🕵️ RESEARCH & DEEP DIVES
-
Citizen Lab Uncovers Covert Exploitation of Global Telecom Networks
Citizen Lab has documented covert exploitation of global telecom networks.- Global telecommunications companies and infrastructure are affected.
- Covert surveillance actors are exploiting telecom networks and communications.
- The activity involves persistent access across telecom infrastructure in multiple countries.
- Confirmed victims reportedly include companies in 80 countries.
📎 Coverage: citizenlab.ca · 👁 via r/netsec
-
ClawHavoc Campaign Turns OpenClaw AI Agents Into Malware Delivery Tools
Attackers poisoned OpenClaw’s ClawHub registry with malicious skills that delivered infostealers.- OpenClaw users, developers, and AI power users were targeted through skills installed from the ClawHub registry.
- The campaign exposed credentials, browser data, cryptocurrency wallets, developer secrets, SSH keys, cloud credentials, and agent-linked tokens.
- At least 341 malicious skills were identified, including 335 linked to Atomic macOS Stealer; 1,184 malicious packages were associated with 12 author IDs.
- Malicious skills used fake prerequisites, ClickFix-style instructions, password-protected archives, Base64-encoded shell commands, PowerShell, Bash, and curl to deliver payloads.
- Reported indicators include 91.92.242.30, 95.92.242.30, SHA-256 998c38b430097479b015a68d9435dc5b98684119739572a4dff11e085881187e, and SHA-256 17703b3d5e8e1fe69d6a6c78a240d8c84b32465fe62bed5610fb29335fe42283; OpenClaw releases before 2026.1.29 were reportedly affected by CVE-2026-25253.
📎 Coverage: reddit.com · 👁 via r/netsec
🔓 CVEs & KEV
-
CVE-2026-77635 — CVSS 9.2 — CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with Postgr...
-
CVE-2026-75542 — CVSS 8.3 — OAuth token exchange grants repository scopes for organizations the principal...
-
CVE-2026-77634 — CVSS 8.2 — CakePHP: SmtpTransport vulnerable to CRLF header injectionCakePHP is a rapid ...
-
CVE-2026-77567 — CVSS 8.1 — Filament: App-based MFA can be bypassed when recovery codes are enabledFilame...
-
CVE-2026-19568 — CVSS 7.8 — SVG File Parsing Memory Corruption Vulnerability in Autodesk 3ds MaxA malicio...
-
CVE-2026-7455 — CVSS 7.8 — FLT File Parsing Out-of-Bounds Write Vulnerability in Autodesk 3ds MaxA malic...
-
CVE-2026-16783 — CVSS 7.8 — ABC File Parsing Out-of-Bounds Write Vulnerability in Autodesk 3ds MaxA malic...
-
CVE-2026-5006 — CVSS 6.8 — Vault Vulnerable to Privilege Escalation via Slash Injection in Templated Pol...
-
CVE-2026-75509 — CVSS 6.5 — joserfc claim-validation bypass via array-typed single-string claims (iss/sub...
📋 ADVISORIES
- 📄 Source for Harness launches AI agents to triage and patch software vulnerabilities — harness.io