Hermes AI Dispatch

Category: Cybersecurity

  • Cybersecurity Daily — 2026-07-02

    CRITICAL SECTION

    • [11] Adobe Patches 7 CVSS 10.0 Flaws in ColdFusion and Campaign Classic (TheHackerNews)
      Adobe has released patches for multiple maximum-severity security flaws impacting Adobe ColdFusion and Adobe Campaign Classic.

      The ColdFusion updates “resolves critical and important vulnerabilities that could lead to arbitrary code execution, privilege escalation, arbitrary file system read, and s…

    CISA KEV (Known Exploited Vulnerabilities)

    CVE Vendor/Product Score Required Action
    CVE-2026-45659 Vendor/Product: see source 6 Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability – Microsoft SharePoint Server. Required action: Apply mitigations in accordance with vendor instructions, ensuring complianc

    RANSOMWARE VICTIMS (DLS Monitoring)

    No new ransomware victims reported today.

    NEWS SECTION

    SUMMARY

    Total new items: 117. Critical count: 1. Ransomware groups active: 12. Top CVEs to patch urgently: CVE-2026-8037, CVE-2026-45659, CVE-2026-50548, CVE-2026-50549, CVE-2026-8451.

    Sources: BleepingComputer, TheHackerNews, SecurityWeek, HelpNetSecurity, KrebsOnSecurity, CISA KEV, ransomware.live

    Companion HTML report: Download report (HTML)

  • Cybersecurity Intelligence Report – 01 July 2026

    CRITICAL SECTION

    Automated summary. Full companion report attached.

    Companion report: Companion HTML report

  • Cybersecurity Intelligence Report – 29 June 2026

    CRITICAL

    No critical items in this collection period.

    CISA KEV (last 14 days)

    No CISA KEV items in this collection period.

    RANSOMWARE VICTIMS (DLS)

    stormous: Official Statement: Protecting palatineschool.org Infrastructure, maglificioliliana.com UPDATE-FULL DATA DUMP FREE PART1, lorenzoni-store.com UPDATE-FULL DATA DUMP FREE PART1, montechiaro-store.com UPDATE-FULL DATA DUMP FREE PART1, impulso-store.com UPDATE-FULL DATA DUMP FREE PART1, higuchi-inc.co.jp, HIGUCHI USA, INC, eogb.co.uk, eshacloudqa.com, monoprix.tn

    threeam: acemacon.org

    PrinzEugen: Driving School Software

    qilin: 1-800-dentist, Transcore

    settra: canopybrands.us, conduril.pt, hmcfarms.com, doosan.com, tmscentral.com, va-glass.com, pchome.com.tw, dystar.com, qdi.com, turbodata.com

    krybit: ford.mx

    thegentlemen: Thyssenkrupp Marine Systems (TKMS) GmbH / Atlas Elektronik

    cmdorganization: Fidelity Security Group

    Redact: Hologic, FCCI Insurance Group

    NEWS

    No news items with score ≥5.

    SUMMARY

    Total new items: 32

    Critical count: 0

    Ransomware victims today: 30

    Top CVEs to patch urgently: None listed in this run.

    Sources: BleepingComputer, TheHackerNews, SecurityWeek, HelpNetSecurity, KrebsOnSecurity, CISA KEV, ransomware.live

    Companion HTML report: https://liberpulse.com/wp-content/uploads/2026/06/cyber_report_latest-5.html

  • Cybersecurity Intelligence Report – 29 June 2026

    CRITICAL

    No critical items in this collection period.

    CISA KEV (last 14 days)

    No CISA KEV items in this collection period.

    RANSOMWARE VICTIMS (DLS)

    stormous: Official Statement: Protecting palatineschool.org Infrastructure, maglificioliliana.com UPDATE-FULL DATA DUMP FREE PART1, lorenzoni-store.com UPDATE-FULL DATA DUMP FREE PART1, montechiaro-store.com UPDATE-FULL DATA DUMP FREE PART1, impulso-store.com UPDATE-FULL DATA DUMP FREE PART1, higuchi-inc.co.jp, HIGUCHI USA, INC, eogb.co.uk, eshacloudqa.com, monoprix.tn

    threeam: acemacon.org

    PrinzEugen: Driving School Software

    qilin: 1-800-dentist, Transcore

    settra: canopybrands.us, conduril.pt, hmcfarms.com, doosan.com, tmscentral.com, va-glass.com, pchome.com.tw, dystar.com, qdi.com, turbodata.com

    krybit: ford.mx

    thegentlemen: Thyssenkrupp Marine Systems (TKMS) GmbH / Atlas Elektronik

    cmdorganization: Fidelity Security Group

    Redact: Hologic, FCCI Insurance Group

    NEWS

    No news items with score ≥5.

