Daily cybersecurity intelligence brief. See the companion report: [Companion HTML report attached]

Companion report

Download full report (HTML)

CRITICAL SECTION

No items meeting score >= 10 were collected today.

CISA KEV (last 14 days)

No CISA KEV items found in today’s collection.

RANSOMWARE VICTIMS (DLS Monitoring)

cmdorganization: Golden Star Resources

qilin: Century Equities, Retelit SpA PIVA, Carolina Agri-Power, Allied Plumbing & Heating

NEWS

[7] Critical Zimbra Flaw Could Let Crafted Emails Run Malicious Code in User Sessions (source)

[6] Hackers Weaponize Balochistan Police Portal in Multi-Group Espionage Campaigns (source)

SUMMARY

Total new items: 40
Critical items: 0
Ransomware victims (24h): 5
CISA KEV items: 0

Companion HTML report: Download full report

test body

Companion HTML report (ZIP): Download report (ZIP)

Top items

• Turning software supply chain security into a daily habit \u2014

  In this Help Net Security video, Anastasia Tikhonova, Global Threat Research Lead at Group-IB, explains how to operationalize software su

• Researcher Details WhatsApp-to-Host Attack Chain Using Three OpenClaw Flaws \u2014 Details have emerged about three now-patched security flaws in the OpenClaw personal artificial intelligence (AI) assistant that, if success
• Hackers exploit critical auth bypass in Gitea Docker image \u2014 Hackers are actively exploiting a critical vulnerability in the official Docker image for the Gitea self-hosted Git service that allows atta
• [RANSOMWARE] dragonforce leaked The Schuett Companies \u2014 Victim: The Schuett Companies | Group: dragonforce | Website: www.schuettcares.com | Country: US | Details: The Schuett Companies, Inc. is a
• [RANSOMWARE] Deadlock leaked BARCELONA URBAN PROPERTY CHAMBER \u2014 Victim: BARCELONA URBAN PROPERTY CHAMBER | Group: Deadlock | Website: cpubcn.com | Country: ES | Details: [AI generated] N/A

CRITICAL SECTION

No critical items today.

CISA KEV (last 14 days)

No KEV items.

RANSOMWARE VICTIMS (today)

No ransomware victims today.

NEWS

[8] 12 Million Impacted by Data Breach at Japanese Telco KDDI 

Hackers exploited a zero-day vulnerability in a third-party system to access a KDDI email system for ISPs.

The post 12 Million Impacted by Data Breach at Japanese Telco KDDI appeared first on SecurityWeek.

(SecurityWeek)

[7] 5,811 arrests, $293 million seized over social engineering scams 

Criminals who pose as police officers, romantic partners, and business suppliers have built fraud operations that reach across continents. A four-month enforcement campaign against these schemes wrapped up, and police in 97 countries and territories took part. Thousands of arrests The campaign, called Operation First Light 2026, centered on social engineering scams and the money laundering that moves their proceeds. Arrests reached 5,811. Investigators intercepted $293 million in illicit asse (HelpNetSecurity)

[6] Injective SDK on npm infected with cryptocurrency wallet stealer  Hackers compromised the Injective Labs SDK project’s GitHub repository and used it to publish a malicious package on the Node Package Manager (npm) that stole cryptocurrency wallet private keys and mnemonic seed phrases. […] (BleepingComputer)

[6] Microsoft patches RoguePlanet Defender zero-day vulnerability  Microsoft has released a security patch to address a Defender zero-day vulnerability known as “RoguePlanet,” disclosed after the June 2026 Patch Tuesday. […] (BleepingComputer)

[6] NetSPI pairs AI pentesting with expert-validated security findings 

NetSPI has announced the expansion of its AI-powered continuous pentesting platform, broadening the suite of services that organizations can use to ensure critical assets are always protected. The new services comprise continuous web application penetration testing, continuous AI penetration testing, continuous internal penetration testing and continuous AI findings validation which applies expert human judgement to AI-generated security findings. With an expanding number of new attack surfac (HelpNetSecurity)

[5] Microsoft Patches RoguePlanet Defender Flaw That Can Grant SYSTEM Privileges  Microsoft has released security updates for a Defender vulnerability known as RoguePlanet, nearly a month after details of the flaw became public.

The vulnerability, tracked as CVE-2026-50656 (CVSS score: 7.8), is a privilege escalation issue in the Microsoft Malware Protection Engine (“mpengine.dll”), which provides scanning, detection, and cleaning capabilities for its antivirus and (TheHackerNews)

[5] Microsoft Patches Defender ‘RoguePlanet’ Vulnerability 

The privilege escalation vulnerability tracked as CVE-2026-50656 has been patched with a Microsoft Malware Protection Engine update.

