Baylor Genetics hack exposed sensitive patient and employee data

💥 BREACHES & INCIDENTS

• Baylor Genetics hack exposed sensitive patient and employee data
  Baylor Genetics disclosed that a June cyberattack exposed sensitive patient and employee information.
  • Baylor Genetics patients and current or former employees were affected.
  • Patient data potentially included names, birth dates, testing information, lab results, health insurance details and limited Social Security numbers.
  • Employee data potentially included Social Security numbers, government IDs and financial account information.
  • An unauthorized third party accessed parts of Baylor Genetics’ network and stored data between June 11 and June 17, 2026.
  • Baylor Genetics detected suspicious activity around June 15 and completed its data review on or around July 30.
    📄 Source: baylorgenetics.com · 📎 Coverage: cybersecuritydive.com · 👁 via Cybersecurity Dive

🕵️ RESEARCH & DEEP DIVES

• C2Looper Rust Backdoor Likely Supports Ransomware Operations via GitHub C2
  Zscaler identified C2Looper, a Rust backdoor likely linked to ransomware attacks.

  • Organizations targeted in ransomware-related activity may be affected by C2Looper.
  • C2Looper is a Rust-based backdoor used to establish footholds for lateral movement.
  • It can execute arbitrary commands, perform reconnaissance, and deploy second-stage payloads.
  • ThreatLabz assesses with low-to-medium confidence that a multi-stage ClickFix chain delivers it.
  • The malware uses GitHub for command-and-control communications.
    📎 Coverage: securityboulevard.com · 👁 via securityboulevard.com (discovered)

• MCPwned Presentation Details a Skeleton-Key Vulnerability in MCP Servers
  Jonathan Leitschuh presented MCPwned, a vulnerability affecting MCP servers.

  • The issue applies to Model Context Protocol servers used by AI assistants.
  • MCPwned describes one “skeleton key” vulnerability capable of compromising MCP servers.
  • The supplied material does not detail the attack vector or exploitation steps.
  • Jonathan Leitschuh presented the research at BSidesSF 2026.
    📄 Source: youtube.com · 📎 Coverage: infosecurity.us · 👁 via securityboulevard.com (discovered)

🔓 CVEs & KEV

• CVE-2026-75045 — CVSS 9.1 — In JetBrains YouTrack before 2025.3.156085, 2026.1.13913, 2026.2.18112 an una...

• CVE-2026-75060 — CVSS 8.4 — In JetBrains PyCharm before 2026.2.1 code execution was possible via unauthen...

• CVE-2026-75048 — CVSS 8.2 — In JetBrains YouTrack before 2026.2.18068 stored XSS via the fenced code-bloc...

• CVE-2026-75051 — CVSS 8.1 — In JetBrains YouTrack before 2026.2.17917 unauthorised project transfer betwe...

• CVE-2026-75044 — CVSS 8.1 — In JetBrains YouTrack before 2025.3.156085, 2026.1.13914, 2026.2.18095 missin...

• CVE-2026-75056 — CVSS 7.8 — In JetBrains IntelliJ IDEA before 2026.2.1 rCE via Markdown export tool was p...

• CVE-2025-27772 — CVSS 7.4 — Uptrain vulnerable to remote code execution via /new_run endpointUpTrain is...

• CVE-2025-27771 — CVSS 7.4 — Uptrain vulnerable to remote code execution via /add_prompts endpointUpTrai...

• CVE-2026-75050 — CVSS 7.1 — In JetBrains YouTrack before 2026.1.13901, 2026.2.17950 doS attack was possib...

• CVE-2026-75049 — CVSS 6.5 — In JetBrains YouTrack before 2026.1.13903, 2026.2.17950 an authenticated user...

• CVE-2026-75047 — CVSS 6.5 — In JetBrains YouTrack before 2026.2.18177 doS attack was possible via a decom...

• CVE-2026-75054 — CVSS 6.3 — In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the OpenAPI ...

• CVE-2026-75057 — CVSS 6.2 — In JetBrains IntelliJ IDEA before 2026.1.5 git credentials were written in pl...