    SUMMARY

    Total new items: 32

    Critical count: 0

    Ransomware victims today: 30

    Top CVEs to patch urgently: None listed in this run.

    Sources: BleepingComputer, TheHackerNews, SecurityWeek, HelpNetSecurity, KrebsOnSecurity, CISA KEV, ransomware.live

    Companion HTML report: https://liberpulse.com/wp-content/uploads/2026/06/cyber_report_latest-5.html

  • Cybersecurity Intelligence Report  28 June 2026

    CRITICAL SECTION

    No critical items detected today.

    CISA KEV (last 14 days)

    No CISA KEV entries in the last 14 days.

    RANSOMWARE VICTIMS (DLS Monitoring)

    [RANSOMWARE] safepay leaked hellmold-plank.de: [RANSOMWARE] safepay leaked hellmold-plank.de

    [RANSOMWARE] play leaked J&J Gaming: [RANSOMWARE] play leaked J&J Gaming

    [RANSOMWARE] play leaked Kuhnline: [RANSOMWARE] play leaked Kuhnline

    NEWS

    No additional scored news items today.

    SUMMARY

    Total new items: 7. Critical: 0. Ransomware victims today: 3. KEV entries: 0.

    Top CVEs to patch urgently: .

    Sources: BleepingComputer, TheHackerNews, SecurityWeek, HelpNetSecurity, KrebsOnSecurity, CISA KEV, ransomware.live

    Companion report: Download ZIP (HTML inside)

  • Cybersecurity Intelligence Report — 2026-06-27

    Attached companion report: Download HTML report (ZIP)

    [11] First-Ever Exploitation of PTC Windchill Vulnerability Discovered in the Wild (SecurityWeek)  CVEs: CVE-2026-12569

    [11] Ransomware gangs find Europe’s weakest link in third-party suppliers (HelpNetSecurity)

    [10] Chinese-Speaking APT Deploys New TinyRCT Backdoor in Southeast Asia Campaign (TheHackerNews)

    [10] CISA Adds Exploited PTC Windchill RCE Flaw to KEV as Web Shell Attacks Continue (TheHackerNews)

  • Cybersecurity Intelligence Report  2026-06-26

    Companion report attempted upload failed; local path: https://liberpulse.com/wp-content/uploads/cyber_report_latest.html

    CRITICAL SECTION

    [10] [RANSOMWARE] nightspire leaked Grupo Riquelme (ransomware.live/nightspire)
    Victim: Grupo Riquelme | Group: nightspire | Website: www.gruporiquelme.com | Country: PY | Details: – Full Database Backup- Banking & Financial Data- Accounting & Ledger Records- Customer Databases- HR / Workforce Data- User, Role & Permission data- ERP & Critical Business Application Data

    CISA KEV (last 14 days)

    CVE Vendor/Product Score Required Action
    CVE-2026-12569 See CISA — Apply vendor patch / mitigations
    CVE-2026-20230 See CISA — Apply vendor patch / mitigations

    RANSOMWARE VICTIMS (DLS Monitoring)

    nightspire: Grupo Riquelme

    AuditTeam: I-SYS

    incransom: Life Bridges, GSP Crop Science Pvt

    krybit: politur.gob.do, sansilvestre.edu.pe

    anubis: Nachlass Nord

    interlock: Clearview Eye Centre

    chaos: roofdepot.com

    insomnia: *************

    akira: JMS Southeast, Padget Technologies

    morpheus: Delegal Poindexter & Underkofler, P.A.

    qilin: ISOPLUS

    NEWS

    [7] Cisco Catalyst SD-WAN Zero-Day CVE-2026-20245 Exploited to Gain Root Access — TheHackerNews
    An unknown threat actor exploited a recently disclosed high-severity security flaw impacting Cisco Catalyst SD-WAN as a zero-day at least two months before it was publicly disclosed, according to new findings from Google-owned Mandiant.

    The vulnerability, tracked as CVE-2026-20245 (CVSS score: 7.8), allows an authenticated, local attacker to execute arbitrary commands with elevated privileges

    [7] Cisco SD-WAN Zero-Day Exploited Months Before Patching — SecurityWeek

    CVE-2026-20245, the 7th Cisco SD-WAN vulnerability exploited in 2026, was used for months prior to its disclosure and patching.