The post Microsoft Patches Defender ‘RoguePlanet’ Vulnerability appeared first on SecurityWeek.

(SecurityWeek)

[5] Microsoft releases fix for RoguePlanet Defender flaw (CVE-2026-50656) 

Microsoft has finally released a security update for its Microsoft Malware Protection Engine, which fixes CVE-2026-50656, the Windows Defender local privilege escalation vulnerability triggered by the RoguePlanet exploit. The vulnerability and the fix CVE-2026-50656 is due to improper link resolution before file access, affects Windows 10 and Windows 11, and may allow authenticated attackers to achieve SYSTEM-level privileges on vulnerable machines by launching low-complexity attacks. The fla (HelpNetSecurity)

[5] [RANSOMWARE] nova leaked Hynet  Victim: Hynet | Group: nova | Country: GB | Details: Hynet helps businesses protect and manage their most important asset: information. With a team of skilled tech experts, they solve complex IT challenges by providing smart data storage and network security services. Their remote team works closely with clients to improve productivity and keep compan (ransomware.live/nova)

[5] [RANSOMWARE] cmdorganization leaked Finance Yorkshire  Victim: Finance Yorkshire | Group: cmdorganization | Website: www.finance-yorkshire.com | Country: GB | Details: Finance Yorkshire provides funding solutions for small and medium-sized enterprises (SMEs) located in or planning to relocate to Yorkshire. Their offerings include business loans ranging from £25,000 to £250,000, equity-linked investments, and seedcorn startup finance, with a focus on supporting gro (ransomware.live/cmdorganization)

[5] [RANSOMWARE] moneymessage leaked Envision Unlimited  Victim: Envision Unlimited | Group: moneymessage | Details: [AI generated] Envision Unlimited is a nonprofit human services organization based in the United States, primarily operating in Illinois. Founded in Chicago, it provides support services for individuals with intellectual and developmental disabilities. Its programs include residential services, day (ransomware.live/moneymessage)

[5] [RANSOMWARE] BrainCipher leaked robroy.com  Victim: robroy.com | Group: BrainCipher | Website: robroy.com | Country: US | Details: [AI generated] Rob Roy Industries, operating through robroy.com, is a US-based manufacturer specializing in electrical conduit systems and enclosures. The company produces PVC-coated steel conduit, fiberglass conduit, and industrial enclosures used in corrosive and hazardous environments. Headquarte (ransomware.live/BrainCipher)

[5] [RANSOMWARE] BrainCipher leaked iac-intl.com  Victim: iac-intl.com | Group: BrainCipher | Website: iac-intl.com | Country: US | Details: [AI generated] N/A (ransomware.live/BrainCipher)

[5] [RANSOMWARE] qilin leaked Inter Power Engineering  Victim: Inter Power Engineering | Group: qilin | Website: www.interpower-engrg.com | Country: AE | Details: N/A (ransomware.live/qilin)

[5] [RANSOMWARE] payload leaked The commune of Castries  Victim: The commune of Castries | Group: payload | Website: castries.fr | Country: FR | Details: The commune of Castries is a picturesque, historic town in the south of France, renowned for its majestic 17th-century château and unique aqueduct. The city’s official website (castries.fr) provides visitors and locals with the latest news, cultural event schedules, and tourism information. Addition (ransomware.live/payload)

[5] [RANSOMWARE] settra leaked wtlawllp.co.uk  Victim: wtlawllp.co.uk | Group: settra | Website: wtlawllp.co.uk | Country: GB | Details: WT Law LLP: Internal Documents of a UK Law Firm PROLOGUE Inside: full credit reports with data from … (ransomware.live/settra)

[5] [RANSOMWARE] settra leaked gvfsinc.com  Victim: gvfsinc.com | Group: settra | Website: gvfsinc.com | Country: US | Details: GREEN VALLEY: SELF-LEASE SCHEME How a California agricultural distributor pays rent to companies con… (ransomware.live/settra)

[5] [RANSOMWARE] settra leaked bergdemo.com  Victim: bergdemo.com | Group: settra | Website: bergdemo.com | Country: DE | Details: Berg / Crushing Corporation of America: Demolition on Federal Money PROLOGUE In our possession are i… (ransomware.live/settra)

[5] [RANSOMWARE] qilin leaked Sintax  Victim: Sintax | Group: qilin | Website: www.sintax.be | Country: BE | Details: N/A (ransomware.live/qilin)

