Threadlinqs

@threadlinqs.bsky.social

24 Followers 10 Following

The Unified Security Engineering and Intelligence platform threadlinqs.com

Metabase Zero-Day (GHSA-vwf4-m7j8-wcjf) Exploited in the Wild for Unauthenticated Admin Access
RovoBlast: One-Click rovoChatPrompt Parameter-to-Prompt Injection in Atlassian Rovo Exposes Confluence, Jira, SharePoint, and Bitbucket Data
Unit 42: Identity Compromise Is the Primary Attack Vector in Nearly 90% of Incidents
Unauthenticated Metabase SQL Injection Zero-Day (GHSA-vwf4-m7j8-wcjf) Exploited to Steal Framework and Tally Customer Data
ClickFix Attacks Deliver Go-Based macOS Infostealer Targeting Crypto Wallets and Keychain Data
Nearly 800 Malicious npm Packages Deliver Cross-Platform WEL1DROPPER RAT and Infostealer ('Flooding Dropper' Campaign)
GepyS Banking Malware and Rust Clipboard Hijacker: Two H1 2026 Attack Chains (Gen Digital)
WordPress Core XSS2Shell Vulnerability Chains Pre-Auth XSS to RCE (CVE-2026-64638)
CI Fortify: CISA/ASD/NCSC-UK/CCCS Joint OT Isolation Guidance Exposes Communications-Continuity Gap for Critical Infrastructure Operators
Google Chrome 151 Update Fixes 41 Security Vulnerabilities, Including 6 Critical Flaws
Microsoft 365 AitM Phishing Campaign Hijacks Sessions via Residential Proxies to Harvest Payroll and Finance Emails
Claude Code RCE via Malicious .mcp.json in Pull Request Branches
Bendix EC80 Truck Brake Controller: 2024 Safety Recall Covertly Patched RCE and DoS Vulnerabilities
NatJack: NAT Connection-Tracking Manipulation Attacks Hijack TCP Sessions Across Windows, Linux, and macOS (CVE-2026-56181, CVE-2026-63913)
UNC6671 Automates Microsoft 365 Data Theft via Vishing-Driven AiTM Phishing and Session Hijacking
CVE-2026-65400: macOS Screen Sharing Authentication Bypass Grants Unauthenticated Root Access
"When Agentic Glue Melts": Five workerd Memory-Corruption Flaws Enable Cross-Tenant Secret Theft and Code Mode Sandbox Escape on Cloudflare Workers
Claude in Chrome "PleaseFix" Prompt-Injection Flaw Enables Gmail/Slack/X/Claude.ai Account Takeover
AI Recommendation Poisoning: Prompt Injection via Deep-Linked 'Ask AI' Buttons Silently Alters LLM Memory
Odysseus AI Workspace Remote Code Execution via Authorization Bypass - GHSA-xwhc-f36c-v5vm (CVSS 9.9)
ClickFix Attack Delivers Go-Based macOS Infostealer Targeting Cryptocurrency Wallets and Credentials
CVE-2026-64561 - Zapscape: KVM/x86 Shadow MMU Use-After-Free Allows L1 Guest Escape to Linux Host
Researcher Demonstrates Full C2 Inside ChatGPT Secure Sandbox via Chained Attack Techniques at Black Hat USA 2026
GOLD ENCOUNTER / Payouts King Ransomware Campaign Targeting Business Managers: 351 Victims Across 334 Organizations
Cardiology Associates of Port Huron (Port Huron Heart Center) Breached by Orova Ransomware Group - 12.90 GB of Patient Data Exfiltrated
VMware Aria Operations Vulnerabilities - CVE-2026-22719 Command Injection (Active Exploitation), CVE-2026-22720 Stored XSS, CVE-2026-22721 Privilege Escalation
Vanta Stealer - Python-Based Cross-Platform Information Stealer Using Layered PyArmor Obfuscation
OWASP GenAI LLM Top 10 2026 - Community-Driven Security Guidance for AI Applications
Critical Cisco IMC Argument Injection (CVE-2026-20200) Enables Root RCE on UCS C-Series M7/M8 Standalone Servers - Public PoC (CIMCown)
Token Jacking: Cybercriminals Steal and Resell AI API Keys/Tokens via Transfer Stations
Attackers Compile khunt Toolkit Inside Oracle Database to Escalate SQL Injection to Windows SYSTEM Access
