Roundup

A roundup of 44 items curated from across the security community. News UN food agency breach exposes 600,000 Gaza households by Nicolas Krassas. The UN World Food Programme discloses a data breach affecting 600,000 households in Gaza. UNC3753 targets US law firms with vishing and physical intrusion by scriptjunkie (Matt). Mandiant details UNC3753 using vishing and RMM tools for data extortion against US law firms, with some operators attempting in-person theft. CISA: SolarWinds Serv-U flaw now actively exploited by BleepingComputer. CISA adds an actively exploited SolarWinds Serv-U vulnerability to the KEV catalog. ...

A roundup of 89 items curated from across the security community. News Red Hat npm packages compromised via CI/CD pipeline by Florian Roth. Multiple @redhat-cloud-services npm packages ship malicious preinstall hooks from a compromised GitHub Actions OIDC pipeline, targeting cloud tokens, /proc/mem secrets, and persisting through Claude Code and VS Code injection. Dutch police dismantle a 17-million-device botnet. Dutch police and the NCSC dismantled a 17-million-device botnet operating on 200 servers seized from a local hosting provider. ...

A roundup of 82 items curated from across the security community. News Active exploitation of a Cisco Catalyst SD-WAN auth bypass (CVE-2026-20182) by Cisco Talos. Talos is tracking in-the-wild exploitation of CVE-2026-20182, an authentication bypass in Cisco Catalyst SD-WAN Manager and Controller. Pwn2Own Berlin 2026: DEVCORE takes Master of Pwn by Dustin Childs. DEVCORE took Master of Pwn at Pwn2Own Berlin 2026, capping an event that paid $1,298,250 for 47 zero-days. Orange Tsai chained three bugs to RCE as SYSTEM on Exchange for $200,000. ...

A roundup of 44 items curated from across the security community. News Bleeding Llama: unauthenticated memory leak in Ollama (CVE-2026-7482). Cyera Research uncovers a critical pre-auth memory disclosure in Ollama. Self-hosted LLM gateways leak adjacent buffer contents to anyone who can hit the API. More this week (2) Zara data breach exposed 197,000 people by BleepingComputer. RansomHouse claims Trellix source-code breach by BleepingComputer. Techniques and Write-ups Five-bug chain to arbitrary APK install on Samsung Galaxy S25 by ϻг_ϻε. Bugscale chains five separate bugs in Samsung’s cloud gaming component to install arbitrary APKs on the Galaxy S25 from an app with no install permissions. ...

A roundup of 54 items curated from across the security community. News Apache ActiveMQ CVE-2026-40466 exploited in the wild by kmkz. VulnCheck sees CVE-2026-40466 burning in active campaigns: authenticated RCE in ActiveMQ via the vm:// protocol, a bypass of the original CVE-2026-34197 fix. 2,700+ exposed instances on Shodan. Mythos: a long-form look at the stakes, impact, and PR by Kuba Gretzky. Ivan Kwiatkowski’s deep-dive cuts through weeks of hot takes about Anthropic’s Mythos: what the actual capability claims are, what they mean for the bug-finding economy, and what the rollout did to industry trust. ...

A roundup of 189 items curated from across the security community. News Bitwarden CLI compromised via Checkmarx npm Trusted Publishing by /r/netsec. Bitwarden CLI was published as a malicious npm package after a compromise in the Checkmarx Trusted Publishing pipeline. Socket walks through the attack chain and the affected versions. Claude Mythos Has Found 271 Zero-Days in Firefox by Bruce Schneier. 271 Firefox bugs found by Claude Mythos in collaboration with Mozilla. Schneier breaks down the disclosure and what it means for browser security at scale. ...