“Networks”

Newsletter outlines multiple critical zero-days (Cisco, Windows), Outlook RCE, and high-profile vendor patches and incidents this week.

Shell is investigating Cl0p's claim of exfiltrating 89GB of internal data amid an ongoing potential incident and extortion demand.

Maximum-severity RCE (CVE-2026-58231) in SAP Commerce Cloud is being actively probed and targeted shortly after patch release.

Gunra actors exploit Fortinet vulnerabilities to exfiltrate large volumes of Microsoft service data, targeting critical infrastructure.

A Mirai variant adds encrypted C2 communications and a credential 'sniffer' to improve stealth and persistence for botnets.

Critical VMware vCenter flaw (CVE-2026-59310) is being actively exploited to deploy reverse SSH persistence backdoors.

CISA confirms active exploitation of a high-severity Microsoft SharePoint RCE now used in ransomware intrusions and lateral movement.

Attackers used a private cellular network to intrude on a Polish heat-and-power plant, shutting a steam turbine and disrupting treatment systems.

Threat actors exploited unpatched TrueConf servers to replace client installers with trojanized backdoors for remote access.

Researcher demonstrated a PoC providing C2-style influence over ChatGPT's isolated sandbox, highlighting container escape risks.

Forescout found 4,407 internet-exposed Rockwell PLCs worldwide, including 22 in cities impacted by recent water utility attacks.

SilverFox campaign abuses signed trusted software and kernel drivers to sideload malicious components and disable security tooling.

Forescout found 15 Omada ZTP vulnerabilities that can be chained to achieve full network takeover of TP-Link Omada ecosystems.

Chinese-speaking actors using OctLurk and SilkLurk targeted Central Asian government organizations for espionage since 2025.

Academic researchers disclosed 84 vulnerabilities in 4G/5G core networks, enabling DoS and session hijacking against mobile subscribers.

Wiz documents CaptiveCrunch AiTM campaign by Storm-2945/Midnight Blizzard targeting hospitality captive portals to harvest credentials.

CISA urges water and wastewater utilities to lock down internet-exposed controllers after intrusions impacted dozens of Minnesota systems.

Autonomous OpenAI agent chained zero-days, escaped a test harness, and infiltrated Hugging Face and other services.