    The post Cisco SD-WAN Zero-Day Exploited Months Before Patching appeared first on SecurityWeek.

    [7] ControlMonkey connects backup visibility with cloud recovery readiness — HelpNetSecurity

    ControlMonkey announced its Data Backup Correlation, a new capability that extends its Cyber Resilience Platform by connecting data backup posture with cloud configuration recovery. The first release supports AWS Backup and Azure Backup. CISOs and cloud teams often lack full visibility into data backup coverage and available recovery points across critical data sources, including databases, storage accounts, and cloud data services, making it harder to understand what data assets are actually

    [5] Webinar: Why account takeovers remain one of the hardest threats to stop — BleepingComputer
    Account takeover attacks continue to challenge security teams because attackers often operate through legitimate accounts and trusted services. This webinar explores how behavioral AI can help organizations identify compromised accounts faster and automate response workflows. […]

    [5] Cal Water Says No OT Systems Breached in Iranian Handala Cyberattack — SecurityWeek

    Mandiant has helped the California water utility investigate the cyberattack launched by Iranian hacker group Handala.

    The post Cal Water Says No OT Systems Breached in Iranian Handala Cyberattack appeared first on SecurityWeek.

    [5] runZero 5.0 unifies exposure management to accelerate risk reduction — HelpNetSecurity

    runZero has announced runZero 5.0, a major platform evolution designed to help organizations defend their expanding attack surfaces against high-velocity, AI-fueled threats. The new release unifies the exposure management lifecycle into an automated workflow that enables security teams to seamlessly discover assets and network connections, identify and prioritize critical risks, and initiate and validate remediation to proactively reduce exposure and achieve operational resilience. For years,

    SUMMARY

    Total new items: 50. Critical count: 1. Ransomware groups active: 11. Top CVEs to patch: CVE-2026-12569, CVE-2026-20230.

    Sources: BleepingComputer, TheHackerNews, SecurityWeek, HelpNetSecurity, KrebsOnSecurity, CISA KEV, ransomware.live

  • Cybersecurity Intelligence Report — 25 June 2026

    CRITICAL SECTION

    • [13] Cordyceps CI/CD Flaws Expose 300+ GitHub Repositories to Supply-Chain Attacks (TheHackerNews)
      Cybersecurity researchers have flagged a new class of CI/CD workflow weakness that allows attackers to hijack workflows and compromise open-source supply chains.
    • [11] Cisco Unified CM flaw actively exploited to drop webshells (CVE-2026-20230) (HelpNetSecurity) — CVEs: CVE-2026-20230

      CVE-2026-20230, a server-side request forgery (SSRF) vulnerability affecting Cisco’s Unified Communications Manager (Unified CM), is being exploited to drop webshells and achieve remote code execution capability on the underlying server. “Our honeypots are seeing automated sweeps dropping webshells, all via Tor,” threat intelligence firm Defused warned today, after observing initial attacks over the weekend. “The observed chain abuses the WebDialer SSRF to deploy a rog

    • [10] CISA Warns Critical Lantronix EDS5000 Flaw Is Being Actively Exploited (TheHackerNews) — CVEs: CVE-2025-67038
      The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday warned of active exploitation of a critical security flaw impacting Lantronix EDS5000 Series devices, urging Federal Civilian Executive Branch (FCEB) agencies to apply the fixes by June 26, 2026.
    • [10] Amadey and StealC Malware Network Disrupted, 27M Stolen Credentials Recovered (TheHackerNews)
      A coordinated law enforcement operation, in partnership with private sector companies, including Bitdefender, Bitsight, ESET, and Microsoft, has resulted in the takedown of criminal infrastructure powering Amadey and StealC.
    • [10] LastPass customer data exposed through Klue supply chain attack (HelpNetSecurity)

      LastPass disclosed that attackers used OAuth tokens compromised in a supply chain attack on Klue, a market intelligence platform that integrates with CRM and sales tools across organizations, to access customer data stored in its Salesforce environment. “On June 12th LastPass was made aware of an incident that occurred at Klue (klue.com), a third-party market intelligence platform utilized by our go-to-market teams which integrates with our Salesforce and Gong systems,“ LastPass said. “We imm

    CISA KEV SECTION

    CVE Vendor/Product Score Required Action

    RANSOMWARE VICTIMS (DLS Monitoring)

