Coverage: Last 24 hours

Today’s Highlights

This cycle demonstrates increasing operational risk from both zero-day exploitation by advanced threat actors and rapid weaponization of publicly disclosed vulnerabilities. Several critical enterprise platforms, including Windows, VMware vCenter, SAP Commerce Cloud, and core SaaS, now face viable attacker tradecraft in the wild. Defenders should expect active exploitation and must shift from detection to aggressive risk reduction, patch management, and SaaS misconfiguration review. The top themes include rapid weaponization of new CVEs, targeted APT campaigns, risks in supply chain and SaaS data, and critical flaws in business process platforms.

Table of Contents

1. WhatsApp Unveils New Scam Alert Feature
2. Stealthy ‘City-Forum’ Attacks Target Salesforce and ServiceNow With Custom Toolset
3. Lazarus Exploits Windows Zero-Day to Gain SYSTEM Access and Deploy Backdoor
4. Attackers Exploit VMware vCenter Vulnerability to Gain Persistent Remote Access
5. SharePoint Vulnerability Exploited Shortly After PoC Release
6. 737 Chrome VPN Extensions Caught Routing Traffic Through Proxies. Check If You Have One
7. Enterprise Defenses Recovered at the Edge and Collapsed Inside
8. SAP Commerce Cloud Flaw Could Let Unauthenticated Attackers Execute Arbitrary Code

Top Stories

WhatsApp Unveils New Scam Alert Feature

Source: SecurityWeek | Risk: Medium | Impacted: WhatsApp users, Messaging platforms

Summary: Signal has also made a security announcement: an automatic key verification feature to complement its safety number system. The post WhatsApp Unveils New Scam Alert Feature appeared first on SecurityWeek.

Why it matters: Messaging platforms continue to roll out security features to combat ongoing social engineering and scam operations, helping users verify contacts and protect against impostor attacks.

Practitioner Perspective

Security teams must stay aware of continual feature rollouts in popular consumer messaging platforms, many of which are adopted informally within business environments. Effective user education and controls around new security features, such as scam alerts and automatic key verification, boost defenses against credential phishing and information exposure via messaging channels.

Recommended Actions

• Review WhatsApp and Signal security features with end users and update internal security guidelines.
• Encourage mobile device management platforms to monitor for adoption of new messaging app security features.

Stealthy ‘City-Forum’ Attacks Target Salesforce and ServiceNow With Custom Toolset

Source: SecurityWeek | Risk: High | Impacted: Salesforce tenants, ServiceNow tenants, Organizations with public or guest SaaS portals

Summary: Researchers observed the novel campaign exploiting unauthenticated guest access to quietly enumerate and exfiltrate exposed data from both platforms. The post Stealthy ‘City-Forum’ Attacks Target Salesforce and ServiceNow With Custom Toolset appeared first on SecurityWeek.

Why it matters: Threat actors are abusing SaaS guest permissions and misconfiguration to access a broad range of business and client data, putting entire organizations at risk regardless of legacy or modern cloud deployments.

Practitioner Perspective

Salesforce and ServiceNow customers must move beyond standard SaaS security checklists. Guest/guest access, misconfigured objects, and open endpoints represent tangible exfiltration risk. This campaign exemplifies post-initial access enumerations rarely flagged by SaaS dashboards, and custom attacker tooling means detection requires tailored log reviews. Overly broad guest access, often a legacy artifact, is now being exploited for both extortion and espionage. Defensive teams should prioritize inventory and kill off public/guest access wherever possible, then review what was accessible prior to remediation.

Recommended Actions

• Audit Salesforce and ServiceNow installations for unauthenticated/guest-accessible objects and endpoints.
• Revoke all public access configurations and enforce least privilege on records and APIs.

Emerging Signals

737 Chrome VPN Extensions Caught Routing Traffic Through Proxies. Check If You Have One

Source: The Hacker News | Risk: High | Impacted: Users of Chrome VPN/proxy extensions, IT teams in Russian-speaking regions, Organizations permitting unmanaged Chrome extension installs

Summary: A massive set of 737 free VPN and proxy extensions have been found to mainly target Russian-speaking users seeking access to blocked services with an aim to intercept browser traffic and route them through a proxy infrastructure. The extensions, published across at least 40 Chrome Web Store developer accounts, racked up 75,486 installs. Of those identified, 274 have been found

Why it matters: Malicious Chrome VPN/proxy extensions have been intercepting user traffic and rerouting it through adversary-controlled infrastructure, exposing organizations to credential theft and session hijacking.

