Cybersecurity Newsfeed - 12/10/26
Daily cybersecurity news covering vulnerabilities, adversaries, trends, breaches, and other notable security developments.
Cybersecurity Newsfeed
📅 12/10/26
🛡️ Vulnerabilities
AnyDesk Linux Pre-Auth RCE (AnyPwn): Security researchers have published a working public exploit for a pre-authentication remote code execution vulnerability affecting AnyDesk Linux. Tracked as AnyPwn, the heap buffer overflow flaw resides in session protocol handling (port 7070) and grants unauthenticated root access. Administrators are urged to update to version 8.0.3 immediately or restrict TCP access. More info More info AhsayCBS Auth Bypass & Command Injection (CVE-2026-105133 & CVE-2026-105134): Threat actors are actively exploiting unpatched vulnerabilities in the AhsayCBS backup management platform. By chaining authentication bypass and OS command injection flaws, attackers deploy JSP webshells, AI-assisted evasion scripts, and disguised XMRig cryptocurrency miners. More info More info NVIDIA DCGM Exporter Memory Exhaustion (CVE-2026-47483): A high-severity vulnerability (CVSS 8.2) in NVIDIA’s DCGM Exporter GPU monitoring tool allows unauthenticated remote attackers to crash telemetry services via exposed profiling interfaces over HTTP, potentially disrupting AI and machine learning workloads. More info
- Critical NetScaler RCE (CVE-2026-107406): Citrix issued an urgent advisory warning administrators to patch a critical remote code execution flaw (CVSS 9.5) affecting NetScaler ADC and NetScaler Gateway appliances configured as SAML identity or service providers. Unauthenticated attackers can achieve arbitrary code execution via memory overflow. More info
🎯 Adversaries
Silent Ransom Group Extorts $207M Without Malware: Leaked internal records reveal that the cybercrime group extorted approximately $207 million from 27 law firms in six months without deploying malware or encrypting files. The group relied on high-pressure phone calls and social engineering to induce employees into uploading sensitive documents to external storage. More info
Hacker Targets South Korean Banks Using ARTEX AI & Claude: A Chinese-speaking threat actor launched disruptive cyberattacks against major South Korean banks (Shinhan, KB Kookmin, Hana). The operation combined the ARTEX AI penetration testing framework with Claude Code agentic sessions to conduct reconnaissance, expose customer data, and trigger localized outages. More info
Google Ads & Bing Redirects Push Claude ClickFix Attacks: Threat actors are abusing legitimate Bing search redirects inside sponsored Google Ads to target macOS users with fake Claude installation portals. Landing pages trick users into running clipboard-pasted Base64 payloads through their terminal. More info
Russian Spies Upgrade Matchboil Framework: Russian-aligned actors updated their Matchboil framework with advanced traffic obfuscation, modular plugins for stealthy lateral movement, and improved credential harvesting routines targeting government and defense entities. More info
📈 Trends
AI SPERA Launches AITEM Exposure Management: AI SPERA introduced AITEM, an AI-powered threat exposure management platform designed to expand attack surface management by correlating external footprints, dark web intelligence, shadow IT, and emerging vulnerabilities. More info
The Third-Party AI Agent Security Blindspot: Third-party AI agents embedded within enterprise SaaS applications inherit broad OAuth scopes and cross-application permissions automatically. This creates expanded blast radiuses across data repositories without traditional SSO or gateway oversight. More info
Chromium Typosquatting Exploits Subtle Character Tricks: Research demonstrates how minimal character variations and encoding mechanics in Chromium-based browsers allow attackers to create visually indistinguishable spoofed domains for credential harvesting and browser-in-the-browser phishing. More info
⚖️ Legal & Governance
CYPFER Co-Founder Arrested in ShinyHunters Extortion Case: Canadian cybersecurity executive Edward Dubrovsky was arrested in Pennsylvania on federal extortion and conspiracy charges linked to ongoing investigations into the ShinyHunters extortion group. More info
Four More U.S. States Sue TP-Link Over Security Claims: Florida, Iowa, Montana, and Nebraska have joined Texas in filing lawsuits against TP-Link Systems. The complaints allege misleading corporate transparency and hardware security claims given historical exploitation by state-sponsored threat groups. More info