🛡️ Security Research Brief

European Commission — Europa.eu Breached by ShinyHunters

The European Commission confirmed a major data breach after the ShinyHunters extortion gang claimed to have stolen over 350GB of information from European Commission cloud systems. The incident represents one of the largest government data thefts in recent European history.

SecurityWeek ↗

CareCloud — Healthcare Patient Data Stolen

Healthcare IT firm CareCloud disclosed a cybersecurity incident involving one of its electronic health record (EHR) environments. Sensitive patient data was exposed during a network disruption lasting approximately eight hours. The breach affects an unknown number of patients whose protected health information (PHI) may have been accessed.

BleepingComputer ↗

FBI Director Kash Patel — Personal Email Compromised

The FBI confirmed that Iranian hackers targeted FBI Director Kash Patel's personal email account. A pro-Iranian hacking group claimed credit and made emails and documents available for download. The US is offering a $10M reward for information on the hackers. The FBI noted the compromised information is old.

SecurityWeek ↗

CVE-2026-3055 — Citrix NetScaler ADC/Gateway Memory Overread

A critical memory overread vulnerability in Citrix NetScaler ADC and Gateway allows attackers to leak sensitive information, including authenticated admin session IDs. Exploitation requires the appliance to be configured as a SAML Identity Provider. Active exploitation observed since March 27.

Action: Patch immediately. Check for SAML IDP configurations.

BleepingComputer ↗

F5 BIG-IP APM — DoS Reclassified to Critical RCE

F5 reclassified a BIG-IP APM vulnerability from high-severity DoS to critical RCE. Attackers are actively deploying webshells on unpatched devices. CISA has added this to its Known Exploited Vulnerabilities (KEV) catalog.

Action: Patch immediately. Audit BIG-IP instances for webshells.

BleepingComputer ↗

CVE-2026-21643 — Fortinet FortiClient EMS SQL Injection

A critical SQL injection vulnerability in Fortinet's FortiClient Endpoint Management Server (EMS) is being actively exploited in the wild. Threat actors are leveraging this flaw for initial access to enterprise networks.

Action: Patch FortiClient EMS immediately. Review EMS logs for anomalous queries.

CyberSecurityNews ↗

Grafana 12.4.2 — Dual Critical RCE Vulnerabilities

Two critical vulnerabilities in Grafana allow full remote code execution. Security updates released in version 12.4.2.

CyberSecurityNews ↗

CVE-2026-33660 — n8n Workflow Automation RCE

Critical RCE flaw in the popular open-source workflow automation platform n8n exposes host servers to remote code execution attacks.

CyberSecurityNews ↗

CVE-2026-33634 — Aqua Trivy Scanner

CISA added a critical vulnerability in Aqua Security's Trivy scanner to the KEV catalog. Ironic — a security scanner itself became a vulnerability vector.

CyberSecurityNews ↗

Vim — Arbitrary Command Execution via Weaponized Files

A high-severity flaw in Vim allows attackers to execute arbitrary commands through weaponized files. Developers using Vim should update immediately.

CyberSecurityNews ↗

Cisco Secure Firewall Management Center — Unauthenticated RCE

Unauthenticated remote code execution vulnerability in Cisco's Secure Firewall Management Center (FMC) software.

CyberSecurityNews ↗

Synology DiskStation Manager — Remote Command Execution

Unauthenticated remote attackers can execute arbitrary commands on Synology DSM devices.

CyberSecurityNews ↗

Jira Work Management — Stored XSS

A stored XSS vulnerability in Jira Work Management could lead to account compromise in the Atlassian ecosystem.

CyberSecurityNews ↗

Claude Chrome Extension — 0-Click Prompt Injection

A zero-click vulnerability in Anthropic's Claude Chrome Extension exposed over 3 million users to silent prompt-injection attacks, allowing malicious websites to hijack the AI assistant.

CyberSecurityNews ↗

Russian APT Star Blizzard — DarkSword iOS Exploit Kit

The Russian state-sponsored group Star Blizzard has adopted the DarkSword iOS exploit kit, targeting government, higher education, financial, and legal entities, as well as think tanks. This marks a notable expansion of their mobile exploitation capabilities.

