Coverage: Last 24 hours
Today’s Highlights
Major vulnerabilities in core infrastructure, from Linux KVM to Cisco SD-WAN and emerging issues in cloud, AI, and ICS environments, demand attention. Defenders must focus on patching, exposure reduction, and proactive monitoring amidst increasingly sophisticated cross-layer attack chains. Themes shaping the day’s risk landscape include critical infrastructure exposure, cloud and SaaS supply chain risk, AI prompt injection, privilege escalation, and flaws undermining hypervisor and OS isolation.
Table of Contents
- Canadian Man Pleads Guilty in Snowflake Extortions
- Snowflake Hacker Pleads Guilty in US Court
- New Zapscape KVM Flaw Could Let Privileged L1 Guest Code Escape to Linux Hosts
- Cisco Patches 12 SD-WAN and IOS XE Flaws, Including Three 9.8 CVSS Score Bugs
- New Interrupt Injection Attack Can Bypass Spectre v2 Defenses on Intel and AMD CPUs
- ThreatsDay: Odysseus RCE, Samsung One-Click Takeover, iCloud Backdoor Fight + 27 More Stories
- Over 4,400 Rockwell PLCs Exposed Online, 22 Found in Water Attack Cities
- Apple iCloud Private Relay Can Expose Real IPs Through WebKit Proxy Bypasses
- Attackers Compile khunt Inside Oracle to Turn SQL Injection Into Windows SYSTEM Access
Top Stories
Canadian Man Pleads Guilty in Snowflake Extortions
Source: Krebs on Security | Risk: High | Impacted: Snowflake tenants, Organizations with shared cloud storage, Data owners subject to privacy regulations
Summary: A 26-year-old Canadian man once described as one of the most consequential cybercrime threat actors of 2024 has pleaded guilty to computer fraud and conspiracy to hack and extort more than 165 organizations that used the cloud data storage provider Snowflake. Connor Riley Moucka, of Kitchener, Ontario, also admitted to stealing call and text history records of more than 100.
Why it matters: Lack of robust controls on cloud data storage platforms creates opportunities for mass exploitation and extortion campaigns that can impact hundreds of organizations in a single actor’s campaign.
Practitioner Perspective
Organizations reliant on cloud storage providers like Snowflake are attractive targets for cybercriminals if access controls and breach response processes are weak. This case illustrates how one attacker can pivot across multiple tenants and compromise sensitive communication records, amplifying downstream supply chain and privacy risk. Defenders must not assume the provider’s security boundary is sufficient, effective monitoring, anomaly detection for data access, and regular privilege reviews are essential. The operational risk is most acute for organizations reusing credentials or lacking event audit trails in the cloud stack. Invest in federated identity and cloud provider log correlation now, before an incident forces learning under duress.
Recommended Actions
- Aggregate and review Snowflake activity logs for unauthorized queries or privilege escalations
- Enforce MFA and minimize local Snowflake user accounts, prefer SSO/federated identity
Snowflake Hacker Pleads Guilty in US Court
Source: SecurityWeek | Risk: High | Impacted: Organizations impacted in Snowflake campaigns, US entities affected by extradited attackers, Cross-border data owners
Summary: Connor Riley Moucka was extradited to the United States in July 2025 after he was arrested in Canada. The post Snowflake Hacker Pleads Guilty in US Court appeared first on SecurityWeek.
Why it matters: This prosecution underscores the international nature of cloud breaches and the continuing challenge of legal jurisdiction and timely response in major platform compromises.
Practitioner Perspective
Global law enforcement cooperation is vital to deter attackers abusing cross-border cloud infrastructure. While prosecution of major threat actors can disrupt ongoing campaigns, defenders should recognize that legal response lags operational risk. Organizations must proactively close access and harden critical data stores rather than count on detection via law enforcement or regulatory notices. A guilty plea signals that tracking and attribution are getting better, but incident containment must start at home.