[5] [RANSOMWARE] qilin leaked Sun Dolphin Boats  Victim: Sun Dolphin Boats | Group: qilin | Website: www.sundolphin.com | Country: US | Details: N/A (ransomware.live/qilin)

[5] [RANSOMWARE] qilin leaked Bronken’s Dist  Victim: Bronken’s Dist | Group: qilin | Website: www.bronkens.com | Details: N/A (ransomware.live/qilin)

[5] [RANSOMWARE] qilin leaked Alan F Burke  Victim: Alan F Burke | Group: qilin | Website: www.alanburkecpa.com | Country: US | Details: N/A (ransomware.live/qilin)

[5] [RANSOMWARE] qilin leaked Hum & Jacoby  Victim: Hum & Jacoby | Group: qilin | Website: www.hhjcpas.com | Country: US | Details: N/A (ransomware.live/qilin)

[5] [RANSOMWARE] AiLock leaked Pinturas Prisa  Victim: Pinturas Prisa | Group: AiLock | Country: MX | Details: Pinturas PRISA is a Mexican company from the state of Jalisco with nearly 80 years of history, specializing in the production of high-quality paints and coatings for industrial sectors (automotive, woodworking, manufacturing) and retail customers. (ransomware.live/AiLock)

[5] [RANSOMWARE] CRPxO leaked Creative Smiles Pediatric Dentistry  Victim: Creative Smiles Pediatric Dentistry | Group: CRPxO | Website: creativesmilesprosper.com | Country: US | Details: Sector: Pediatric Dentistry | Data leaked: 2.5 GB (ransomware.live/CRPxO)

[5] [RANSOMWARE] CRPxO leaked AMHWA Biopharm Co., Ltd.  Victim: AMHWA Biopharm Co., Ltd. | Group: CRPxO | Website: amhwabio.com | Country: CN | Details: Sector: Biopharmaceutical | Data leaked: 37.0 GB (ransomware.live/CRPxO)

[5] [RANSOMWARE] CRPxO leaked SF Smile Doctor  Victim: SF Smile Doctor | Group: CRPxO | Website: sfsmiledoctor.com | Country: US | Details: Sector: Medical | Data leaked: 100.0 GB (ransomware.live/CRPxO)

[5] [RANSOMWARE] CRPxO leaked Bishop Arts Dental PLLC  Victim: Bishop Arts Dental PLLC | Group: CRPxO | Website: bishopartsdental.com | Country: US | Details: Sector: Medical | Data leaked: 24.6 GB (ransomware.live/CRPxO)

[5] [RANSOMWARE] CRPxO leaked Top Notch Dentistry of Dallas  Victim: Top Notch Dentistry of Dallas | Group: CRPxO | Website: topnotchdentistryofdallas.com | Country: US | Details: Sector: Medical | Data leaked: 2.0 GB (ransomware.live/CRPxO)

[5] [RANSOMWARE] CRPxO leaked Benjamin H. Wang DDS Inc.  Victim: Benjamin H. Wang DDS Inc. | Group: CRPxO | Country: US | Details: Sector: Medical | Data leaked: 1.2 GB (ransomware.live/CRPxO)

[5] [RANSOMWARE] qilin leaked Peligro Sports  Victim: Peligro Sports | Group: qilin | Website: www.peligrosportsnyc.com | Country: US | Details: N/A (ransomware.live/qilin)

Companion full HTML report: Download full HTML report

SUMMARY

Total new items: 65  Critical: 0  KEV: 0  Ransomware victims today: 0

Sources: BleepingComputer, TheHackerNews, SecurityWeek, HelpNetSecurity, KrebsOnSecurity, CISA KEV, ransomware.live

Cybersecurity Daily  08 July 2026

Collected: 2026-07-08T04:00:49.771611

CRITICAL SECTION

CISA KEV (last 14 days)

CVE-2026-48908  [CISA KEV] CVE-2026-48908: JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability – JoomShaper SP Page Builder (Score: 6)

CVE-2026-55255  [CISA KEV] CVE-2026-55255: Langflow Authorization Bypass Through User-Controlled Key Vulnerability – Langflow Langflow (Score: 6)

CVE-2026-56290  [CISA KEV] CVE-2026-56290: Joomlack Page Builder Improper Access Control Vulnerability – Joomlack Page Builder (Score: 6)

CVE-2026-48282  [CISA KEV] CVE-2026-48282: Adobe ColdFusion Path Traversal Vulnerability – Adobe ColdFusion (Score: 6)

RANSOMWARE VICTIMS (today)

