ThreatsDay: Apache OFBiz RCE, DreamHost Breach, DeFi Site Hijacks + 17 More Stories

Multiple critical security incidents were reported, including a pre-authentication remote code execution vulnerability in Apache OFBiz (CVE-2026-68524) and an authentication bypass flaw (CVE-2026-109928), both now patched. DreamHost suffered a data breach where an attacker exploited a vulnerability to access FTP/SFTP credentials and webmail session data. DeFi websites registered with Name.com were hijacked via DNS changes, leading to $138K in crypto thefts through a Step Drainer malware kit. Additionally, stolen Entra ID credentials were abused to access Microsoft 365 and Azure environments across 27 organizations, with malicious sign-ins traced to IP 199.19.77.84. Android banking trojan Mirax, attributed to threat actor Aquafina, targeted META region users, enabling real-time device control and financial fraud.

AI-extracted · verify before operational use