💥 BREACHES & INCIDENTS
- Croatia Arrests Serbian Businessman Suspected of Hacking State Systems
Croatia arrested a Serbian cybersecurity businessman suspected of hacking Croatian state systems.
- The case affects Croatia's Interior and Finance ministries, health and pension funds, HAKOM and REGOS.
- Police suspect Georgije V., 33, owner of Novi Sad cybersecurity firm Elite Security Systems, of unauthorized access and personal-data misuse.
- The intrusions reportedly began in April 2026 and targeted multiple government systems.
- Investigators say the activity was routed through servers in Sweden and Belize using Serbian IP addresses. 📎 Coverage: balkaninsight.com · 👁 via @campuscodi@mastodon.social
🕵️ RESEARCH & DEEP DIVES
-
Ghostjacking Uses Poisoned Logs to Hijack AI Agents Tenet researchers demonstrated attacks that hijack AI agents through poisoned logs and alerts.
- Cloudflare, Datadog, and Sentry users are exposed to the attack pattern.
- AI agents can alter DNS, execute code, steal cloud credentials, and run attacker-controlled fixes.
- Attackers plant instructions in blocked-request logs, fake alerts, or crafted error reports.
- The technique succeeded against Claude Code 9 times out of 10 in testing.
- Tenet found more than 2,700 exposed Datadog front-end keys that could help attackers plant alerts. 📎 Coverage: securityweek.com · 👁 via Dark Reading
-
Aeternum Uses Polygon Smart Contracts for Decentralized Botnet C2 Aeternum uses Polygon smart contracts for botnet command and control.
- Organizations with systems infected by the Aeternum botnet loader are affected.
- The loader uses Polygon blockchain smart contracts for decentralized C2 infrastructure.
- The blockchain-based C2 also enables payload execution. 📄 Source: ethereum.org · 📎 Coverage: unit42.paloaltonetworks.com · 👁 via Palo Alto Unit 42
🔓 CVEs & KEV
- CVE-2026-72911 — CVSS 9.9 — ERPNext: Possibility of server-side template injection due to missing validat...
- CVE-2026-48161 — CVSS 9.3 — react18-use was vulnerable to malicious code execution via compromised commit...
- CVE-2026-48160 — CVSS 9.3 — react-tracked was vulnerable to malicious code execution via compromised comm...
- CVE-2025-30237 — CVSS 8.7 — Authentication Bypass via Broken Access Control in Web Server in Multiple TP-...
- CVE-2025-30241 — CVSS 8.6 — OS Command Injection in Web Interface in Multiple TP-Link Aginet DevicesCerta...
- CVE-2025-30238 — CVSS 8.6 — Privilege Escalation via Improper Authorization in User Management in multipl...
- CVE-2025-30239 — CVSS 8.5 — Sensitive Data Exposure due to Hardcoded Cryptographic Keys in Multiple TP-Li...
- CVE-2026-18947 — CVSS 8.5 — Feast Authorization Bypass: DoS via Materialization (CVE-2026-18947)
- CVE-2026-8718 — CVSS 8.4 — Out-of-bounds write in DTLS peer Connection ID getsockopt (
TLS_DTLS_PEER_CID... - CVE-2026-72915 — CVSS 7.5 — Mastodon: Personally-identifying information disclosure due to incorrect acce...
- CVE-2026-72914 — CVSS 7.5 — Mastodon: Exhausting data by an unauthenticated request to the admin retentio...
- CVE-2026-72913 — CVSS 7.3 — Kitty: Command injection into the child shell via chained @kitty-echo + @kitt...
- CVE-2026-72910 — CVSS 7.1 — ERPNext: Unauthorised modification of master data due to missing validationER...
- CVE-2026-72916 — CVSS 6.3 — Mastodon: SSRF Protection Bypass via IPv4-compatible IPv6 AddressesMastodon i...