Booba Project: URA Group

incransom: Aesthetic Surgical Images

thegentlemen: LogiQuip, Mercado Libre, Shamrock Holdings Inc., Medic Rescue, Virginia Historical Society, Quanterm Logistics Sdn Bhd, Spedidam, hiddeenn, Arabia Falcon Insurance Company SAOG, Ce Ratp Comite D entreprise Ratp, Keifert, Kosmos, EBNY Development, Tonnies Group, Automovil Supply S.A, Excel Cell Electronic, CSIR Structural Engineering Research Centre, Jump Solutions Inc, MBT Energy, Pro-Tech Technology, Technical Solutions Group

cmdorganization: Mount Royal University

AiLock: Studio Sardano, Richmont Graduate University

krybit: seprec.gob.bo

qilin: Lechner Massivhaus GmbH, COP® Vertriebs-GmbH Zentrale, Next Clinics, Accelirate

interlock: YMCA of Western North Carolina

akira: RISE Architecture, Chisholm Persson & Ball, Excalibur Rentals, Edge Solutions | Stone Ridge Payments

medusalocker: Forces

dragonforce: hive360.com, amplesurveyor.com

bravox: PB Fiduciaire SA

play: Preneed Funeral Programs, Kevin Bao Lenguyen, United Infrastructure

payoutsking: Welldyne, C****p

NEWS

[8] What Changes When Your Software Supply Chain Includes AI Writing Your Code?  Software supply chain security was hard enough. Then AI joined the build pipeline.

For five years, "software supply chain security" meant one question: what's in your code? Which open-source packages, which versions, which transitive dependencies three layers deep that nobody chose on purpose?

SolarWinds, Log4Shell, and XZ Utils all taught the same lesson: the risk lives less in the code a

[8] Suspected China-Aligned Hackers Exploit Roundcube Flaws Against Universities  A suspected China-aligned threat activity cluster has been observed exploiting Roundcube webmail software belonging to physics and engineering departments of U.S. and Canadian universities as part of a new campaign.

The activity involves the exploitation of now-patched, critical security flaws in the open-source email solution, such as CVE-2024-42009 (CVSS score: 9.3), to siphon credentials,

[8] CERT/CC Warns of Hidden Admin Backdoor in Tenda Router Firmware  Several versions of firmware released by Chinese network device manufacturer Tenda have been found to embed an undocumented authentication backdoor that enables administrative access to the devices' web management interfaces, the CERT Coordination Center (CERT/CC) warned Monday.

"An attacker can exploit this vulnerability, tracked as CVE-2026-11405, to bypass the password verification process

[8] BeyondTrust Patches Critical Auth Bypass Flaws in Remote Support and PRA  BeyondTrust has released updates to address two critical security flaws affecting Remote Support (RS) and Privileged Remote Access (PRA) products that, if successfully exploited, could allow unauthenticated attackers to take control of susceptible devices.

The vulnerabilities are listed below –

CVE-2026-40138 (CVSS score: 9.2) – A pre-authentication vulnerability exists in the

[6] Accenture confirms breach after hacker offers stolen data for sale  IT services giant Accenture has confirmed it suffered a security breach after a threat actor claimed to have stolen 35 GB of source code and other data from the company. […]

[5] Chinese hackers develop LONGLEASH malware to expand ORB network  Chinese hackers tracked as 'UAT-7810' are actively evolving their malware to expand their Operational Relay Box (ORB) network by compromising internet-facing networking devices, primarily unpatched Ruckus routers. […]

[5] Rogue Agent Flaw Could Have Let Attackers Hijack Google Dialogflow CX Chatbots  A critical flaw in Google's Dialogflow CX could have let an attacker with edit rights on one Code Block-enabled agent compromise other Code Block-enabled agents in the same Google Cloud project.

From there, they could read live conversations, steal the data users shared, and make the bots send attacker-written messages, including requests to re-enter a password.

Security firm Varonis found it

[5] Writer AI Flaw Could Let Agent Previews Leak Session Tokens Across Tenants  Cybersecurity researchers have disclosed details of a now-patched critical session isolation vulnerability in Writer, an enterprise generative artificial intelligence (AI) platform, that could result in cross-tenant compromise.

The one-click vulnerability has been codenamed WriteOut by the Sand Security Research team.

"An outsider could go from having no access to taking over any Writer AI

Companion HTML report: Download report (HTML)

CRITICAL SECTION

[16] BlueHammer Vulnerability Exploited in Ransomware Attacks (SecurityWeek) — CVE-2026-33825

Cybersecurity Intelligence Report — 2026-07-04

Collected: 2026-07-04T04:13:31.019776

CRITICAL SECTION

• [10] In Other News: Canadian Hacker Jailed, Open Source Zero-Days, Two Sentenced for ATM Jackpotting (SecurityWeek)
  

  Noteworthy stories that might have slipped under the radar: Anonymous-linked Canadian hacker jailed, researcher drops zero-days in open source projects, Venezuelans sentenced in the US over ATM jackpotting.

