VulnHub

Framework, a company that specializes in repairable laptops, recently faced a data breach due to a zero-day vulnerability in Metabase, a business intelligence tool. Attackers exploited this vulnerability and gained unauthorized access to sensitive customer information, including names, email addresses, phone numbers, physical addresses, and login IP addresses. However, the breach did not compromise payment information or order records. Framework informed affected customers about the incident, emphasizing the importance of safeguarding personal data. This incident raises concerns about the security of business intelligence tools and the potential risks to customer data across various companies that utilize such services.

A new attack method known as 'Ghostjacking' has emerged, where attackers manipulate logs to control AI agents. By embedding malicious instructions into logs or alerts that record blocked requests, these agents can be tricked into executing harmful commands. This poses a significant risk, particularly for organizations that rely on AI to automate processes or manage security alerts. The implications are serious, as compromised AI systems could lead to unauthorized actions and data breaches. Companies using AI technology need to be vigilant about how logs are managed and ensure they are protected against such manipulations.

Recent research has shown vulnerabilities in passkey systems designed to enhance online security by replacing traditional passwords and resisting phishing attacks. Three separate studies demonstrated methods for bypassing these protections without breaking the underlying cryptography. For instance, attackers were able to exploit signed authentication data exposed by Windows, leverage a cloud-synced passkey system compromised by existing malware on a victim's device, and other techniques. This is concerning for users and organizations relying on passkeys for secure authentication, as it suggests that even advanced security measures can be undermined. As these attacks become more sophisticated, it raises questions about the reliability of passkeys and the need for ongoing vigilance in security practices.

The Cybersecurity and Infrastructure Security Agency (CISA) and the FBI have issued a warning about the Gunra ransomware group, which is targeting multiple sectors of critical infrastructure. Organizations in areas such as healthcare, energy, and government are particularly at risk. Researchers have noted that Gunra actors are employing sophisticated tactics to infiltrate systems and encrypt sensitive data, demanding ransom for its release. This situation is concerning as it poses a threat to essential services that many rely on daily. Companies are urged to bolster their cybersecurity measures and remain vigilant against potential attacks.

Hackers believed to be linked to Iran have targeted industrial control systems (ICS) at water facilities across at least a dozen states in the U.S., including New Jersey and Alabama. This cyberattack raises serious concerns about the security of critical infrastructure, as these systems are essential for managing water supplies. While specific details on how the hackers gained access have not been disclosed, the incidents indicate a growing trend of cyber threats against vital public services. The implications of such attacks could be severe, potentially disrupting water services and endangering public safety. Authorities are urging water facilities to bolster their cybersecurity measures in response to these incidents.

N-able has released a second hotfix for its N-central remote monitoring and management solution due to ongoing exploitation of the vulnerability identified as CVE-2026-18577. This new hotfix, referred to as Hotfix 2, is critical even for those who have already applied the first hotfix, as it includes additional security measures aimed at protecting users and their customers from active attacks. The company has also shared indicators of compromise that have been observed in these attacks, highlighting the seriousness of the situation. Managed service providers using N-central should prioritize applying this hotfix to enhance their defenses against these threats and protect their clients' systems.

A group known as Head Mare has been exploiting vulnerabilities in unpatched TrueConf servers to carry out attacks against various Russian companies. These companies operate in sectors like instrumentation, electronics, transport, energy, IT, and software development. Kaspersky, a cybersecurity firm, reported detecting these attacks in July 2026. The attackers are reportedly replacing legitimate client installers with malicious software called PhantomCore, which could compromise the security of the affected organizations. This situation raises concerns for companies still using outdated versions of TrueConf, as failure to update could lead to severe security breaches.

OpenAI has decided to pause work on its Astra model due to significant cybersecurity risks identified during internal evaluations. The company found that Astra's capabilities could potentially reach a Critical risk level according to its Preparedness Framework. This decision indicates that the model's cybersecurity functions raised enough concern that OpenAI could not confidently rule out the possibility of serious vulnerabilities. As a result, the company is reassessing Astra to ensure it does not pose a threat to users or systems. This incident highlights the importance of rigorous testing and evaluation in AI development to prevent potential security issues before deployment.

Metabase has patched a significant security vulnerability that allowed unauthenticated remote attackers to gain administrative access to its instances. This flaw posed a serious risk, as it enabled attackers to potentially manipulate data and settings without needing any credentials. The issue has been classified as a zero-day exploit, meaning it was actively being exploited in the wild before the patch was released. Users of Metabase should ensure they update to the latest version to protect against this vulnerability. This incident serves as a reminder of the importance of timely software updates and vigilant security practices in safeguarding sensitive data.