining Browser Vaults Remus is stealing browser credentials and crypto data from Windows systems.
- Windows users with Chromium-based browsers, password managers, FTP clients, and crypto extensions are targeted.
- Remus steals saved passwords, session cookies, crypto-wallet data, clipboard contents, screenshots, and email files.
- Fake cracked-software sites and Turkish-language warez storefronts deliver archives containing the malware.
- Remus injects into Chromium browsers, decrypts stored credentials, and resolves rotating C2 URLs through Ethereum contract 0x999941b74F6bbc921D5174A5b29911562cd2D7CF.
- Observed exfiltration domains include fimmora[.]surf, zelpx[.]garden, and tzpx[.]courses; traffic uses HTTP POST requests and forged Host headers. :page_facing_up: Source: github.com · :paperclip: Coverage: cybersecuritynews.com · :eye: via Cyber Security News
BREACHES & INCIDENTS
🚨 7 | Canadian Man Pleads Guilty in Cloud Storage Hacking and Extortion Case A Canadian man pleaded guilty for hacking a U.S. cloud storage provider and extorting its customers.
- The campaign affected at least 165 customers of a U.S.-based software-as-a-service provider.
- Attackers accessed cloud-hosted data containing records tied to at least 100 million individuals.
- The group operated from February through October 2024 using stolen login credentials.
- They downloaded terabytes of data, threatened public disclosure, and advertised stolen datasets on cybercrime forums and Telegram.
- The scheme generated more than $2.5 million in ransom payments and caused over $9.5 million in known losses. :paperclip: Coverage: cybersecuritynews.com · :eye: via Cyber Security News
🔓 CVEs & KEV
CVE-2026-70426 — CVSS 9.0 — Critical Jenkins Vulnerability Allows Attackers to Execute Malicious Code on Controller
🕵️ RESEARCH & DEEP DIVES
↑ UPDATE | 🚨 7 | Critical Paperclip Flaw Enabled Admin Access and Code Execution A critical Paperclip flaw enabled remote code execution with server permissions.
- Network-accessible Paperclip instances using default authenticated-mode configurations were affected.
- CVE-2026-41679, rated CVSS 10, bypassed authorization and exposed board-level API access.
- Attackers could self-register without email verification, approve a CLI challenge, and obtain a persistent board API token.
- A crafted .paperclip.yaml import could deploy an agent using a host-level execution adapter to run commands as the Paperclip server. :paperclip: Coverage: securityweek.com · :eye: via SecurityWeek
↑ UPDATE | 🚨 7 | Public PoC Released for Linux Kernel Bridge STP Use-After-Free A public PoC demonstrates a Linux kernel bridge STP use-after-free vulnerability.
- Linux systems using the kernel bridge subsystem and Spanning Tree Protocol are affected.
- Kernels before commit 2a00517db8de4be7df3d483b215c5544fb30a191 are vulnerable.
- STP timers can remain active after an administratively down bridge is deleted, leaving freed bridge memory referenced.
- The dangling timer can trigger a kernel crash or potentially enable control-flow hijacking through slab-object reallocation. :paperclip: Coverage: cybersecuritynews.com · :eye: via Cyber Security News
↑ UPDATE | ⚠️ 6 | Ransom Cartel administrator sentenced to 16 years in prison A Ransom Cartel administrator known as “lansky” was sentenced to 16 years in prison.
- Ransom Cartel administrator and Angler Exploit Kit member “lansky” was sentenced to 16 years.
- A separate Snowflake cloud-storage hacker pleaded guilty in a related justice update.
- The cases involve hacking cloud storage providers and extorting their customers. :paperclip: Coverage: mastodon.social · :eye: via @campuscodi@mastodon.social
⚠️ 6 | Chinese spyware tool operates in 13 countries, cyber firm says A Chinese spyware tool is operating in 13 countries, according to a cyber firm.
- The activity spans 13 countries.
- A Chinese spyware tool is operating across those countries.
- The available reporting does not describe the delivery method or tooling. :paperclip: Coverage: infosec.exchange · :eye: via @metacurity@infosec.exchange
⚠️ 5 | Hidden “Ask AI” Prompts Poison LLM Memory Through Deep Links Commercial websites are using hidden prompts in Ask AI links to poison LLM memory.
- Users of ChatGPT, Claude, Gemini, and Grok can be affected when logged-in sessions open malicious deep links.
- Commercial websites embed prompts in marketing and competitor-comparison buttons to bias future AI recommendations.
- URL query parameters automatically execute pre-filled prompts that can instruct assistants to save a vendor domain as a trusted source.
- Microsoft identified 31 companies across 14 industries using the technique, tracked in MITRE ATLAS as AML.T0080 and related to AML.T0051. :page_facing_up: Source: microsoft.com · :paperclip: Coverage: thehackernews.com · :eye: via The Hacker News
⚠️ 5 | Hacks on U.S. Water Supplies Follow Years of Warnings and Neglect U.S. water supplies have faced cyberattacks after years of warnings and neglect.
- U.S. water-supply systems are affected.
- Cyberattacks have targeted the water supply.
- The attacks follow years of warnings and neglect. :paperclip: Coverage: infosec.exchange · :eye: via @metacurity@infosec.exchange
📋 ADVISORIES
:pushpin: 4 | OWASP Releases GenAI LLM Top 10 2026 Security Guide OWASP has released its 2026 Top 10 security guide for LLM applications and autonomous agents.
- The guide targets developers, architects, and CISOs deploying enterprise GenAI applications and agents.
- It covers prompt injection, sensitive-information disclosure, excessive agency, poisoning, supply-chain risks, output handling, memory flaws, misinformation, hidden context exposure, and unbounded consumption.
- The ranking draws on 7,714 real AI-related security incidents, including 6,639 with sufficient classification detail.
- Key attack paths include untrusted-text prompt injection, autonomous shell or API execution, RAG manipulation, model-data poisoning, and resource exhaustion. :page_facing_up: Source: genai.owasp.org · :paperclip: Coverage: cybersecuritynews.com · :eye: via Cyber Security News