OSINT / CyberSec report 27.08.2026 00:04

1. CISA warned of active exploitation of a critical remote code execution vulnerability in Gitea tracked as CVE-2026-60004 (The Hacker News).

2. Oracle WebLogic Server vulnerability CVE-2026-21962 is under active exploitation allowing unauthenticated attackers to access critical data (The Hacker News).

3. Threat actors are actively exploiting a high-severity vulnerability in Zimbra Collaboration Suite to compromise over 270 servers (BleepingComputer).

4. Attackers are targeting unauthenticated authentication bypass flaws in the miniOrange SAML 2.0 plugin to gain WordPress administrator access (The Hacker News).

5. INTERPOL Operation Jackal IV resulted in 58 arrests and the identification of 263 suspects linked to West African organized crime groups like Black Axe (The Hacker News).

6. A new phishing-as-a-service platform named AnonyMousKIT uses AI voice agents to trick theft victims into providing passcodes for stolen Apple devices (BleepingComputer).

7. The Mirage2FA phishing campaign has impacted 4500 organizations by abusing Microsoft 365 login flows to bypass two-factor authentication (The Hacker News).

8. A massive distributed denial-of-service attack has disrupted government digital services in Norway (BleepingComputer).

9. Researchers identified a new Windows backdoor named SLEEPWALKER that remains inert until triggered by a specific network packet (The Hacker News).

10. A campaign using 24 npm packages is abusing unpkg mirrors to host fake Cloudflare CAPTCHA pages for phishing purposes (BleepingComputer).

11. New remote access trojans E4del and PINHOLE are using FTP banners as dead drop resolvers to receive command-and-control instructions (The Hacker News).

12. The Los Angeles County Museum of Art confirmed a data breach from last year that exposed employee and customer social security and medical information (BleepingComputer).

13. Nutex Health is investigating a data breach where unauthorized parties exfiltrated information from company servers (BleepingComputer).

14. Paylogix reported that hackers stole financial and health data belonging to tens of thousands of individuals (The Record).

15. The U.S. Department of the Treasury sanctioned Iranian cyber actors for their involvement in attacks against critical infrastructure (The Hacker News).