Practitioner Perspective

Organizations with BYOD or unmanaged browser extension policies are exposed to credential phishing, data loss, and traffic interception, especially among Russian-speaking staff. The scale, over 700 extensions and 75,000 installs, shows how easily attacker tooling can add network-based eavesdropping to corporate browsing. Endpoints leveraging Chrome Web Store need targeted control and monitoring. Immediate risk exists wherever proxy extensions are used to bypass regional blocking or corporate network controls. Defenders must treat browser extension inventory and control as a core component of corporate risk.

Recommended Actions

• Audit Chrome extension inventories for presence of the 737 affected VPN/proxy extension IDs.
• Revoke and uninstall all flagged extensions, especially from endpoints handling sensitive data.

Enterprise Defenses Recovered at the Edge and Collapsed Inside

Source: The Hacker News | Risk: Medium | Impacted: Enterprise security teams, Blue team analysts, SOC managers

Summary: Enterprise defenses are tuned to catch the attacks that make noise. This year’s data shows attackers winning by making none. According to Picus Labs’ new Blue Report 2026, which measured more than 338 million real attack simulations across actual client production environments in the first half of 2026, defenses are having one of their strongest years yet. Average prevention effectiveness

Why it matters: Improved prevention rates at the edge challenge attackers, but gaps in detection inside the network mean quiet attackers can still evade layered security and achieve their objectives.

Practitioner Perspective

Although prevention rates are rising at the perimeter, defenders should not be lulled into complacency. Attackers increasingly succeed via stealth, targeting gaps in internal monitoring or response. Blue teamers must focus on detection-in-depth and invest in lateral movement and privilege escalation monitoring, not just catching noisy attacks at ingress points. Simulated attack data remains a valuable benchmarking tool but should be paired with real-world IR readiness.

Recommended Actions

• Review hardening and monitoring controls inside the enterprise network, not just at ingress points.
• Schedule and evaluate internal red team or automated adversary simulations using up-to-date threat models.

SAP Commerce Cloud Flaw Could Let Unauthenticated Attackers Execute Arbitrary Code

Source: The Hacker News | Risk: Critical | Impacted: Ecommerce operations, SAP Commerce admins, Third-party systems integrating with SAP

Summary: SAP has released patches to address a maximum-severity security flaw impacting Commerce Cloud (Data Hub Adapter) that could result in arbitrary code execution. The vulnerability, assigned the CVE identifier CVE-2026-58231, is rated 10.0 on the CVSS scoring system. It has been described as a case of insufficient authorization checks and input validation. “SAP Commerce Cloud allows an

Why it matters: A critical SAP Commerce Cloud vulnerability allows unauthenticated remote code execution, endangering ecommerce and customer data and opening the door to full environment compromise.

Practitioner Perspective

Any enterprise using SAP Commerce Cloud should treat unauthenticated code execution (CVE-2026-58231, CVSS 10.0) as a business continuity risk: attackers can gain a foothold without credentials, likely leading to data breach or service disruption. E-commerce operations, PII handling, and customer data processing are acute targets. Failure to patch or restrict access invites ransomware or supply chain pivots. Regular patch cadence and strict access controls to SAP management and integration endpoints are essential.

Recommended Actions

• Apply SAP’s CVE-2026-58231 patch to all affected Commerce Cloud instances.
• Block unauthenticated external access to Commerce Cloud Data Hub Adapters and management endpoints.

Exploits & CVEs

Lazarus Exploits Windows Zero-Day to Gain SYSTEM Access and Deploy Backdoor

Source: The Hacker News | Risk: High | Impacted: Windows workstations, Domain controllers, Aerospace enterprise networks, Defense contractors

Summary: The North Korean threat actor known as Lazarus Group has been attributed to the zero-day exploitation of a newly patched security flaw impacting Microsoft Windows to deliver a never-before-seen backdoor targeting defense and aerospace companies across France, Germany, Brazil, and India. The activity, per Check Point Research, is part of Operation Dream Job, a long-running cyber espionage and

Why it matters: Nation-state attackers have leveraged an unpatched Windows flaw to deploy persistent backdoors, allowing ongoing espionage access to sensitive sectors’ networks.

Practitioner Perspective

Any defender in defense or aerospace must treat recently patched Windows vulnerabilities as immediately weaponized, especially as Lazarus is targeting multinational environments. This campaign demonstrates attackers’ capacity for rapid exploit development, pre-positioning in vendor supply chains, and SYSTEM-level compromise of endpoints. The focus on persistence and data exfiltration matches historic North Korean tradecraft. Teams need to work under the assumption of post-breach cleanup and must assess for both initial compromise and unauthorized privileges. Expect multi-stage infection chains that may evade initial EDR detection.