Recommended Actions
- Correlate cloud breach detection rules across international jurisdictions in SIEMs
- Validate legal and incident response points of contact for cloud storage providers
Emerging Signals
New Zapscape KVM Flaw Could Let Privileged L1 Guest Code Escape to Linux Hosts
Source: The Hacker News | Risk: Critical | Impacted: Cloud providers offering nested virtualization, Linux KVM hypervisor operators, Multi-tenant virtual environments
Summary: Zapscape, a new Linux kernel vulnerability, could allow an attacker with kernel privileges inside an L1 guest virtual machine (VM) to escape KVM isolation and execute code on the host. The risk applies when nested virtualization is exposed to untrusted guests. The flaw is tracked as CVE-2026-64561 and affects KVM/x86’s shadow memory management unit (MMU), which manages shadow page.
Why it matters: Attackers able to compromise an L1 guest VM with kernel access can escape KVM isolation and gain code execution on the Linux host, undermining multi-tenant and cloud hypervisor trust boundaries.
Practitioner Perspective
Environments using nested KVM virtualization, especially public or shared clouds, now face increased risk of host escape via CVE-2026-64561. If attackers control a privileged L1 guest, they can pivot directly into the host OS, breaking isolation and enabling infrastructure-wide compromise. This flaw moves the threat model from VM compromise to hypervisor breach, impacting both service providers and enterprises running sandboxed untrusted workloads. Rapid patch deployment and temporary restriction of nested virtualization features should be prioritized where threat of malicious tenants is non-negligible.
Recommended Actions
- Patch Linux KVM hypervisors with the fix for CVE-2026-64561 as soon as possible
- Enforce controls to prevent untrusted tenants from running L1 guests with kernel privileges
Cisco Patches 12 SD-WAN and IOS XE Flaws, Including Three 9.8 CVSS Score Bugs
Source: The Hacker News | Risk: Critical | Impacted: Organizations running Cisco Catalyst SD-WAN, Enterprises with IOS XE-based routers/switches, Service provider backbone environments
Summary: Cisco has rolled out updates to address multiple critical security vulnerabilities impacting Catalyst SD-WAN and IOS XE Software as part of a comprehensive internal security review. The security issues affect Cisco Catalyst SD-WAN Software, regardless of device configuration, and Cisco IOS XE Software when it is running in autonomous or controller mode.
Why it matters: Unpatched Cisco Catalyst SD-WAN and IOS XE devices are susceptible to remote attacks that could compromise critical routing infrastructure, potentially enabling network takeover.
Practitioner Perspective
Cisco networking products remain foundational but high-value targets, especially in hybrid and distributed enterprises. The existence of three CVSS 9.8 vulnerabilities means attackers can remotely exploit unpatched SD-WAN and IOS XE devices regardless of configuration. Organizations with soft network perimeters or unmanaged SD-WAN assets are especially exposed. Prioritize fast patching in production networks and use this opportunity to inventory shadow devices. Waiting for operational maintenance windows invites adversary exploitation.
Recommended Actions
- Deploy Cisco patches for all affected Catalyst SD-WAN and IOS XE devices, especially those with public exposure
- Monitor for indicators of exploit attempts targeting unpatched IOS XE and SD-WAN endpoints
New Interrupt Injection Attack Can Bypass Spectre v2 Defenses on Intel and AMD CPUs
Source: The Hacker News | Risk: High | Impacted: Linux servers with untrusted local code execution, Cloud platforms with sensitive workloads, Shared multi-user environments on Intel and AMD architectures
Summary: An unprivileged Linux program can time a hardware interrupt to land in the gap between a processor sanitizing its branch predictor and the kernel using it, re-poisoning the predictor after the defense has run. MIT CSAIL researchers Daniël Trujillo and Mengjia Yan named the technique INTERRUPT INJECTION. On an AMD Zen 2 machine running Linux 6.14 with every default Spectre.
Why it matters: Defensive measures for speculative execution attacks can be bypassed on both Intel and AMD CPUs, leaving sensitive in-memory data at risk even on fully patched systems.
