Open Cyber Threat Intelligence

Wiz Research has identified a campaign named Gheist that abuses stolen GitHub tokens to deploy malicious workflows across both public and private repositories. The attack creates a branch named ci-sync- followed by random characters and commits a workflow file designed to exfiltrate repository secrets by encoding them in base32 within workflow logs, bypassing GitHub's secret masking. The campaign has evolved with multiple variants, including one that targets self-hosted runners to collect system-level credentials. While GitHub's approval controls have prevented execution in public repositories, the attack has successfully run in private repositories and enterprise environments, leading to credential exfiltration and follow-on cloud access.

CVE-2026-109518 is a critical vulnerability in the apt package manager used by Debian, Ubuntu, and their derivatives, allowing an on-path attacker to swap a package after its hash verification and execute arbitrary code as root. The flaw exploits apt's HTTP download resume functionality, where an attacker can merge two downloads, force a retry, and overwrite the verified file with a malicious payload before installation. This affects systems with non-zero Acquire::Retries settings, which is default in Debian 12+ and Ubuntu 22.04+, impacting CI/CD pipelines, container builds, and developer machines that install packages over untrusted or compromised networks.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2024-27834, a medium-severity improper authentication vulnerability in multiple Apple operating systems, to its Known Exploited Vulnerabilities catalog due to active exploitation. The flaw, which allows bypass of Pointer Authentication, was patched by Apple in May 2024 but has since been exploited in the wild by APT29 (Cozy Bear), a Russia-linked state-sponsored group. Attackers leverage the vulnerability through malicious JavaScript delivered via compromised websites, fake sites, and a supply chain attack on Plerdy SEO Tracker, combining it with CVE-2025-43529 to execute code and steal browser cookies and device data.

Researchers at Binarly discovered that Zyxel's earlier firmware patch (Patch 2) for GS1900 switches failed to fully mitigate a critical zero-day vulnerability, CVE-2026-107441, which allows unauthenticated attackers to execute root-level commands via a web interface memory corruption flaw. The vulnerability stems from an out-of-bounds write due to missing input size and count validation, enabling exploitation even after Patch 2 was applied. A new firmware update (Patch 3) has been released to properly address the issue. GreyNoise observed active exploitation of related infrastructure, with attackers exfiltrating switch configurations and credentials, linked to a Chinese-speaking group tracked as Red Heron.

In October 2026, multiple cyber threats targeted US enterprises using phishing kits, malware, and abuse of legitimate services. SkyW4lker, GeorgeGinx, and Mir0Auth are phishing campaigns exploiting Microsoft 365 device-code authentication to compromise corporate accounts without stealing passwords or bypassing MFA. Fake AI campaigns impersonated popular AI services to steal credentials via trojanized installers and fake event invitations. WKLP is a Python-based infostealer and RAT that disables Microsoft Defender, terminates security processes, and establishes persistent remote access on compromised systems. These threats leveraged trusted platforms like Adobe Shared Links and DocuSign to evade detection and increase success rates.

Multiple critical security incidents were reported, including a pre-authentication remote code execution vulnerability in Apache OFBiz (CVE-2026-68524) and an authentication bypass flaw (CVE-2026-109928), both now patched. DreamHost suffered a data breach where an attacker exploited a vulnerability to access FTP/SFTP credentials and webmail session data. DeFi websites registered with Name.com were hijacked via DNS changes, leading to $138K in crypto thefts through a Step Drainer malware kit. Additionally, stolen Entra ID credentials were abused to access Microsoft 365 and Azure environments across 27 organizations, with malicious sign-ins traced to IP 199.19.77.84. Android banking trojan Mirax, attributed to threat actor Aquafina, targeted META region users, enabling real-time device control and financial fraud.

Researchers from Check Point discovered a vulnerability in OpenAI's ChatGPT that allowed attackers to bypass Lockdown Mode protections via HTML page previews in code blocks, enabling zero-click data exfiltration and malicious payload delivery. The flaw exploited improper sandbox handling of popup windows in nested frames, allowing escape from restricted environments and unauthorized outbound communication. OpenAI patched the issue after responsible disclosure on September 18, 2026, but the finding highlights risks in AI application security controls beyond the model itself.

OpenSSH released an emergency critical update (version 10.6p2) to address a vulnerability that allows attackers to bypass SSH authentication on Alpine Linux systems by using long passwords (257–1,024 bytes) to log in to passwordless accounts. The flaw affects systems running OpenSSH without PAM, where password authentication is enabled and at least one local account has a password hash. The vulnerability stems from interaction between OpenSSH and musl C library, and impacts Alpine Linux, OpenWrt (if OpenSSH is installed), Buildroot, and Yocto. No CVE has been assigned yet, and no active exploitation has been reported.

A vulnerability in Android, dubbed 'GhostMap', allows a malicious app to trigger a persistent boot loop on affected devices by exploiting inconsistent ZIP compression method handling in Android libraries. The app does not require permissions or user interaction beyond installation, and causes the system_server process to crash repeatedly by mapping a file into an unallocated memory region, triggering a SIGBUS signal. Bitdefender discovered the flaw while analyzing an Android banking trojan and demonstrated it on a Pixel 10 running Android 17; Google has classified the issue as 'not reproducible' and has not issued a patch.

DigiCert disclosed a data breach resulting from a misconfigured server migration in February 2025 that inadvertently exposed an internal business system to the internet. The system, which had a self-registration feature, allowed unauthorized external users to create accounts and, due to an authorization flaw, gain read-only access to archived customer information. Between June 27 and July 2, 2026, an unauthorized account accessed sensitive customer data including names, business email addresses, phone numbers, business addresses, and in some cases, identity documents such as driver's licenses, passports, and utility bills.