CVE-2026-54876 - OpenSSL Client-Side Memory Leak in OCSP Response Checking (Denial of Service)
Larva-26005 APT Campaign: Xctdoor and CRAT Backdoors Targeting South Korea (2020-2026)
Over 250 Fake Download Domains Deliver AMOS and MacSync Infostealers via ClickFix with Server-Side Browser Fingerprinting Evasion Gate
ENDLESSDOORS: Zbtlink Router Firmware Contains rctl Backdoor (CVE-2026-66747) Across 20+ Models
Multiple Critical Vulnerabilities in Cisco Catalyst SD-WAN Software (CVE-2026-20303, CVE-2026-20304, CVE-2026-20310, CVE-2026-20312, CVE-2026-20313)
Coldcard Hardware Wallet Firmware RNG Vulnerability (Yasmarang Fallback) Leads to ~$116M Bitcoin Theft
Khunt Post-Exploitation Toolkit Deployed via Oracle Database JVM (Huntress Discovery)
Ransom Cartel ransomware creator Maksim Silnikau sentenced to 16 years in federal prison
Samsung Bixby Exploit Chain - System-Level RCE via Samsung Members, Samsung Account, and Capsule Bypass (CVE-2025-21079, CVE-2025-58486, CVE-2025-58487)
AISI Cyber Test: Autonomous AI Agent (Anthropic Claude Mythos 5) Attempts Supply-Chain Attack via Social Engineering of Open-Source Maintainer
Over 250 ClickFix Domains Use Browser Fingerprinting to Hide macOS Malware Lures - Atomic Stealer (AMOS) and MacSync Campaign
Pre-auth RCE chains in Bonita BPM 10.4.3 and Apache OFBiz 24.09.05 (CVE-2026-31986)
Agent-to-Agent Privilege Boundary Failures in Google ADK for Python (adk-python) CI/CD Workflows via Cross-Agent Prompt Injection
Coldcard Security Audit Phishing Campaign Installs ConnectWise ScreenConnect RAT
Greatness PhaaS - AiTM phishing platform targeting Microsoft 365 and multi-platform credentials via spoofed RingCentral voicemail campaigns
macOS ClickFix Campaign Using Browser Fingerprinting Gate to Distribute Atomic Stealer (AMOS) and MacSync Infostealers
CVE-2026-9198 - Unauthenticated RCE in IBM Langflow Under Active Exploitation (Auto-Login Bypass + Code Injection Chain)
Paperclip AI Flaws Let Attackers Run Host Commands via Malicious Agent Imports
August 2026 Patch Roundup: 11 Critical/High CVEs in Veeam VSPC (CVE-2026-58073, CVSS 9.5), HashiCorp Terraform MCP Server (CVE-2026-16498, CVSS 10.0), and Django
Google Blogger Automated Malware False Positive Locks Hundreds of Blogs - Platform-Wide Enforcement Error Triggered by Tightened Safe Browsing Post-VEIL#DROP (August 2026)
Immigration & Asylum Policy as an Enabler of Transnational Repression (Citizen Lab / Foreign Policy Centre policy analysis, IALDF v. Rubio lawsuit, Freedom House 2026)
Three PhaaS Kits (Sneaky 2FA, EvilTokens, EvilProxy) Targeting US Organizations to Steal M365 Credentials and Session Tokens
OVSWrap (CVE-2026-64531): Linux kernel Open vSwitch datapath 16-bit nla_len wraparound local privilege escalation with public PoC targeting ~800 x86-64 kernel builds
Pass-ta-Key Attacks Let Malware Hijack Google Password Manager Synchronized Passkeys (Chrome on Windows)
CVE-2026-34486: Apache Tomcat EncryptInterceptor Bypass Actively Exploited in SnowLight and AI-Assisted Campaigns
Botnet Scanning Internet-Exposed Router Diagnostic Tools Exploiting OS Command Injection (CVE-2024-12856, CVE-2013-7179, CVE-2020-8949, CVE-2024-48419)
ELECTRUM (Russian state-linked) PathWiper destructive wiper campaign targets Ukrainian ISPs and Polish CHP/energy facilities
Sage Water Resources Utah saltwater disposal facility PLC intrusion - Iranian IRGC-CEC (CyberAv3ngers) logic manipulation bypasses pump safeguards
Octagon Android RAT - Fake Bahrain Civil Defense App Targets Mobile Endpoints via Multi-Stage Payload