Open Cyber Threat Intelligence

Security researchers discovered two sandbox escape vulnerabilities in OpenAI's Codex that allowed untrusted code to execute commands on the host system. The more severe, named Heapjack, exploited shared memory in a Node.js process to steal a UUID token and gain unauthorized access to a privileged parent process, enabling remote code execution without user interaction. The second flaw, Overpatch, abused a patch utility in Codex CLI to escalate file write permissions and modify files outside the intended directory via symlink manipulation. Both vulnerabilities were fixed by OpenAI within eight days of disclosure.

A malicious npm campaign distributed counterfeit packages, including 'indexed-btree', designed to mimic the legitimate 'sorted-btree' library. The threat evades npm's install-script restrictions by embedding malicious logic in runtime code—specifically within the BTree.prototype.set() method—triggering execution only when called with a specific key. The malware collects system information, exfiltrates it via Slack and Telegram, and communicates with a C2 server through an Ethereum smart contract on the Sepolia test network using encrypted payloads. The attackers also created nine additional malicious packages with fabricated repositories and commit histories to appear legitimate.

North Korean threat actor WaterPlum conducted a global campaign from December 2025 to July 2026, compromising over 30,000 devices and stealing more than $10.7 million in cryptocurrency. The group targeted job seekers by impersonating legitimate companies and delivering malware through malicious npm packages and Visual Studio Code projects. WaterPlum deployed multiple malware families including BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, and StoatWaffle to steal credentials, cryptocurrency keys, and conduct espionage. The actors are linked to North Korea's 313 General Bureau and operate alongside fraudulent IT worker operations using stolen identities and AI face-swapping during fake interviews.

Security researcher Gal Weizman discovered a new attack technique called BragJack that hijacks AI browser agents through malicious browser extensions. The proof-of-concept targets AI assistants in Chromium-based browsers including Google Chrome's Gemini Live, Perplexity Comet, Microsoft Edge, Opera Neon, and Claude in Chrome by exploiting trust relationships and browser extension capabilities. The attacks use declarativeNetRequest (DNR) rules to manipulate trusted components, enabling unauthorized access to sensitive data and control over AI agents without user interaction. The technique, dubbed 'Prompt Forcing,' allows attackers to send full prompts and instructions to the AI agent, leveraging its legitimate privileges to perform malicious actions.

SolarWinds has patched a high-severity vulnerability, CVE-2026-28326, in its Access Rights Manager (ARM) product that could allow unauthenticated remote code execution due to a hard-coded static key. The flaw affects all versions prior to 2026.2.1 and has been assigned a CVSS score of 8.8. The vulnerability was discovered and reported by Armadin security researcher Kai Huang, but there is no evidence of in-the-wild exploitation to date.

The ShinyHunters cybercrime group breached the Clop ransomware gang's data leak site by exploiting an unauthenticated file upload vulnerability in Grav CMS. They defaced the Tor-based site with ASCII art of Umbreon, their logo, and claimed to have stolen server data including source code, system logs, and the private keys for Clop's onion service. ShinyHunters stated they plan to extort Clop and published a message via the compromised site, marking an escalation in an ongoing feud between the two threat groups.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog due to evidence of active exploitation in the wild. The vulnerabilities—CVE-2025-39682, CVE-2026-53266, and CVE-2025-39964—allow local attackers to achieve memory disclosure, denial-of-service, or local privilege escalation. Red Hat has acknowledged active exploitation and labeled the flaws as high risk, urging immediate remediation. Federal agencies are required to patch these vulnerabilities by September 21, 2026, per Binding Operational Directive 26-04.

CrowdSec disclosed that approximately 170 of its private GitHub repositories were copied on May 22, 2026, due to a supply chain attack stemming from the compromise of a former employee's laptop via malicious TanStack npm packages. The attacker leveraged a GitHub OAuth token from the former employee's account, which had not been revoked promptly after departure. The breach exposed source code, including internal automation scripts, data science models, and the consensus algorithm used in its blocklist system, as well as sensitive information such as 83 user email addresses and investor details from 2020. The initial compromise is linked to CVE-2026-45321, a supply chain attack on TanStack that stole developer credentials.

A critical pre-authentication remote code execution (RCE) vulnerability, CVE-2026-58138, in Orkes Conductor Workflow Platform is being actively exploited in the wild. The flaw exists in versions prior to 3.30.2 and allows unauthenticated attackers to execute arbitrary OS commands by submitting malicious workflow definitions containing JavaScript or Python expressions to the Conductor API endpoint. Exploitation leverages unsandboxed GraalVM evaluators with unrestricted host access, enabling command execution via Java reflection or subprocess calls. Attack attempts have been observed globally, with significant activity originating from Germany, Hong Kong, Indonesia, the U.A.E., and India, and telemetry from multiple security firms confirming ongoing exploitation.

Datadog Security Research has identified two credential harvesting platforms, Loot and UltraVault, which are used to inventory, validate, and exploit stolen credentials, including API keys for cloud and AI services. The platforms are accessible without authentication and support automated validation and post-exploitation actions, such as re-probing credentials and recommending local privilege escalation exploits. The attacker infrastructure has been observed abusing Amazon Bedrock through API calls like GetCallerIdentity, ListFoundationModels, and InvokeModel, indicating active exploitation of compromised AWS credentials, including both long-term and temporary STS credentials.