OSINT / CyberSec report 01.07.2026 00:07

1. A critical vulnerability in Progress Kemp LoadMaster tracked as CVE-2026-8037 allows unauthenticated attackers to execute arbitrary commands as root (thehackernews.com).

2. The Oracle E-Business Suite vulnerability CVE-2026-46817 is currently being exploited in the wild to take over susceptible instances (thehackernews.com).

3. Ransomware gangs are actively exploiting the Windows BlueHammer privilege escalation flaw in Microsoft Defender (bleepingcomputer.com).

4. The Blackfield ransomware group has demanded a 2 million dollar ransom from the Japanese manufacturer Nidec Corporation (bleepingcomputer.com).

5. Attackers are exploiting a critical authentication bypass vulnerability in SimpleHelp tracked as CVE-2026-48558 to deploy the Djinn Stealer malware (bleepingcomputer.com).

6. Nissan disclosed a data breach affecting employees caused by the exploitation of an Oracle PeopleSoft zero-day vulnerability (bleepingcomputer.com).

7. The National Association of Insurance Commissioners confirmed a data breach involving the same Oracle PeopleSoft zero-day exploited by the ShinyHunters group (bleepingcomputer.com).

8. A malicious Chrome extension masquerading as Perplexity AI was removed from the store after intercepting user search queries and address bar inputs (thehackernews.com).

9. The BioShocking attack technique has been used to trick AI browsers and extensions into leaking user credentials to attackers (thehackernews.com).

10. Apple released security updates for iOS and macOS to patch over 30 vulnerabilities, including four WebKit bugs discovered by AI tools (thehackernews.com).

11. The Mustang Panda APT group is conducting espionage campaigns against the Indian government by using Zoho WorkDrive as a command channel (thehackernews.com).

12. Over 236000 websites using the DCloud Uni-App framework are being utilized for crypto scams, phishing, and wallet draining operations (thehackernews.com).

13. The U.S. government is offering a 10 million dollar reward for information on Russian-linked hackers targeting WhatsApp and Signal users (bleepingcomputer.com).

14. Polymarket confirmed a supply chain attack where malicious JavaScript was injected into its website via a third-party vendor (research.checkpoint.com).