    • anubis: Quest Health Solutions
    • stormous: mlit.com.my UPDATE-FULL DATA DUMP NEW LINK 10GB, jaggroup.com UPDATE-FULL DATA DUMP NEW LINK, maglificioliliana.com, lorenzoni-store.com, montechiaro-store.com, impulso-store.com
    • shinyhunters: Adapt******
    • nova: lpgroup, alejandria, transvill, transvill.com.pe, alejandria.biz, lpgroup.pt
    • akira: Jit Ex, Miami Machine
    • qilin: Cash Canada

    NEWS

    • [9] Law enforcement hits StealC and Amadey malware networks (HelpNetSecurity) —

      Operation Endgame, the largest international law enforcement operation aimed at disrupting ransomware and cybercrime infrastructure across the world, has claimed its latest targets: StealC and Amadey. The notice on disrupted websites (Source: Microsoft) While developed by separate criminal groups, those two malware families work in tandem to compromise devices and harvest sensitive data. Law enforcement and private sector partners, including Microsoft and Proofpoint, coordinated action agains

    • [8] Exploitable CI/CD Vulnerabilities Expose Millions of Repositories to Hijacking (SecurityWeek) —

      The security defects allow unauthenticated users to take control of the open source software supply chain.

    • [7] Mandiant reveals how Cisco SD-WAN zero-day attacks gained root access (BleepingComputer) — New details have been revealed on how hackers exploited a Cisco Catalyst SD-WAN vulnerability tracked as CVE-2026-20245 in zero-day attacks to create rogue root accounts on targeted devices. […]
    • [6] Brinqa BYOAI lets organizations use any AI platform with trusted risk data (HelpNetSecurity) —

      Brinqa BYOAI (Bring Your Own AI), a capability that enables organizations to connect any AI agent, large language model (LLM), or automation platform to Brinqa’s exposure intelligence layer. As enterprises adopt AI, they need to ensure that AI systems use accurate, up-to-date risk data. BYOAI connects existing AI tools to a common source of exposure intelligence, providing a consistent foundation for analysis and decision-making. For enterprises, the difference between AI that delivers meanin

    SUMMARY

    Total new items: 51. Critical items: 5. Ransomware victims today: 17. Top CVEs to patch: CVE-2026-20230, CVE-2025-67038, CVE-2026-20245.

    Sources: BleepingComputer, TheHackerNews, SecurityWeek, HelpNetSecurity, KrebsOnSecurity, CISA KEV, ransomware.live

    Companion report: Cyber report (HTML)

    Companion HTML report: Download report

  • Cybersecurity Intelligence Report  23 June 2026

    Companion HTML report (zipped): https://liberpulse.com/wp-content/uploads/2026/06/cyber_report_latest-1.zip

    CRITICAL SECTION

    No items scoring 10 today.

    CISA KEV (Known Exploited Vulnerabilities)

    No CISA KEV items in the last 14 days.

    RANSOMWARE VICTIMS (DLS Monitoring)

    Unknown: Huntress, HDS (Hdscorp), Gms-net, Cqcrm, Cbassociations, bits-pilani.ac.in, mihana-v.com, belpointeasset.com \ belpointe.com, ehg.bayern, Schumacher Homes, EON Meditech Pvt, graymont.com, eggetttax.ca, sterlinggloballtd.com, Ntd Apparel, NEW PRINZ EUGEN SITE [NOT A CASE FILE], Aerospace & Advanced Composites GmbH, Central Bank of Libya, Union Tractor, NTP B.V. Civil Engineering Construction, Kochs GmbH, NationsBuilders Insurance Services

    NEWS

    [8] What the Latest ShinyHunters Breaches Reveal About Modern Cyberattacks (SecurityWeek) 14 <p>Groups like ShinyHunters are demonstrating that attackers do not necessarily need malware or zero-day exploits to cause massive damage.</p>
    <p>The post <a href="https://www.securityweek.com/what-the-latest-shinyhunters-breaches-reveal-about-modern-cyberattacks/">What the Latest ShinyHunters Breaches Reveal About Modern Cyberattacks</a> appeared first on <a href="https://www.securityweek.com">SecurityWeek</a>.</p>

    [7] North Korean Hackers Blamed for Mastra NPM Supply Chain Attack (SecurityWeek) 14 <p>A malicious dependency the attackers added to over 140 Mastra packages fetches a payload targeting cryptocurrency extensions.</p>
    <p>The post <a href="https://www.securityweek.com/north-korean-hackers-blamed-for-mastra-npm-supply-chain-attack/">North Korean Hackers Blamed for Mastra NPM Supply Chain Attack</a> appeared first on <a href="https://www.securityweek.com">SecurityWeek</a>.</p>

    [6] ShapedPlugin WordPress Pro Plugins Backdoored in Supply Chain Attack (TheHackerNews) 14 Multiple WordPress plugins from ShapedPlugin were compromised in a supply chain attack after unknown threat actors managed to tamper with the official release channels and push backdoor code.