Practitioner Perspective
The INTERRUPT INJECTION technique demonstrates that hardware-level timing attacks still have traction against modern CPUs. Defenders who previously believed Spectre v2 mitigations provided sufficient coverage must reassess exposure, particularly for high-sensitivity multi-user Linux hosts. Cloud, CI/CD, and research workloads where tenants run untrusted code are at higher risk. Until microcode or kernel-level mitigations are updated, threat modeling should account for persistent side-channel exposure on even well-configured systems.
Recommended Actions
- Assess kernel version and CPU microcode status on AMD Zen 2 and recent Intel platforms for Spectre v2 defense gaps
- Restrict untrusted code execution on multi-user Linux systems until interrupt-based side-channel mitigations emerge
ThreatsDay: Odysseus RCE, Samsung One-Click Takeover, iCloud Backdoor Fight + 27 More Stories
Source: The Hacker News | Risk: High | Impacted: Organizations using cloud apps, Platforms with third-party integrations, End users reliant on SaaS for core functions
Summary: Apparently, opening the thing is now enough. A repo can run before the first prompt, a package can hide among hundreds, and a harmless-looking PDF can finish the job. This week runs on cheap leverage: exposed servers, recycled bugs, poisoned agent instructions, remote-access tools dressed as support software, and trusted defaults doing attackers a favor. Nothing here is especially mystical.
Why it matters: The diversity and ease of chained attacks highlights the ongoing tension between usability and exposure in SaaS, cloud, and multi-agent ecosystems.
Practitioner Perspective
Today’s threat climate is characterized by high-leverage attacks exploiting unchecked integrations, rapid supply chain adoption, and increasingly creative abuse of default configurations. Each new surfaced vector underscores the need for continuous attack surface monitoring, not just for known CVEs, but for misuse of existing controls. Incident response teams should expect lateral movement through trust boundaries that defenders may not realize they expose.
Recommended Actions
- Review access policies and integration authorizations for business-critical SaaS platforms
- Enable detailed logging and monitoring of all third-party integration traffic in cloud environments
Over 4,400 Rockwell PLCs Exposed Online, 22 Found in Water Attack Cities
Source: The Hacker News | Risk: Critical | Impacted: Water utilities using Rockwell PLCs, Industrial operators with internet-facing controllers, Critical infrastructure asset owners
Summary: Forescout found 22 internet-facing Rockwell Automation programmable logic controllers (PLCs) in cities hit by recent cyberattacks on US water utilities. Nineteen used the same mobile carrier network. Its August 3 scan counted 4,407 exposed Rockwell controllers worldwide, including 2,844 in the United States, but Forescout could not confirm any were compromised.
Why it matters: Internet-exposed Rockwell PLCs in US cities targeted in water utility attacks present a direct vector for critical infrastructure disruption or physical sabotage.
Practitioner Perspective
Industrial control systems, especially Rockwell Automation PLCs, should never be directly accessible from the internet, yet widespread scanning continues to reveal thousands still exposed. The identification of these devices in geographies recently targeted for water utility attacks highlights the persistent failure to enforce segmentation and access control in operational networks. Security teams supporting utilities or manufacturing must treat public PLC exposure as an emergency, not an audit finding. Remove exposure or deploy compensating controls immediately, do not wait for direct evidence of compromise.
Recommended Actions
- Scan for and immediately remove public internet access to Rockwell PLCs using firewall ACLs or VPN segmentation
- Coordinate with NOC/OT teams to validate inventory of all exposed Rockwell Automation controllers
Apple iCloud Private Relay Can Expose Real IPs Through WebKit Proxy Bypasses
Source: The Hacker News | Risk: Medium | Impacted: iOS users employing iCloud Private Relay, Organizations relying on IP masking for privacy, Mobile device privacy advocates
Summary: Cybersecurity researchers have disclosed a security issue with Apple’s iCloud Private Relay tool that can expose a user’s real IP address. Introduced with iOS 15, iCloud Private Relay employs a dual-hop architecture to ensure users’ privacy by routing their Safari web traffic through two relays so that no single third-party, including Apple, can determine where the request is originating from.
