Open Cyber Threat Intelligence

Pokémon Center disclosed a data breach affecting customers in the United Kingdom and Germany due to a cyberattack on its third-party logistics provider, CEVA Logistics, which was compromised between July 29 and August 1, 2026. The breach exposed customer personal information including full names, mailing addresses, phone numbers, email addresses, and order details. Although payment card data was not accessed, the incident led to order cancellations and shipping delays. CEVA Logistics, a subsidiary of CMA CGM Group, confirmed the breach impacted multiple European retailers, including Valve, which also reported stolen customer data.

GitLab has patched a critical vulnerability, CVE-2026-19478, affecting its self-managed Community and Enterprise Editions, which could allow unauthenticated attackers to remotely modify or delete public projects and user data under certain conditions. The flaw exists in the GraphQL implementation and can be exploited over the network without authentication or user interaction. The vulnerability impacts versions 18.2 to 18.11.10, 19.0 to 19.0.7, 19.1 to 19.1.5, and 19.2 to 19.2.3. A second high-severity issue, CVE-2026-19650, was also fixed, involving a CSRF vulnerability in the GraphQL multiplex query handler that allows unauthenticated mutation execution via GET requests under certain conditions.

Evooo1Bot is a newly identified Linux botnet derived from Mirai source code that targets internet-facing edge devices by exploiting known vulnerabilities. It installs a SOCKS5 proxy on compromised systems, enabling threat actors to route traffic through infected devices for evasion and anonymity. The malware includes an exploit toolkit targeting multiple CVEs, performs anti-analysis checks, and communicates with C2 servers over encrypted channels on port 443. It supports various post-compromise actions including DDoS attacks, credential sniffing, SSH brute-forcing, and lateral movement.

Iranian nation-state actors linked to Cavern (aka Cav3rn) C2 framework have evolved their infrastructure to blend malicious traffic with legitimate services, using DNS A-record queries to dynamically switch between direct HTTPS and Google Apps Script relays for command-and-control. A new module, HOLLOWGRAPH, abuses Microsoft 365 calendars via the Graph API to exfiltrate data and receive commands, with events scheduled far into the future to avoid detection. The framework uses a modular architecture with components like GoogleService.dll and rnp.dll, leveraging legitimate cloud services to evade perimeter defenses and maintain persistence.

A critical vulnerability, CVE-2026-15748, exists in the Forminator Forms WordPress plugin that allows unauthenticated attackers to upload arbitrary PHP files, leading to remote code execution on vulnerable sites. The flaw affects all versions prior to and including 1.56.1 and stems from insufficient file type validation in the 'handle_file_upload()' function, which can be bypassed using alternative MIME types. Exploitation is possible when a form contains both a File Upload and a Select field, and custom upload directories without proper .htaccess protection increase the risk of successful code execution.

A workflow injection vulnerability was discovered in Snowflake's public GitHub repository 'snowflakedb/snowflake-connector-net' that allowed a crafted GitHub issue to trigger command injection in a CI/CD pipeline. The vulnerable workflow (.github/workflows/jira_issue.yml) directly embedded untrusted issue data into a shell run block, exposing internal Jira credentials including an API token. Researchers from Wiz exploited the flaw during authorized testing, successfully retrieving the Jira API token, which granted read access to internal engineering and security projects. The vulnerability was introduced via a commit on August 25, 2025, and was fixed on June 23, 2026, after being reported via HackerOne; no evidence of external exploitation was found.

A threat actor using the alias 'TheHatman' is selling alleged employee databases stolen from the Microsoft Azure environments of multiple Fortune 500 companies, including McDonald's, Gap Inc., Vodafone, Tata Consultancy Services, HCL Technologies, InterContinental Hotels, Wyndham Hotels, Hexaware, and Kyndryl. The actor claims to have obtained the data using compromised credentials, potentially via password spray and MFA fatigue attacks. The datasets reportedly include employee names, email addresses, job titles, phone numbers, addresses, service accounts, and tenant-specific Azure structures. While some companies like Tata and Gap have stated there is no evidence of a breach and that the data may be outdated, cybersecurity firm Hudson Rock has analyzed samples and confirmed the data contains authentic corporate directory attributes and could be used for social engineering or spearphishing.

Wiz Research's AI-powered Red Agent discovered a critical script injection vulnerability in a GitHub Actions workflow within Snowflake's public repository snowflakedb/snowflake-connector-net. The vulnerability was introduced on June 18, 2026, via an AI-generated 'autofix' commit that removed safe input handling, allowing unauthenticated users to execute arbitrary commands by opening a maliciously titled GitHub issue. Wiz successfully exploited the flaw to exfiltrate Snowflake's Jira API token, which granted read access to internal engineering and security projects. Snowflake patched the workflow, rotated credentials, and confirmed no unauthorized access occurred beyond Wiz's testing.

Multiple active threats were reported this week, including exploitation of critical vulnerabilities in VMware, Apple macOS, and GeoServer, as well as ongoing campaigns by state-linked actors. A suspected China-nexus APT exploited CVE-2026-59310 in VMware vCenter to deploy Babuk-derived ransomware, likely as a forensic distraction. The Lazarus Group leveraged a Windows zero-day (CVE-2026-68820) in a campaign dubbed Operation Dream Job, targeting aerospace and defense sectors. GeoServer faced active exploitation of a critical SQL injection flaw prior to patching. Additionally, new macOS malware Amnesia Stealer enables real-time browser hijacking via Chrome DevTools Protocol, stealing authenticated sessions and sensitive data.

Certighost, tracked as CVE-2026-54121, is a critical vulnerability in Active Directory Certificate Services (AD CS) that allows a low-privileged domain user to coerce an Enterprise Certification Authority (CA) into issuing a valid authentication certificate for a Domain Controller. This is achieved by exploiting a 'chase' functionality flaw where the CA follows attacker-supplied routing information without validating the target endpoint, enabling the attacker to forge identity data and obtain a certificate impersonating a Domain Controller. The attacker can then use PKINIT to obtain a Ticket Granting Ticket, perform DCSync to extract credentials including the krbtgt hash, and achieve full domain compromise. The vulnerability was patched by Microsoft on July 14, 2026, but the underlying risk stems from standing privileges like default MachineAccountQuota settings that allow unprivileged users to create machine accounts.