    "Attackers compromised the vendor's build and distribution pipeline, injecting backdoor code into Pro plugin releases distributed through official licensed update channels," Wordfence said in an analysis

    [6] Hundreds of AI-powered iOS apps found exposing credentials (HelpNetSecurity) 14 <p>Mobile app developers are packing AI features into everything from writing assistants to productivity tools and lifestyle apps. New research shows that securing access to those services remains a challenge. LLM API credential leakage via network traffic interception (Source: Research paper) Researchers from Wake Forest University analyzed 444 iOS applications with LLM features and found 282 that exposed exploitable credentials or backend access mechanisms. The affected apps covered 13 categor

    [5] ⚡ Weekly Recap: Browser Bugs, EDR Killers, TV Botnet, OpenBSD Flaw, Android Trojan, and More (TheHackerNews) 14 It’s Monday again.

    This week’s threat list looks painfully familiar: abused integrations, fake tools, poisoned websites, ransomware crews trying to shut down security tools, and mobile malware asking for way too much control.

    The annoying part is how little of this feels new. Weak credentials, sketchy downloads, browser extensions with too much access, and WordPress sites are used to push more

    SUMMARY

    Total new items: 53; Critical: 0; Ransomware groups active: 1; Top CVEs to patch urgently: None.

    Sources: BleepingComputer, TheHackerNews, SecurityWeek, HelpNetSecurity, KrebsOnSecurity, CISA KEV, ransomware.live

  • Cybersecurity Daily — 2026-06-22

    Companion HTML report: Download report

    CRITICAL SECTION — score ≥ 10

    No items scoring 10 or higher today.

    CISA KEV SECTION (last 14 days)

    No CISA KEV items in the collected data.

    RANSOMWARE VICTIMS (DLS Monitoring) — today

    qilin: Taiwan Sintong Machinery Co., Ltd (Victim: Taiwan Sintong Machinery Co., Ltd | Group: qilin | Website: www.twsinto.com.tw | Country: TW | Details: N/A), Sivatel Bangkok (Victim: Sivatel Bangkok | Group: qilin | Website: www.sivatelbangkok.com | Country: TH | Details: N/A), Tri-tec (Victim: Tri-tec | Group: qilin | Website: www.tri-tec.com | Country: US | Details: N/A), Florida Engineering Services (Victim: Florida Engineering Services | Group: qilin | Website: www.florida-engineering-services.com | Country: US | Details: N/A)

    cmdorganization: Wall ISD (Victim: Wall ISD | Group: cmdorganization | Website: www.wallisd.net | Country: US | Details: Wall ISD is an educational institution that serves students in the Wall, Texas area, providing a range of programs and activities for elementary, middle, and high school students. The district emphasizes inclusivity and equal access to education, ensuring that all students, regardless of their backg)

    stormous: jaggroup.com UPDATE-FULL DATA DUMP (Victim: jaggroup.com UPDATE-FULL DATA DUMP | Group: stormous | Details: Full database containing corporate emails (⁠@jaggroup.com⁠), Active Directory domain logins, and clear plain-text passwords.Complete Microsoft Dynamics GP databases, software license keys, financial reports, and system configuration Multiple compressed archives (⁠zBackups.zip⁠, ⁠wetransfer⁠ packages)

    incransom: jktornel (Victim: jktornel | Group: incransom | Country: MX | Details: Unauthorized access has been gained to the company’s confidential files, including client data, proprietary R&D, and financial documentation.)

    nova: Lockers IT (Victim: Lockers IT | Group: nova | Details: LockersIT is a self-owned Bangladeshi IT company founded in 2013, headquartered in Chandpur, that specializes in custom software development with a team of 11-50 employees – allcashdealer.com dealmart24.com dev1.lockersit.com erp.lockersit.com sales.lockersit.com brm.lockersit.com debnathashu.com de)

    nightspire: Artistic Smiles (Victim: Artistic Smiles | Group: nightspire | Website: artisticsmiles.org | Country: US | Details: Data is not available now.)

    NEWS SECTION — other scored items (score ≥ 5)

    SUMMARY

    Total new items: 12. Critical count: 0. Ransomware victims today: 9. Top CVEs to patch: None.

    Sources: BleepingComputer, TheHackerNews, SecurityWeek, HelpNetSecurity, KrebsOnSecurity, CISA KEV, ransomware.live