Why it matters: Weaknesses in privacy relay implementations defeat assurances for users believing their traffic is anonymized, raising privacy and compliance risks.
Practitioner Perspective
Users and organizations leveraging iCloud Private Relay for privacy must be aware that proxy bypasses can reveal real IP addresses, inadvertently exposing user locations or metadata. Privacy controls in multi-layer relay or anonymization products should be independently validated. Relying solely on advertised privacy features without verification may invite legal or reputational consequences if exposed in investigations or data breach notifications.
Recommended Actions
- Test iCloud Private Relay deployments for proxy bypass behavior on enterprise-managed devices
- Educate privacy-conscious users on the limitations of software-based IP anonymization mechanisms
Attackers Compile khunt Inside Oracle to Turn SQL Injection Into Windows SYSTEM Access
Source: The Hacker News | Risk: High | Impacted: Organizations running public-facing Oracle DBs, Web applications prone to SQL injection, Enterprise Windows servers with database access
Summary: Attackers broke into an organization’s Oracle database through a SQL injection flaw in a public-facing web application, then installed a post-exploitation toolkit without writing an executable to disk. They fed Java source code to the database, let Oracle compile it into stored schema objects, and ran commands from inside the database engine. Huntress, which tracks the toolkit as khunt,.
Why it matters: Sophisticated adversaries are now compiling post-exploitation toolkits like khunt entirely inside Oracle databases, turning SQL injection exploits into full control of Windows hosts without dropping traditional binaries.
Practitioner Perspective
Web-facing Oracle databases are highly attractive targets for attackers who exploit SQL injection to move beyond mere data theft. Compiling attacker-supplied Java directly inside the database sidesteps EDR and traditional OS-level defenses, enabling persistent command execution and privilege escalation, ultimately to SYSTEM on Windows. This technique dramatically increases impact when input validation or query instrumentation is lacking on public web apps interfacing with Oracle. If SQL injection is still regarded as ‘just a data breach risk,’ this scenario demands a re-evaluation of the threat.
Recommended Actions
- Hunt for attacker-supplied Java source artifacts in Oracle schema objects referencing khunt
- Conduct targeted SQL injection penetration testing on public web applications connected to Oracle
Exploits & CVEs
No major new CVE exploit publications or critical vendor CVE advisories in the last 24 hours presented directly in today’s alerts. See above for patch actions aligned to Cisco, KVM, and Oracle vulnerabilities.
Defensive Actions
- Aggregate and review Snowflake activity logs for unauthorized queries or privilege escalations
- Enforce MFA and minimize local Snowflake user accounts, prefer SSO/federated identity
- Patch Linux KVM hypervisors with the fix for CVE-2026-64561 as soon as possible
- Enforce controls to prevent untrusted tenants from running L1 guests with kernel privileges
- Deploy Cisco patches for all affected Catalyst SD-WAN and IOS XE devices, especially those with public exposure
- Monitor for indicators of exploit attempts targeting unpatched IOS XE and SD-WAN endpoints
- Scan for and immediately remove public internet access to Rockwell PLCs using firewall ACLs or VPN segmentation
- Hunt for attacker-supplied Java source artifacts in Oracle schema objects referencing khunt
- Conduct targeted SQL injection penetration testing on public web applications connected to Oracle
- Test iCloud Private Relay deployments for proxy bypass behavior on enterprise-managed devices
What We’re Watching
Defenders should track for rapid developments in KVM patch adoption and Cisco device patching status, ongoing Rockwell PLC exposure, and newly weaponized post-exploitation toolchains leveraging SQL injection. The day’s signal: privilege separation and verification must remain core to any modern environment as adversaries continue to discover and chain new access avenues across the stack.
Categories: Cybersecurity Blog, Cybersecurity News
Leave a Reply