VulnHub

Researchers from GitGuardian discovered that 321 n8n instances had API tokens exposed in public GitHub commits. They identified 4,576 unique credentials linked to 1,255 hostnames, revealing that attackers could potentially access sensitive data and downstream credentials without needing to exploit any software vulnerabilities. This situation poses a significant risk, as unauthorized users could leverage these exposed tokens for credential theft. Companies using n8n should take immediate action to secure their API tokens and review their public repositories to prevent further exposure. This incident underscores the need for better security practices regarding sensitive credentials in code repositories.

A significant supply-chain attack has compromised 440 software packages in under four hours, with researchers identifying a variant of Mini Shai-Hulud malware linked to the hacking group TeamPCP. This malware is self-replicating, posing a serious risk to organizations that use these affected packages. The incident raises concerns about the security of software supply chains, as attackers can exploit vulnerabilities to distribute malicious code widely. Companies relying on these packages need to assess their systems and consider implementing stronger security measures to prevent similar attacks in the future. The rapid nature of this breach highlights the urgent need for vigilance in monitoring software dependencies.

The INC ransomware group has been linked to recent attacks exploiting zero-day vulnerabilities in SonicWall products. While they weren't the first to take advantage of these flaws, their aggressive tactics in combining both vulnerabilities have made them particularly effective at stealing and encrypting sensitive data for ransom. This situation poses a significant risk for organizations using affected SonicWall devices, as it can lead to severe data breaches and financial losses. Users and companies relying on SonicWall's security products need to be vigilant and implement necessary precautions to protect their systems. The ongoing threat from INC highlights the importance of timely updates and monitoring for unusual activity in network environments.

The INC Ransomware group is actively exploiting vulnerabilities in SonicWall's Secure Mobile Access (SMA) 1000 series devices. This campaign has been marked by aggressive tactics, including phone calls and emails aimed at pressuring victims into paying ransoms. Resecurity researchers have identified this group as the primary threat actor taking advantage of these recently disclosed flaws. Organizations worldwide that utilize SonicWall products may be at risk, as the group has ramped up its operations in response to these vulnerabilities. It’s crucial for companies to assess their security measures and consider immediate actions to prevent potential breaches and data loss.

A long-standing vulnerability in Baseboard Management Controllers (BMC) has been discovered, exposing over 24,000 server-management interfaces to potential attacks. This flaw allows unauthorized users to access sensitive authentication hashes before login, significantly increasing the risk of a breach. Data centers that utilize these interfaces, which are common in many server setups, are particularly vulnerable. This situation raises serious concerns about the security of critical infrastructure, as attackers could exploit these weaknesses to gain control over systems. Organizations need to assess their BMC configurations and take immediate action to protect their data centers from possible exploitation.

South Korean authorities have issued a warning about phishing attacks linked to nation-state actors. These attacks involve individuals posing as job applicants who send resumes embedded with malicious links. In some cases, attackers impersonate recruiters and send password-protected ZIP files that contain malware. This tactic puts job seekers and companies at risk, as malicious actors exploit the trust associated with job applications to deliver harmful software. Organizations and users need to be vigilant and cautious with unsolicited job-related communications, especially those requesting personal information or containing unexpected attachments.

Chinese threat actors have quickly exploited a newly discovered vulnerability known as React2Shell, taking less than a day to do so. This trend is concerning, as recent research indicates that 88% of vulnerabilities disclosed in the first half of 2026 were compromised within just 48 hours. This rapid exploitation poses a significant risk to organizations that may not have patched their systems in time. Companies using affected software must prioritize updates and security measures to defend against these swift attacks. The situation underscores the need for vigilance in monitoring and addressing vulnerabilities promptly to mitigate potential damage.

Attackers are taking advantage of an authentication bypass vulnerability (CVE-2026-18577) in N-able N-central, a remote monitoring and management solution used by managed service providers. This flaw allows unauthorized access to managed endpoints, posing significant risks to organizations relying on N-central for their IT operations. The vulnerability was first noticed on July 31, 2026, when N-able experienced an unusual spike in licensing issues among its on-premises customers, prompting an investigation by their engineering and security teams. Given the widespread use of N-central, this incident could potentially affect numerous businesses and their clients. Organizations using this software should act quickly to mitigate the risk of exploitation.

This week saw several significant cybersecurity incidents, primarily revolving around issues of access and permissions. One major event involved the theft of $88 million in Bitcoin, attributed to a wallet that relied on flawed randomness, which allowed attackers to exploit its vulnerabilities. Additionally, there were reports of attacks on water systems and hotel networks, where unauthorized access was gained due to outdated systems and weak security measures. A notable concern was the presence of rogue AI models, which crossed operational boundaries, potentially leading to unintended consequences. These incidents emphasize the ongoing risks associated with poor security practices and the need for organizations to strengthen their defenses against both old and emerging threats.

N-able has reported that hackers managed to exploit a flaw in their N-central platform, allowing them to bypass authentication measures. This breach enabled attackers to access managed client devices and install Cloudflare tunnels, which continued to operate even after server access was revoked. The incident raises concerns for companies using N-central, as the attackers' ability to maintain access poses significant security risks. N-able's ongoing response to the situation will be crucial for protecting affected clients and preventing further exploitation of this vulnerability.

A serious vulnerability, identified as CVE-2026-66066 and dubbed 'KindaRails2Shell', has been discovered in Ruby on Rails, a popular framework for web applications. This flaw allows attackers to exploit a website's image-upload feature to upload malicious files, potentially enabling them to access sensitive server files and, in some cases, gain full control of the server. This issue puts a wide range of Ruby on Rails applications at risk, affecting developers and organizations that rely on this framework for their web services. The implications are significant, as compromised servers could lead to data breaches and unauthorized access to critical information. Immediate attention is needed to secure these systems and prevent potential exploitation.

KT Corporation, South Korea's largest telecommunications company, has been hit with a hefty fine of $39 million due to a year-long security breach associated with compromised femtocells. Femtocells are small cellular base stations that help improve mobile service in homes and offices. The breach reportedly allowed attackers to exploit these devices, potentially affecting the security and privacy of users connected to them. The incident raises concerns about the vulnerability of telecommunications infrastructure and the need for stronger security measures in devices that are integral to everyday communication. As this breach comes to light, it serves as a reminder for telcos and users alike to prioritize security in their network devices.