  The post In Other News: Canadian Hacker Jailed, Open Source Zero-Days, Two Sentenced for ATM Jackpotting appeared first on Critical Cursor AI Code Editor Flaws Could Lead to OS-Level Remote Code Execution appeared first on SecurityWeek.

• [5] Google, FBI Disrupt NetNut Residential Proxy Network Powered by Millions of Devices (SecurityWeek)
  

  NetNut rented access to millions of compromised devices, allowing cybercriminals and nation-state actors to mask their identities during attacks.

  The post Google, FBI Disrupt NetNut Residential Proxy Network Powered by Millions of Devices appeared first on SecurityWeek.

• [5] Organizations struggle to prioritize known cyber risks (HelpNetSecurity)
  

  Organizations collect more cyber risk data than ever, with many still struggling to build a unified view of their exposure. The latest State of Threat Management report from Filigran found that security teams continue to work across disconnected tools, leaving important context spread across multiple systems. Cloud infrastructure, on-premises environments, third-party services, vulnerability scanners, threat intelligence feeds, and attack surface management platforms all generate information

SUMMARY

• Total new items: 31
• Critical count: 1
• Ransomware groups active: 11
• Top CVEs to patch: CVE-2026-46242

Sources: BleepingComputer, TheHackerNews, SecurityWeek, HelpNetSecurity, KrebsOnSecurity, CISA KEV, ransomware.live

Companion HTML report: Full report

Companion HTML report (ZIP): Download detailed report

CRITICAL SECTION

• [11] CISA Warns of Actively Exploited Microsoft SharePoint Vulnerability  CVEs: CVE-2026-45659
  CISA says threat actors are exploiting a recently patched SharePoint remote code execution vulnerability (CVE-2026-45659).
  The post CISA Warns of Actively Exploited Microsoft SharePoint Vulnerability appeared first on SecurityWeek.
• [10] CISA: Microsoft SharePoint RCE flaw now actively exploited
  CISA warned on Wednesday that attackers have begun exploiting a high-severity Microsoft SharePoint remote code execution vulnerability patched in May. […]

NEWS

• [8] Ransomware Groups Turn to Citrix Bleed 2, BYOVD, and Supply Chain Credentials
• [7] AI Agent Exploits Langflow RCE to Automate Database Ransomware Attack
• [6] Cisco Confirms In-the-Wild Exploitation of Unified CM Vulnerability
• [6] New iboss platform gives organizations instant visibility into AI tools and usage
• [6] [RANSOMWARE] apt73 leaked flazio.com
• [6] [RANSOMWARE] apt73 leaked holidaypalace.com
• [6] [RANSOMWARE] apt73 leaked ritavo.com
• [5] SharePoint RCE CVE-2026-45659 Added to CISA KEV After Active Exploitation
• [5] Scattered Spider suspect extradited over $8 million ransom scheme
• [5] Review: CTRL+ALT+PWN
• [5] Catching ransomware on the wire before it locks the file server
• [5] [RANSOMWARE] incransom leaked oakparkmi.gov
• [5] [RANSOMWARE] anubis leaked Ferrum AG
• [5] [RANSOMWARE] incransom leaked tambasa.com
• [5] [RANSOMWARE] incransom leaked tricountyhs.org
• [5] [RANSOMWARE] incransom leaked acworth-ga.gov
• [5] [RANSOMWARE] incransom leaked carvalima.com.br
• [5] [RANSOMWARE] incransom leaked ezortea.com.br
• [5] [RANSOMWARE] incransom leaked hamilton-eye.com
• [5] [RANSOMWARE] worldleaks leaked Service IT
• [5] [RANSOMWARE] worldleaks leaked Treet Group of Companies
• [5] [RANSOMWARE] anubis leaked Quest Healthcare Solutions
• [5] [RANSOMWARE] moneymessage leaked X-Copper Professional
• [5] [RANSOMWARE] qilin leaked Pennant Hills Golf Club
• [5] [RANSOMWARE] payload leaked Tofutown
• [5] [RANSOMWARE] spacebears leaked Salters propane
• [5] [RANSOMWARE] anubis leaked Northeast Pediatrics & Adolescent Medicine

SUMMARY

Total new items: 57; Critical: 2; Ransomware victims today: 19.

Full HTML report (ZIP)