SecurityWeek ↗

Russian CTRL Toolkit — RDP Hijacking via FRP Tunnels

A newly discovered Russian-origin remote access toolkit called CTRL is being distributed via malicious LNK files disguised as private key folders. Built in .NET, it includes credential phishing (Windows Hello UI), keylogging, RDP session hijacking, and reverse proxy tunneling via Fast Reverse Proxy (FRP).

The Hacker News ↗

China-Linked APTs — Southeast Asian Government Targeted

Three China-aligned threat clusters (Mustang Panda, Earth Estries/Crimson Palace, Unfading Sea Haze) ran a coordinated campaign against a Southeast Asian government. Malware deployed includes HIUPAN, PUBLOAD, MASOL RAT, PoshRAT, FluffyGh0st, and others — indicating a well-resourced, persistent operation.

The Hacker News ↗

Iran — Cyber Operations in Warfare Context

Iran-linked hacking groups are shifting to high-volume, low-impact cyberattacks with AI-powered boosts. Targets include hospitals, infrastructure, and civilian systems in an evolving conflict landscape.

SecurityWeek ↗

TeamPCP Supply Chain Attack — Telnyx SDK Poisoned on PyPI

Two malicious versions of the popular Telnyx SDK were uploaded to the PyPI registry, targeting Windows, macOS, and Linux systems. Part of the growing TeamPCP supply chain attack campaign.

SecurityWeek ↗

RoadK1ll — New WebSocket Implant for Lateral Movement

A newly identified implant named RoadK1ll uses WebSocket connections to enable quiet lateral movement from compromised hosts to other systems on the network.

BleepingComputer ↗

Infiniti Stealer — Cloudflare-Themed ClickFix Targeting Macs

A Cloudflare-themed ClickFix attack drops the Infiniti Stealer on Macs via fake CAPTCHA pages, Bash scripts, a Nuitka loader, and a Python-based infostealer. Apple's macOS Tahoe 26.4 now includes Terminal paste warnings specifically to counter ClickFix techniques.

SecurityWeek ↗

Apple macOS Tahoe 26.4 — Terminal Paste Protection

Apple introduced a new security feature in macOS Tahoe 26.4 that blocks pasting and executing potentially harmful commands in Terminal, directly addressing the ClickFix social engineering technique that tricks users into pasting malicious commands.

BleepingComputer ↗

Huskeys — Edge Security Management Startup ($8M Funding)

Huskeys emerged from stealth with $8M in funding, building an edge security management (ESM) platform — an AI engine atop the entire edge security stack.

SecurityWeek ↗

Google Sets 2029 Quantum Deadline

Google has set an internal 2029 deadline for quantum-related security readiness, signaling that post-quantum cryptography migration timelines are tightening.

SecurityWeek ↗

LLMs Eroding Access Control

SecurityWeek highlights a growing concern: LLMs can generate complex access control policies (Rego, Cedar) in seconds, but a single missing condition or hallucinated attribute can quietly dismantle least-privilege security models. Organizations using AI to write access policies should treat output as untrusted code requiring thorough review.

Browser-Based Attacks Bypassing Traditional Controls

A Push Security report details how browser-based attacks — AITM phishing, ClickFix, malicious OAuth apps, and session hijacking — are driving major breaches while existing security controls fail to detect them. The browser is becoming the primary attack surface.

Network Appliance CVEs Under Rapid Mass Exploitation

Today's report shows 3 separate network appliance vendors (Citrix, F5, Fortinet) with critical CVEs being actively exploited simultaneously. The window between disclosure and exploitation continues to shrink. Edge device patching is not optional — it's a race.

State-Sponsored Mobile Exploitation Expanding

Star Blizzard's adoption of the DarkSword iOS exploit kit signals Russian APTs expanding mobile targeting capabilities. Combined with Iran's AI-powered attack scaling, nation-state offensive capabilities are broadening faster than defensive coverage.