Recommended Actions

• Apply the latest Microsoft Windows patches addressing this zero-day across all domains, prioritizing endpoints in defense or aerospace sectors.
• Hunt for backdoor persistence on high-value Windows assets recently patched using IOC feeds from the Check Point Research report.

Attackers Exploit VMware vCenter Vulnerability to Gain Persistent Remote Access

Source: The Hacker News | Risk: Critical | Impacted: VMware vCenter server administrators, Virtual platform operators, Data center network teams

Summary: Threat actors have begun to actively exploit a recently patched critical security flaw in Broadcom VMware vCenter, according to new findings from QUIRSO. The vulnerability in question is CVE-2026-59310 (CVSS score: 9.8), a directory-traversal vulnerability in the VMware vCenter server that a malicious actor with network access can exploit to execute arbitrary code. Patches for the flaw were

Why it matters: Active exploitation of a critical VMware vCenter bug enables attackers to execute arbitrary code, increasing the risk of both lateral movement and persistent access to virtual infrastructure.

Practitioner Perspective

Any organization running VMware vCenter is at direct risk, especially if patch SLAs are not strictly enforced or exposure to management interfaces persists on internal or internet-reachable networks. This CVE-2026-59310 vulnerability provides a practical attacker path to escalate privileges within highly virtualized estates. Given the recent release of a vendor patch and the immediate onset of exploitation, defenders can expect rapid expansion beyond initial foothold. If not patched promptly, expect attackers to establish persistence inside the virtualization layer, complicating IR and containment.

Recommended Actions

• Patch all VMware vCenter servers immediately to remediate CVE-2026-59310 (directory traversal, CVSS 9.8).
• Restrict network access to vCenter management interfaces and monitor for aberrant access attempts.

SharePoint Vulnerability Exploited Shortly After PoC Release

Source: SecurityWeek | Risk: High | Impacted: On-premises SharePoint servers, Hybrid cloud SharePoint operators, IT teams managing Microsoft services

Summary: The vulnerability was patched by Microsoft in July and CISA warned that it could end up being exploited in the wild. The post SharePoint Vulnerability Exploited Shortly After PoC Release appeared first on SecurityWeek.

Why it matters: Proof-of-concept code for a SharePoint vulnerability was weaponized within days, making internal and external SharePoint instances higher-value targets for opportunistic access and lateral movement.

Practitioner Perspective

Microsoft patched the relevant SharePoint vulnerability in July, but exploitation is now confirmed and CISA has issued warnings on timely patching. Environments lagging on patch cycles or running legacy instances will be targeted first. Attackers can abuse these flaws for escalation or data theft, especially post-auth, and SharePoint’s ubiquity makes this an attractive vector for initial access. Critical internal collaboration data and linked authentication tokens are at risk; defenders must prioritize patch validation and assume ongoing scanning for known-vulnerable servers.

Recommended Actions

• Validate installation of July 2026 Microsoft SharePoint security updates fleetwide.
• Monitor for exploitation signatures and lateral movement linked to this vulnerability using CISA advisories.

Defensive Actions

• Apply the latest Microsoft Windows patches addressing the recent zero-day vulnerability, with priority for defense and aerospace endpoints.
• Hunt for backdoor persistence on Windows assets recently patched using current IOC feeds from trusted sources.
• Patch all VMware vCenter servers to remediate CVE-2026-59310 (CVSS 9.8) across all platforms.
• Restrict and monitor network access to vCenter management interfaces for unauthorized attempts.
• Validate the July 2026 Microsoft SharePoint security updates are installed throughout your environment.
• Audit Salesforce and ServiceNow for public/guest-accessible objects, removing unauthenticated access where possible.
• Revoke and uninstall any flagged Chrome VPN/proxy extensions from all managed devices.
• Enforce Chrome Enterprise policies to block unapproved VPN/proxy extensions and monitor related traffic.
• Apply patches for SAP Commerce Cloud CVE-2026-58231 (CVSS 10.0) and block unauthenticated external access to SAP management endpoints.
• Schedule internal red team exercises and update detection logic for lateral movement and quiet attack techniques.

What We’re Watching

Security teams are closely monitoring for additional post-patch exploitation of Microsoft, VMware, and SAP vulnerabilities, as well as evidence of City-Forum toolset deployments across new SaaS platforms. Ongoing review of Chrome extension risk and supply chain exposures in open-source packages remains a top priority for defenders seeking early detection of emerging threats.

Categories: Cybersecurity Blog, Cybersecurity News

Tags: cve, cybersecurity, Malware, threat-intelligence, vulnerability-management